Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Feb. 12, 2025, 1:16 p.m.	Feb. 12, 2025, 1:18 p.m.

Size	4.2MB
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5	`580d01da779f9d2c14ffa548ea4da16e`
SHA256	`331135350bbc1edcbc92cb10aa3d285ea0df48fda73d9838c1a6e9947485dd93`
CRC32	`D592947B`
ssdeep	`98304:Q9pmQDzZAhYAtNDrp6mEj7XPBPiwULkpBUpeStt3499o:u9ZAhLrDCXP6wU0e3499`
Yara	themida_packer - themida packer PE_Header_Zero - PE File Signature anti_vm_detect - Possibly employs anti-virtualization techniques IsPE32 - (no description) UPX_Zero - UPX packed file

random.exe "C:\Users\test22\AppData\Local\Temp\random.exe"
652
- AcroRd32.exe "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744CAF070E41400\15.7.20033\AcroRd32.exe"
  2540
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.156.73.73	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 185.156.73.73:80 -> 192.168.56.103:49166	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 185.156.73.73:80 -> 192.168.56.103:49166	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 185.156.73.73:80 -> 192.168.56.103:49166	2014520	ET INFO EXE - Served Attached HTTP	Misc activity
TCP 185.156.73.73:80 -> 192.168.56.103:49166	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 185.156.73.73:80 -> 192.168.56.103:49166	2014520	ET INFO EXE - Served Attached HTTP	Misc activity

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (7 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 12, 2025, 1:16 p.m.			0	0
IsDebuggerPresent Feb. 12, 2025, 1:16 p.m.			0	0
IsDebuggerPresent Feb. 12, 2025, 1:16 p.m.			0	0
IsDebuggerPresent Feb. 12, 2025, 1:16 p.m.			0	0
IsDebuggerPresent Feb. 12, 2025, 1:16 p.m.			0	0
IsDebuggerPresent Feb. 12, 2025, 1:16 p.m.			0	0
IsDebuggerPresent Feb. 12, 2025, 1:16 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (6 events)

section	\x00
section	.idata
section
section	kxkleecg
section	aynfkejm
section	.taggant

One or more processes crashed (50 out of 126 events)

Time & API	Arguments	Status
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: fb e9 4e 01 00 00 60 8b 74 24 24 8b 7c 24 28 fc exception.symbol: random+0x9820b9 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 9969849 exception.address: 0x14e20b9 registers.esp: 3668960 registers.edi: 0 registers.eax: 1 registers.ebp: 3668976 registers.edx: 23769088 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb e9 93 01 00 00 87 3c 24 5c 81 c6 17 cd d9 1f exception.symbol: random+0x636f24 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6516516 exception.address: 0x1196f24 registers.esp: 3668928 registers.edi: 1971192040 registers.eax: 28869 registers.ebp: 4008464404 registers.edx: 11927552 registers.ebx: 1197932651 registers.esi: 18472622 registers.ecx: 1971388416	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 57 55 c7 04 24 d3 9a ff 37 8b 3c 24 55 e9 09 exception.symbol: random+0x63719b exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6517147 exception.address: 0x119719b registers.esp: 3668928 registers.edi: 1971192040 registers.eax: 0 registers.ebp: 4008464404 registers.edx: 11927552 registers.ebx: 1197932651 registers.esi: 18447314 registers.ecx: 239849	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 52 ba 30 1b fc 7d 81 ee 82 49 7d 79 29 d6 81 exception.symbol: random+0x63854d exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6522189 exception.address: 0x119854d registers.esp: 3668924 registers.edi: 1971192040 registers.eax: 32556 registers.ebp: 4008464404 registers.edx: 5735895 registers.ebx: 1989360879 registers.esi: 18448563 registers.ecx: 661852573	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 68 fd f6 b9 1d 89 3c 24 68 71 3f bf 6f 5f e9 exception.symbol: random+0x638a5c exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6523484 exception.address: 0x1198a5c registers.esp: 3668928 registers.edi: 1971192040 registers.eax: 32556 registers.ebp: 4008464404 registers.edx: 1259 registers.ebx: 0 registers.esi: 18452059 registers.ecx: 661852573	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 50 e9 00 00 00 00 89 1c 24 89 04 24 e9 23 00 exception.symbol: random+0x7b9bd9 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8100825 exception.address: 0x1319bd9 registers.esp: 3668928 registers.edi: 20053803 registers.eax: 26139 registers.ebp: 4008464404 registers.edx: 7006551 registers.ebx: 4294943916 registers.esi: 20027116 registers.ecx: 793378816	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb be 11 57 7f 75 52 e9 66 01 00 00 01 c2 81 c2 exception.symbol: random+0x7bf915 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8124693 exception.address: 0x131f915 registers.esp: 3668928 registers.edi: 20053803 registers.eax: 27294 registers.ebp: 4008464404 registers.edx: 2130566132 registers.ebx: 20078895 registers.esi: 20027116 registers.ecx: 62	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 83 ec 04 89 04 24 b8 e6 6c ff 77 56 be 03 d6 exception.symbol: random+0x7bff37 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8126263 exception.address: 0x131ff37 registers.esp: 3668928 registers.edi: 20053803 registers.eax: 1549541099 registers.ebp: 4008464404 registers.edx: 2130566132 registers.ebx: 20054527 registers.esi: 0 registers.ecx: 62	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 50 b8 70 43 77 3b c1 e8 02 e9 98 fe ff ff bb exception.symbol: random+0x7c2da8 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8138152 exception.address: 0x1322da8 registers.esp: 3668924 registers.edi: 0 registers.eax: 29607 registers.ebp: 4008464404 registers.edx: 20065280 registers.ebx: 20054553 registers.esi: 549937315 registers.ecx: 20054553	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 68 46 8f 51 72 89 0c 24 53 e9 32 03 00 00 87 exception.symbol: random+0x7c2d0c exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8137996 exception.address: 0x1322d0c registers.esp: 3668928 registers.edi: 0 registers.eax: 29607 registers.ebp: 4008464404 registers.edx: 20094887 registers.ebx: 20054553 registers.esi: 549937315 registers.ecx: 20054553	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 51 c7 04 24 96 5f f8 69 e9 6e 05 00 00 ff 34 exception.symbol: random+0x7c2d78 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8138104 exception.address: 0x1322d78 registers.esp: 3668928 registers.edi: 0 registers.eax: 134889 registers.ebp: 4008464404 registers.edx: 20068151 registers.ebx: 20054553 registers.esi: 549937315 registers.ecx: 0	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 ec 04 89 3c 24 54 5f exception.symbol: random+0x7cd378 exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8180600 exception.address: 0x132d378 registers.esp: 3668920 registers.edi: 4206200 registers.eax: 1447909480 registers.ebp: 4008464404 registers.edx: 22104 registers.ebx: 1971327157 registers.esi: 20089592 registers.ecx: 20	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: 0f 3f 07 0b 64 8f 05 00 00 00 00 83 c4 04 83 fb exception.symbol: random+0x7cd759 exception.address: 0x132d759 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 8181593 registers.esp: 3668920 registers.edi: 4206200 registers.eax: 1 registers.ebp: 4008464404 registers.edx: 22104 registers.ebx: 0 registers.esi: 20089592 registers.ecx: 20	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: ed 81 fb 68 58 4d 56 75 0a c7 85 db 2b 2d 12 01 exception.symbol: random+0x7ce334 exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8184628 exception.address: 0x132e334 registers.esp: 3668920 registers.edi: 4206200 registers.eax: 1447909480 registers.ebp: 4008464404 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 20089592 registers.ecx: 10	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: cd 01 eb 00 6a 00 53 e8 03 00 00 00 20 5b c3 5b exception.symbol: random+0x7d10b9 exception.instruction: int 1 exception.module: random.exe exception.exception_code: 0xc0000005 exception.offset: 8196281 exception.address: 0x13310b9 registers.esp: 3668888 registers.edi: 0 registers.eax: 3668888 registers.ebp: 4008464404 registers.edx: 38514577 registers.ebx: 20124151 registers.esi: 1622099892 registers.ecx: 4599	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 52 55 e9 59 00 00 00 81 ed 2d 46 b0 d9 31 eb exception.symbol: random+0x7d1d64 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8199524 exception.address: 0x1331d64 registers.esp: 3668924 registers.edi: 20125734 registers.eax: 27513 registers.ebp: 4008464404 registers.edx: 3650360100 registers.ebx: 38514577 registers.esi: 37906 registers.ecx: 37906	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 29 d2 ff 34 3a e9 b7 ff ff ff bd 14 c6 f7 2c exception.symbol: random+0x7d1ad1 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8198865 exception.address: 0x1331ad1 registers.esp: 3668928 registers.edi: 20153247 registers.eax: 27513 registers.ebp: 4008464404 registers.edx: 3650360100 registers.ebx: 38514577 registers.esi: 37906 registers.ecx: 37906	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb ba 98 87 ff 3f 81 f2 e9 12 b3 7a c1 e2 02 e9 exception.symbol: random+0x7d1968 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8198504 exception.address: 0x1331968 registers.esp: 3668928 registers.edi: 20153247 registers.eax: 27513 registers.ebp: 4008464404 registers.edx: 4294942264 registers.ebx: 38514577 registers.esi: 2283 registers.ecx: 37906	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb e9 a2 f3 ff ff 2d d1 46 35 78 89 c7 58 e9 00 exception.symbol: random+0x7d96e2 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8230626 exception.address: 0x13396e2 registers.esp: 3668924 registers.edi: 20153247 registers.eax: 29778 registers.ebp: 4008464404 registers.edx: 20128428 registers.ebx: 339760737 registers.esi: 2283 registers.ecx: 20154940	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 55 54 5d e9 db 06 00 00 81 c1 f2 e1 d5 3f 81 exception.symbol: random+0x7d8f18 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8228632 exception.address: 0x1338f18 registers.esp: 3668928 registers.edi: 20153247 registers.eax: 29778 registers.ebp: 4008464404 registers.edx: 20128428 registers.ebx: 339760737 registers.esi: 2283 registers.ecx: 20184718	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 56 c7 04 24 35 7c 7f 19 56 be f8 6e c1 b9 29 exception.symbol: random+0x7d924d exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8229453 exception.address: 0x133924d registers.esp: 3668928 registers.edi: 20153247 registers.eax: 29778 registers.ebp: 4008464404 registers.edx: 20128428 registers.ebx: 0 registers.esi: 2298801283 registers.ecx: 20158370	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 52 68 9d cd cd 76 89 34 24 be f7 5f d7 69 81 exception.symbol: random+0x7e17c2 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8263618 exception.address: 0x13417c2 registers.esp: 3668924 registers.edi: 20190382 registers.eax: 31843 registers.ebp: 4008464404 registers.edx: 6 registers.ebx: 38514799 registers.esi: 1971262480 registers.ecx: 0	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 68 ee c4 06 12 e9 4c 01 00 00 29 d6 e9 71 02 exception.symbol: random+0x7e1a8c exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8264332 exception.address: 0x1341a8c registers.esp: 3668928 registers.edi: 20222225 registers.eax: 31843 registers.ebp: 4008464404 registers.edx: 6 registers.ebx: 38514799 registers.esi: 1971262480 registers.ecx: 0	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 68 0f 21 90 4c 89 1c 24 bb aa ed be 7e 87 fb exception.symbol: random+0x7e18b2 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8263858 exception.address: 0x13418b2 registers.esp: 3668928 registers.edi: 20193325 registers.eax: 31843 registers.ebp: 4008464404 registers.edx: 0 registers.ebx: 38514799 registers.esi: 1971262480 registers.ecx: 6949480	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 50 b8 da 6a 6f 7b 25 67 c0 dd 3f e9 8f 01 00 exception.symbol: random+0x7e28fd exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8268029 exception.address: 0x13428fd registers.esp: 3668924 registers.edi: 20193325 registers.eax: 27146 registers.ebp: 4008464404 registers.edx: 2065632003 registers.ebx: 20193679 registers.esi: 1971262480 registers.ecx: 637444268	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb e9 9d fe ff ff 01 fb 50 b8 54 fd 57 3f e9 2c exception.symbol: random+0x7e257a exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8267130 exception.address: 0x134257a registers.esp: 3668928 registers.edi: 20193325 registers.eax: 27146 registers.ebp: 4008464404 registers.edx: 2065632003 registers.ebx: 20220825 registers.esi: 1971262480 registers.ecx: 637444268	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 51 c7 04 24 1b e5 44 09 e9 00 00 00 00 89 2c exception.symbol: random+0x7e2856 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8267862 exception.address: 0x1342856 registers.esp: 3668928 registers.edi: 20193325 registers.eax: 3924199766 registers.ebp: 4008464404 registers.edx: 2065632003 registers.ebx: 20220825 registers.esi: 4294942668 registers.ecx: 637444268	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 55 e9 53 02 00 00 81 f6 4c bf 3f 7f e9 1c fd exception.symbol: random+0x7e866c exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8291948 exception.address: 0x134866c registers.esp: 3668920 registers.edi: 20193325 registers.eax: 20220279 registers.ebp: 4008464404 registers.edx: 1466553401 registers.ebx: 1881797736 registers.esi: 4294942668 registers.ecx: 0	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 57 e9 7e 06 00 00 59 e9 5a ff ff ff 89 04 24 exception.symbol: random+0x80cafb exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8440571 exception.address: 0x136cafb registers.esp: 3668888 registers.edi: 3901653864 registers.eax: 4294937568 registers.ebp: 4008464404 registers.edx: 20399628 registers.ebx: 20363402 registers.esi: 20363466 registers.ecx: 793378816	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 83 ec 04 89 34 24 c7 04 24 78 8b 4e 5f 89 0c exception.symbol: random+0x80d477 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8442999 exception.address: 0x136d477 registers.esp: 3668888 registers.edi: 3901653864 registers.eax: 31529 registers.ebp: 4008464404 registers.edx: 20399628 registers.ebx: 20363402 registers.esi: 20401862 registers.ecx: 825359943	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 68 db e8 e7 4d 89 1c 24 52 ba 2b a6 b7 7f 89 exception.symbol: random+0x80db21 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8444705 exception.address: 0x136db21 registers.esp: 3668888 registers.edi: 0 registers.eax: 1459645024 registers.ebp: 4008464404 registers.edx: 20399628 registers.ebx: 20363402 registers.esi: 20373538 registers.ecx: 825359943	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb e9 a6 fc ff ff 87 34 24 87 0c 24 87 f1 f7 d6 exception.symbol: random+0x80e8e2 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8448226 exception.address: 0x136e8e2 registers.esp: 3668888 registers.edi: 20374240 registers.eax: 80172881 registers.ebp: 4008464404 registers.edx: 20373568 registers.ebx: 4294943344 registers.esi: 20401996 registers.ecx: 0	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 53 c7 04 24 ec 24 b8 3d 89 04 24 e9 e1 05 00 exception.symbol: random+0x80f5ee exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8451566 exception.address: 0x136f5ee registers.esp: 3668884 registers.edi: 20374240 registers.eax: 26984 registers.ebp: 4008464404 registers.edx: 2059975715 registers.ebx: 20378461 registers.esi: 20401996 registers.ecx: 0	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 55 89 e5 e9 7a 02 00 00 29 34 24 5e 50 b8 84 exception.symbol: random+0x80faaa exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8452778 exception.address: 0x136faaa registers.esp: 3668888 registers.edi: 20374240 registers.eax: 26984 registers.ebp: 4008464404 registers.edx: 2059975715 registers.ebx: 20405445 registers.esi: 20401996 registers.ecx: 0	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 55 68 27 1c ff 5f 5d 56 be ec bc e5 5e 81 e6 exception.symbol: random+0x80f9f2 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8452594 exception.address: 0x136f9f2 registers.esp: 3668888 registers.edi: 0 registers.eax: 26984 registers.ebp: 4008464404 registers.edx: 2059975715 registers.ebx: 20381233 registers.esi: 1442867808 registers.ecx: 0	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 52 ba 95 93 bf 5d 81 ca a1 e4 7b 3f c1 ea 05 exception.symbol: random+0x814021 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8470561 exception.address: 0x1374021 registers.esp: 3668884 registers.edi: 0 registers.eax: 27444 registers.ebp: 4008464404 registers.edx: 0 registers.ebx: 20397317 registers.esi: 1442867808 registers.ecx: 1969225870	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 68 4a 4a e6 2e 89 34 24 81 ec 04 00 00 00 89 exception.symbol: random+0x814696 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8472214 exception.address: 0x1374696 registers.esp: 3668888 registers.edi: 0 registers.eax: 27444 registers.ebp: 4008464404 registers.edx: 0 registers.ebx: 20424761 registers.esi: 1442867808 registers.ecx: 1969225870	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 52 e9 78 ff ff ff 83 e8 04 87 04 24 5c e9 34 exception.symbol: random+0x814235 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8471093 exception.address: 0x1374235 registers.esp: 3668888 registers.edi: 68073 registers.eax: 27444 registers.ebp: 4008464404 registers.edx: 0 registers.ebx: 20424761 registers.esi: 1442867808 registers.ecx: 4294942896	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb e9 8f 02 00 00 bf cb e3 96 1c 31 f9 5f ff 34 exception.symbol: random+0x814d41 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8473921 exception.address: 0x1374d41 registers.esp: 3668888 registers.edi: 68073 registers.eax: 31843 registers.ebp: 4008464404 registers.edx: 0 registers.ebx: 0 registers.esi: 20403800 registers.ecx: 24811	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb e9 45 fb ff ff 56 f7 14 24 5e 87 f3 c1 eb 04 exception.symbol: random+0x8177d7 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8484823 exception.address: 0x13777d7 registers.esp: 3668884 registers.edi: 68073 registers.eax: 29652 registers.ebp: 4008464404 registers.edx: 0 registers.ebx: 2056231195 registers.esi: 20411026 registers.ecx: 70394703	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 57 83 ec 04 89 0c 24 b9 55 19 c5 25 e9 22 00 exception.symbol: random+0x817a93 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8485523 exception.address: 0x1377a93 registers.esp: 3668888 registers.edi: 68073 registers.eax: 29652 registers.ebp: 4008464404 registers.edx: 0 registers.ebx: 2056231195 registers.esi: 20440678 registers.ecx: 70394703	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 68 65 1b df 7f 89 3c 24 51 68 e3 df fd 7d 59 exception.symbol: random+0x817704 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8484612 exception.address: 0x1377704 registers.esp: 3668888 registers.edi: 68073 registers.eax: 148610152 registers.ebp: 4008464404 registers.edx: 0 registers.ebx: 0 registers.esi: 20413766 registers.ecx: 70394703	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 53 e9 48 00 00 00 29 74 24 04 81 44 24 04 a1 exception.symbol: random+0x8184e3 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8488163 exception.address: 0x13784e3 registers.esp: 3668888 registers.edi: 68073 registers.eax: 29185 registers.ebp: 4008464404 registers.edx: 20443353 registers.ebx: 1388651474 registers.esi: 20413766 registers.ecx: 70394703	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 55 c7 04 24 92 af ff 6d 55 e9 66 fe ff ff ff exception.symbol: random+0x8189e6 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8489446 exception.address: 0x13789e6 registers.esp: 3668888 registers.edi: 0 registers.eax: 29185 registers.ebp: 4008464404 registers.edx: 20417201 registers.ebx: 1388651474 registers.esi: 266950224 registers.ecx: 70394703	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 68 9b c8 00 7f 89 34 24 89 e6 50 55 bd e8 4a exception.symbol: random+0x81fec1 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8519361 exception.address: 0x137fec1 registers.esp: 3668888 registers.edi: 1259543589 registers.eax: 26037 registers.ebp: 4008464404 registers.edx: 2130566132 registers.ebx: 2147483650 registers.esi: 20472711 registers.ecx: 793378816	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 51 c7 04 24 61 50 bf 6d 81 2c 24 24 87 7f 7f exception.symbol: random+0x81fdf6 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8519158 exception.address: 0x137fdf6 registers.esp: 3668888 registers.edi: 1259543589 registers.eax: 26037 registers.ebp: 4008464404 registers.edx: 2130566132 registers.ebx: 1373669712 registers.esi: 20472711 registers.ecx: 4294943992	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 68 6f 97 8d 11 89 1c 24 bb cc a4 3e 7c 43 f7 exception.symbol: random+0x8307c2 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8587202 exception.address: 0x13907c2 registers.esp: 3668884 registers.edi: 918951255 registers.eax: 28057 registers.ebp: 4008464404 registers.edx: 20514001 registers.ebx: 20483975 registers.esi: 5357548 registers.ecx: 0	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 31 c0 ff 34 02 e9 e9 fd ff ff f7 d1 81 f1 82 exception.symbol: random+0x830767 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8587111 exception.address: 0x1390767 registers.esp: 3668888 registers.edi: 918951255 registers.eax: 28057 registers.ebp: 4008464404 registers.edx: 20542058 registers.ebx: 20483975 registers.esi: 5357548 registers.ecx: 0	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 68 29 07 52 5a 89 2c 24 89 04 24 57 89 34 24 exception.symbol: random+0x830929 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8587561 exception.address: 0x1390929 registers.esp: 3668888 registers.edi: 918951255 registers.eax: 4294941920 registers.ebp: 4008464404 registers.edx: 20542058 registers.ebx: 20483975 registers.esi: 2298801283 registers.ecx: 0	1
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: fb 53 89 14 24 51 c7 04 24 52 71 1a 49 e9 7e fd exception.symbol: random+0x83e48f exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8643727 exception.address: 0x139e48f registers.esp: 3668888 registers.edi: 4023722812 registers.eax: 28318 registers.ebp: 4008464404 registers.edx: 2153464 registers.ebx: 4026397567 registers.esi: 20596717 registers.ecx: 22720111	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (5 events)

suspicious_features	Connection to IP address	suspicious_request	GET http://185.156.73.73/success?substr=mixtwo&s=three&sub=non
suspicious_features	Connection to IP address	suspicious_request	GET http://185.156.73.73/info
suspicious_features	Connection to IP address	suspicious_request	GET http://185.156.73.73/update
suspicious_features	Connection to IP address	suspicious_request	GET http://185.156.73.73/service
suspicious_features	Connection to IP address	suspicious_request	GET http://185.156.73.73/ycl

Performs some HTTP requests (5 events)

request	GET http://185.156.73.73/success?substr=mixtwo&s=three&sub=non
request	GET http://185.156.73.73/info
request	GET http://185.156.73.73/update
request	GET http://185.156.73.73/service
request	GET http://185.156.73.73/ycl

Allocates read-write-execute memory (usually to unpack itself) (12 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Feb. 12, 2025, 1:16 p.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7793f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 12, 2025, 1:16 p.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 12, 2025, 1:16 p.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 2469888 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b61000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 12, 2025, 1:16 p.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00960000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 12, 2025, 1:16 p.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 12, 2025, 1:16 p.m.	process_identifier: 652 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 12, 2025, 1:16 p.m.	process_identifier: 652 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 12, 2025, 1:16 p.m.	process_identifier: 652 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 12, 2025, 1:16 p.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 12, 2025, 1:16 p.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 12, 2025, 1:16 p.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 12, 2025, 1:16 p.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Feb. 12, 2025, 1:09 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 9929404416 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1	0

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\GY6s92RSeAf327rE2wrBw\Bunifu_UI_v1.5.3.dll
file	C:\Users\test22\AppData\Local\Temp\GY6s92RSeAf327rE2wrBw\Y-Cleaner.exe
file	C:\Users\test22\Desktop\YCL.lnk

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\Desktop\YCL.lnk

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\GY6s92RSeAf327rE2wrBw\Y-Cleaner.exe
file	C:\Users\test22\AppData\Local\Temp\GY6s92RSeAf327rE2wrBw\Bunifu_UI_v1.5.3.dll

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Feb. 12, 2025, 1:16 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 65536 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x10001000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x0025a400', u'virtual_address': u'0x00001000', u'entropy': 7.989168150691731, u'name': u' \\x00 ', u'virtual_size': u'0x00622000'}

entropy

7.98916815069

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00002000', u'virtual_address': u'0x00623000', u'entropy': 7.826271143356675, u'name': u'.rsrc', u'virtual_size': u'0x00010b7c'}

entropy

7.82627114336

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x001c8000', u'virtual_address': u'0x00982000', u'entropy': 7.923059091384781, u'name': u'kxkleecg', u'virtual_size': u'0x001c8000'}

entropy

7.92305909138

description

A section with a high entropy has been found

entropy

0.997412982126

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Feb. 12, 2025, 1:16 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Expresses interest in specific running processes (1 event)

process

system

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://ns.adobe.com/xap/1.0/mm/
url	http://ns.adobe.com/xap/1.0/sType/ResourceRef
url	http://ns.adobe.com/xap/1.0/

Yara rule detected in process memory (16 events)

description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Communications over HTTP	rule	Network_HTTP
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Run a KeyLogger	rule	KeyLogger

Communicates with host for which no DNS query was performed (1 event)

host

185.156.73.73

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Feb. 12, 2025, 1:16 p.m.	process_identifier: 2540 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000214	1	0	0

Checks for the presence of known devices from debuggers and forensic tools (3 events)

file	\??\SICE
file	\??\SIWVID
file	\??\NTICE

Checks for the presence of known windows from debuggers and forensic tools (47 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: #0 window_name: Registry Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Feb. 12, 2025, 1:16 p.m.	class_name: pediy06 window_name:		0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Feb. 12, 2025, 1:16 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Network activity contains more than one unique useragent (4 events)

process	AcroRd32.exe	useragent	1
process	AcroRd32.exe	useragent	C
process	AcroRd32.exe	useragent	d
process	AcroRd32.exe	useragent	s

An executable file was downloaded by the process acrord32.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile Feb. 12, 2025, 1:16 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELJlïXà!¨.Æ à @ÔÅWà H.text4¦ ¨ `.rsrcàª@@.reloc°@BÆH `4eU}Yy={Xx=rpo2 o(3 o2 }:s(2rßp(; &Vr¨pr¨p( >þ} ¾(C Öo(D (E } (F (E (G &>þ}ª(C Öo(D }(F (E (H &"þ>þ }R} { oo { "}!{!ê}{#{op {, { oo {!oo {Bsu (v {#{# request_handle: 0x00cc000c	1	1	0
InternetReadFile Feb. 12, 2025, 1:17 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÁ°à"0Zy @ À`ØxOl ¼x H.text0Y Z `.rsrcl\@@.reloc l@ByH}lATl¾Pº ( ( ®~-rpÐ( o s ~~*j(r3p~o tj(rCp~o tj(rp~o tj(rÁp~o tj(rÏp~o tj(ráp~o tj(rp~o t~( Vs( tN( ((0f( 8M o 9: o o -a{=% o ¢% request_handle: 0x00cc000c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 652 called NtSetContextThread to modify thread in remote process 2540
NtSetContextThread Feb. 12, 2025, 1:16 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4233272 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000218 process_identifier: 2540	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 652 resumed a thread in remote process 2540
NtResumeThread Feb. 12, 2025, 1:16 p.m.	thread_handle: 0x00000218 suspend_count: 1 process_identifier: 2540	1	0	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Feb. 12, 2025, 1:16 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 ec 04 89 3c 24 54 5f exception.symbol: random+0x7cd378 exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8180600 exception.address: 0x132d378 registers.esp: 3668920 registers.edi: 4206200 registers.eax: 1447909480 registers.ebp: 4008464404 registers.edx: 22104 registers.ebx: 1971327157 registers.esi: 20089592 registers.ecx: 20	1	0	0

Detects the presence of Wine emulator (1 event)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress Feb. 12, 2025, 1:16 p.m.	ordinal: 0 function_address: 0x0037f879 function_name: wine_get_version module: ntdll module_address: 0x778a0000		3221225785	0

Executed a process and injected code into it, probably while unpacking (8 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Feb. 12, 2025, 1:16 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: C:\Windows\Boot\PCAT\memtest.exe track: 0 command_line: filepath_r: C:\Windows\Boot\PCAT\memtest.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000		0
NtGetContextThread Feb. 12, 2025, 1:16 p.m.	thread_handle: 0x00000210	1	0
NtResumeThread Feb. 12, 2025, 1:16 p.m.	thread_handle: 0x00000210 suspend_count: 1 process_identifier: 652	1	0
CreateProcessInternalW Feb. 12, 2025, 1:16 p.m.	thread_identifier: 2544 thread_handle: 0x00000218 process_identifier: 2540 current_directory: filepath: C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744CAF070E41400\15.7.20033\AcroRd32.exe track: 1 command_line: filepath_r: C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744CAF070E41400\15.7.20033\AcroRd32.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000214	1	1
NtGetContextThread Feb. 12, 2025, 1:16 p.m.	thread_handle: 0x00000218	1	0
NtAllocateVirtualMemory Feb. 12, 2025, 1:16 p.m.	process_identifier: 2540 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000214	1	0
NtSetContextThread Feb. 12, 2025, 1:16 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4233272 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000218 process_identifier: 2540	1	0
NtResumeThread Feb. 12, 2025, 1:16 p.m.	thread_handle: 0x00000218 suspend_count: 1 process_identifier: 2540	1	0

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Cynet	Malicious (score: 99)
CTX	exe.unknown.zusy
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.581206
CrowdStrike	win/malicious_confidence_90% (D)
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Packed.Themida.Gen.BGZ
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Zusy.581206
MicroWorld-eScan	Gen:Variant.Zusy.581206
Emsisoft	Gen:Variant.Zusy.581206 (B)
F-Secure	Heuristic.HEUR/AGEN.1314794
McAfeeD	ti!331135350BBC
Trapmine	malicious.high.ml.score
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.580d01da779f9d2c
Google	Detected
Avira	HEUR/AGEN.1314794
Kingsoft	Win32.Trojan.Generic.a
Gridinsoft	Trojan.Heur!.038121A1
Arcabit	Trojan.Zusy.D8DE56
Microsoft	Trojan:Win32/Wacatac.B!ml
AhnLab-V3	Trojan/Win.Evo-gen.C5728871
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.3199381110
Ikarus	Trojan-PSW.Agent
Zoner	Probably Heur.ExeHeaderL
Tencent	Win32.Trojan.Generic.Bdhl
MaxSecure	Trojan.Malware.300983.susgen

random.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All