Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 18, 2025, 8:07 a.m.	April 18, 2025, 8:09 a.m.

Size	122.6KB
Type	HTML document, UTF-8 Unicode text, with very long lines
MD5	`0b0afec69e7d62568ab3bfdadc92c631`
SHA256	`9efb73f81866197485054c24c3e4e2009a6176eceb045cb2409472848a77f101`
CRC32	`F00EEAAA`
ssdeep	`3072:KoMiMewr4sNZQuG31d4vEMEee8yeeSUknyhFMMlSqPQRvqLYINBzgEr:oydSjyhFvFe0V`
Yara	None matched

chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "C:\Users\test22\AppData\Local\Temp\1 Podgląd wpisu po zmianie _ Ceidg.gov.pl - Centralna Ewidencja i Informacja o Działalności Gospodarczej.html"
2992
- chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xb0,0xb4,0xb8,0x84,0xbc,0x7fef3476e00,0x7fef3476e10,0x7fef3476e20
  792

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (23 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 18, 2025, 7:59 a.m.			0	0
IsDebuggerPresent April 18, 2025, 7:59 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 8 a.m.			0	0
IsDebuggerPresent April 18, 2025, 7:59 a.m.			0	0
IsDebuggerPresent April 18, 2025, 7:59 a.m.			0	0
IsDebuggerPresent April 18, 2025, 7:59 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

file	C:\Program Files (x86)\Google\Chrome\Application\86.0.4240.111\Locales

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ April 18, 2025, 8 a.m.	stacktrace: 0xb90004 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: ff 15 16 1f 09 00 ff 25 00 00 00 00 aa a4 17 77 exception.instruction: call qword ptr [rip + 0x91f16] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb90004 registers.r14: 256765608 registers.r15: 86940000 registers.rcx: 1412 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 256764864 registers.rsp: 256764584 registers.r11: 256768480 registers.r8: 2000388492 registers.r9: 0 registers.rdx: 1428 registers.r12: 256765224 registers.rbp: 256764720 registers.rdi: 87744800 registers.rax: 12124160 registers.r13: 51885696	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 18, 2025, 8 a.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 18, 2025, 8 a.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef69c9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 18, 2025, 7:59 a.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process chrome.exe with pid 2992 crashed
__exception__ April 18, 2025, 8 a.m.	stacktrace: 0xb90004 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: ff 15 16 1f 09 00 ff 25 00 00 00 00 aa a4 17 77 exception.instruction: call qword ptr [rip + 0x91f16] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb90004 registers.r14: 256765608 registers.r15: 86940000 registers.rcx: 1412 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 256764864 registers.rsp: 256764584 registers.r11: 256768480 registers.r8: 2000388492 registers.r9: 0 registers.rdx: 1428 registers.r12: 256765224 registers.rbp: 256764720 registers.rdi: 87744800 registers.rax: 12124160 registers.r13: 51885696	1	0	0

Steals private information from local Internet browsers (23 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6801CE3D-BB0.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Last Version
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\First Run
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Policy\User Policy
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports\8b61f930-395c-464f-b1e4-78ccec5b28bf.dmp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess April 18, 2025, 8:01 a.m.	status_code: 0xc0000005 process_identifier: 2992 process_handle: 0x00000000000000bc		0	0
NtTerminateProcess April 18, 2025, 8:01 a.m.	status_code: 0xc0000005 process_identifier: 2992 process_handle: 0x00000000000000bc	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	chrome.exe				martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1088,2840979663167582456,11263765792253777613,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1152 /prefetch:2
parent_process	chrome.exe				martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xb0,0xb4,0xb8,0x84,0xbc,0x7fef3476e00,0x7fef3476e10,0x7fef3476e20

Resumed a suspended thread in a remote process potentially indicative of process injection (24 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 792 resumed a thread in remote process 2992
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0
NtResumeThread April 18, 2025, 8 a.m.	thread_handle: 0x00000000000000d0 suspend_count: 2 process_identifier: 2992	1	0	0

1 Podgląd wpisu po zmianie _ Ceidg.gov.pl - Centralna Ewidencja i Informacja o Działalności Gospodarczej.html

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All