Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 18, 2025, 10:10 a.m.	Jan. 18, 2025, 10:14 a.m.

Size	2.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`f419e107bdfd77d9589c618cb5e37c0b`
SHA256	`6f4a01fe0d3ececbec11972584e3ccec348514b0d15aecaf190f3bebcac930cd`
CRC32	`4B938CFA`
ssdeep	`49152:WS7aj5p6EdbaXeDK9iuO0zFL/t50yAIUwSuab7SNudXjdTF:n8DddbmeSlZ9jlUwJOJF`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) mzp_file_format - MZP(Delphi) file format UPX_Zero - UPX packed file

Needle_Setup.exe "C:\Users\test22\AppData\Local\Temp\Needle_Setup.exe"
2560
- Needle_Setup.tmp "C:\Users\test22\AppData\Local\Temp\is-4D249.tmp\Needle_Setup.tmp" /SL5="$80178,1953869,161792,C:\Users\test22\AppData\Local\Temp\Needle_Setup.exe"
  2612
  - Needle_Setup.exe "C:\Users\test22\AppData\Local\Temp\Needle_Setup.exe" /VERYSILENT
    2700
    - Needle_Setup.tmp "C:\Users\test22\AppData\Local\Temp\is-9F43C.tmp\Needle_Setup.tmp" /SL5="$90178,1953869,161792,C:\Users\test22\AppData\Local\Temp\Needle_Setup.exe" /VERYSILENT
      2764
      - regsvr32.exe "regsvr32.exe" /s /i:SYNC "C:\Users\test22\AppData\Roaming\\4advapi32.drv"
        2812
        
        regsvr32.exe /s /i:SYNC "C:\Users\test22\AppData\Roaming\\4advapi32.drv"
        2856
        
        powershell.exe "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\test22\AppData\Roaming\4advapi32.drv' }) { exit 0 } else { exit 1 }"
        2900
        
        powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\test22\AppData\Roaming\4advapi32.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{769E47FD-D713-45C5-BB35-F82EE51C0C69}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
        2084

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.196.10.22	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 185.196.10.22:56003 -> 192.168.56.101:49177	2400032	ET DROP Spamhaus DROP Listed Traffic Inbound group 33	Misc Attack
TCP 192.168.56.101:49177 -> 185.196.10.22:56003	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49177 -> 185.196.10.22:56003	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49177 -> 185.196.10.22:56003	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 185.196.10.22:56003 -> 192.168.56.101:49177	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 185.196.10.22:56003 -> 192.168.56.101:49177	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 185.196.10.22:56003 -> 192.168.56.101:49177	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	Domain Observed Used for C2 Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49177 185.196.10.22:56003	CN=Zhnayrp	CN=Zhnayrp	0e:0d:00:ae:7c:c8:7c:9a:46:34:0d:e8:8f:b0:10:f9:57:bb:0e:4f

Queries for the computername (13 events)

Time & API	Arguments	Status	Return
GetComputerNameW Jan. 18, 2025, 10:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2025, 10:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2025, 10:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2025, 10:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2025, 10:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Jan. 18, 2025, 10:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2025, 10:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2025, 10:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2025, 10:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2025, 10:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2025, 10:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Jan. 18, 2025, 10:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2025, 10:03 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 18, 2025, 10:10 a.m.			0	0
IsDebuggerPresent Jan. 18, 2025, 10:10 a.m.			0	0
IsDebuggerPresent Jan. 18, 2025, 10:04 a.m.			0	0
IsDebuggerPresent Jan. 18, 2025, 10:04 a.m.			0	0
IsDebuggerPresent Jan. 18, 2025, 10:03 a.m.			0	0
IsDebuggerPresent Jan. 18, 2025, 10:03 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 94 events)

Time & API	Arguments	Status	Return
CryptExportKey Jan. 18, 2025, 10:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000049c580 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 8	1	1
CryptExportKey Jan. 18, 2025, 10:04 a.m.	buffer: f :zãÛÉXLÈtóÐõ&ÐÐ:¸@ä¿ð\ïÎ{ crypto_handle: 0x000000000049c580 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 8	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000241d80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742740 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742740 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742740 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742740 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742740 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742040 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742040 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742040 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742040 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7429e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7429e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7429e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7426d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7426d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7426d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742e40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742e40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742e40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742e40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742e40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742e40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742f20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742f20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c2f50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c2f50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c2f50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000022a300 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000022a300 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742430 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742430 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742eb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742eb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742eb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b76b380 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b76b380 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b76b3f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b76b3f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b76be00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b76be00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b76c180 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b76c180 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742c10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742c10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742c10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b742c10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000283ce0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2025, 10:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9caf80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 18, 2025, 10:10 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Jan. 18, 2025, 10:10 a.m.	stacktrace: needle_setup+0xdf949 @ 0x4df949 needle_setup+0xfd08a @ 0x4fd08a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1637836 registers.edi: 4885052 registers.eax: 1637836 registers.ebp: 1637916 registers.edx: 0 registers.ebx: 5110089 registers.esi: 2 registers.ecx: 7	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 577 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Jan. 18, 2025, 10:10 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:10 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 90112 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:10 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 73728 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00420000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:10 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:10 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2025, 10:10 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00540000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:10 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:10 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 90112 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:10 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 73728 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00420000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:10 a.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74142000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:10 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74142000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2025, 10:10 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00540000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:03 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef406d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:03 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3eca000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:03 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefcb87000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:03 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd6c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:03 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd7c3000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000021a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002250000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 region_size: 401408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002252000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefeffd000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ba0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000767ce000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000766f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef4ef8000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000024c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002570000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef4e53000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000025f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000026c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef324a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3dd5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef324b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002040000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002080000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 10:04 a.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb4000 process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\is-77DD7.tmp\_isetup\_shfoldr.dll
file	C:\Users\test22\AppData\Local\Temp\is-77DD7.tmp\_isetup\_isdecmp.dll
file	C:\Users\test22\AppData\Local\Temp\is-6BLII.tmp\_isetup\_isdecmp.dll
file	C:\Users\test22\AppData\Local\Temp\is-6BLII.tmp\_isetup\_shfoldr.dll

Creates a shortcut to an executable file (1 event)

file	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\test22\AppData\Roaming\4advapi32.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{769E47FD-D713-45C5-BB35-F82EE51C0C69}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
cmdline	"regsvr32.exe" /s /i:SYNC "C:\Users\test22\AppData\Roaming\\4advapi32.drv"
cmdline	"powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\test22\AppData\Roaming\4advapi32.drv' }) { exit 0 } else { exit 1 }"

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Local\Temp\is-77DD7.tmp\_isetup\_isdecmp.dll
file	C:\Users\test22\AppData\Local\Temp\is-4D249.tmp\Needle_Setup.tmp
file	C:\Users\test22\AppData\Local\Temp\is-77DD7.tmp\_isetup\_shfoldr.dll

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Jan. 18, 2025, 10:10 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\Needle_Setup.exe parameters: /VERYSILENT filepath: C:\Users\test22\AppData\Local\Temp\Needle_Setup.exe	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 events)

Time & API	Arguments	Status	Return
Process32NextW Jan. 18, 2025, 10:03 a.m.	snapshot_handle: 0x00000000000000e0 process_name: mobsync.exe process_identifier: 2296	1	1
Process32NextW Jan. 18, 2025, 10:03 a.m.	snapshot_handle: 0x00000000000000e0 process_name: regsvr32.exe process_identifier: 2812	1	1
Process32NextW Jan. 18, 2025, 10:03 a.m.	snapshot_handle: 0x00000000000000e0 process_name: regsvr32.exe process_identifier: 2856	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Jan. 18, 2025, 10:03 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Jan. 18, 2025, 10:03 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Queries for potentially installed applications (4 events)

Time & API	Arguments	Return
RegOpenKeyExW Jan. 18, 2025, 10:10 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Bitter Fowl_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Bitter Fowl_is1	2
RegOpenKeyExW Jan. 18, 2025, 10:10 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Bitter Fowl_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Bitter Fowl_is1	2
RegOpenKeyExW Jan. 18, 2025, 10:10 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Bitter Fowl_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000008 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Bitter Fowl_is1	2
RegOpenKeyExW Jan. 18, 2025, 10:10 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Bitter Fowl_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000008 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Bitter Fowl_is1	2

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\test22\AppData\Roaming\4advapi32.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{769E47FD-D713-45C5-BB35-F82EE51C0C69}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"

Communicates with host for which no DNS query was performed (1 event)

host

185.196.10.22

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-4D249.tmp\Needle_Setup.tmp

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Uses Sysinternals tools in order to add additional command line functionality (4 events)

cmdline	"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\test22\AppData\Roaming\4advapi32.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{769E47FD-D713-45C5-BB35-F82EE51C0C69}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
cmdline	"regsvr32.exe" /s /i:SYNC "C:\Users\test22\AppData\Roaming\\4advapi32.drv"
cmdline	"powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\test22\AppData\Roaming\4advapi32.drv' }) { exit 0 } else { exit 1 }"
cmdline	/s /i:SYNC "C:\Users\test22\AppData\Roaming\\4advapi32.drv"

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

Lionic	Trojan.Win32.Crysan.m!c
Skyhigh	BehavesLike.Win32.Dropper.vc
Cylance	Unsafe
Sangfor	Trojan.Win32.Agent.Vptk
CrowdStrike	win/grayware_confidence_90% (W)
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Generik.EEASEPD
Kaspersky	Backdoor.MSIL.Crysan.jpq
McAfeeD	ti!6F4A01FE0D3E
Sophos	Mal/Generic-S
Google	Detected
Antiy-AVL	GrayWare/Win32.Wacapew
Kingsoft	Win32.Trojan.Gatak.a
Microsoft	Trojan:Win32/Wacatac.B!ml
Varist	W32/ABTrojan.MMFT-1322
McAfee	Artemis!F419E107BDFD
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware/Suspicious
Ikarus	Win32.Outbreak
Panda	Trj/Chgt.AD

Needle_Setup.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All