Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 9, 2021, 6:12 p.m.	March 9, 2021, 6:14 p.m.

Size	224.2KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`b180f2a24d5dc06cac7012b78c467d1e`
SHA256	`07c81cceba2e04d6daebd227f37525bd931d19491dc6dc903e99b0176f1a9252`
CRC32	`0D5E624E`
ssdeep	`3072:HkxJPZOqw29kUljbj6UjhecHlpdZV1Y9Pysu:yJPZvw29FuelpDV1`
Yara	IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) HasOverlay - Overlay Check Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Zero

bobox.exe "C:\Users\test22\AppData\Local\Temp\bobox.exe"
2088
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\bobox.exe" -Force
  2412
- cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 1
  2416
  - timeout.exe timeout 1
    1892
- bobox.exe "C:\Users\test22\AppData\Local\Temp\bobox.exe"
  1684

Name	Response	Post-Analysis Lookup
liverpoolofcfanclub.com	A 104.21.31.39 A 172.67.174.240	172.67.174.240

IP Address	Status	Action
104.21.31.39	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameA March 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (7 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 9, 2021, 6:12 p.m.			0	0
IsDebuggerPresent March 9, 2021, 6:12 p.m.			0	0
IsDebuggerPresent March 9, 2021, 6:13 p.m.			0	0
IsDebuggerPresent March 9, 2021, 6:13 p.m.			0	0
IsDebuggerPresent March 9, 2021, 6:13 p.m.			0	0
IsDebuggerPresent March 9, 2021, 6:13 p.m.			0	0
IsDebuggerPresent March 9, 2021, 6:13 p.m.			0	0

Command line console output was observed (11 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 9, 2021, 6:13 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW March 9, 2021, 6:13 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW March 9, 2021, 6:13 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW March 9, 2021, 6:13 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW March 9, 2021, 6:13 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\bobo console_handle: 0x00000053	1	1
WriteConsoleW March 9, 2021, 6:13 p.m.	buffer: x.exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW March 9, 2021, 6:13 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW March 9, 2021, 6:13 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW March 9, 2021, 6:13 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW March 9, 2021, 6:13 p.m.	buffer: Waiting for 1 console_handle: 0x00000007	1	1
WriteConsoleW March 9, 2021, 6:13 p.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (49 events)

Time & API	Arguments	Status	Return
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x009115a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x009114e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x009114e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064ba08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c248 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c248 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c248 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c408 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c408 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c408 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c408 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c408 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c408 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064b848 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064b848 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064b848 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c248 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c248 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c248 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c108 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c248 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c248 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c248 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c248 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c248 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c248 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c248 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c4c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c4c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c4c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c4c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c4c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c4c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c4c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 9, 2021, 6:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0064c4c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 9, 2021, 6:12 p.m.		1	1	0

One or more processes crashed (6 events)

Time & API	Arguments	Status
__exception__ March 9, 2021, 6:13 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x728f1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x727c2ba1 mscorlib+0x2f45b0 @ 0x6ff345b0 mscorlib+0x2f73b5 @ 0x6ff373b5 mscorlib+0x2eeaf8 @ 0x6ff2eaf8 mscorlib+0x2eea8f @ 0x6ff2ea8f mscorlib+0x30c43f @ 0x6ff4c43f system+0xe8021 @ 0x6dbd8021 system+0xe7f77 @ 0x6dbd7f77 system+0xd01da @ 0x6dbc01da system+0xcec0d @ 0x6dbbec0d system+0xea387 @ 0x6dbda387 system+0xcec2d @ 0x6dbbec2d system+0x6f7869 @ 0x6f9b7869 system+0x6f6e71 @ 0x6f9b6e71 system+0x6f3892 @ 0x6f9b3892 system+0x6f3514 @ 0x6f9b3514 system+0x6f42ec @ 0x6f9b42ec 0x55475d 0x550198 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 4254608 registers.edi: 0 registers.eax: 4254608 registers.ebp: 4254688 registers.edx: 0 registers.ebx: 9804600 registers.esi: 9059616 registers.ecx: 475199757	1
__exception__ March 9, 2021, 6:13 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x728f1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x727c2ba1 mscorlib+0x2f45a5 @ 0x6ff345a5 mscorlib+0x2f73b5 @ 0x6ff373b5 mscorlib+0x2eeaf8 @ 0x6ff2eaf8 mscorlib+0x2ec3f4 @ 0x6ff2c3f4 system+0xd0c96 @ 0x6dbc0c96 system+0xd33b7 @ 0x6dbc33b7 system+0xd2428 @ 0x6dbc2428 system+0xff01f @ 0x6dbef01f system+0xea215 @ 0x6dbda215 system+0x6f7878 @ 0x6f9b7878 system+0x6f6e71 @ 0x6f9b6e71 system+0x6f3892 @ 0x6f9b3892 system+0x6f3514 @ 0x6f9b3514 system+0x6f42ec @ 0x6f9b42ec 0x55475d 0x550198 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 4254628 registers.edi: 0 registers.eax: 4254628 registers.ebp: 4254708 registers.edx: 0 registers.ebx: 9804600 registers.esi: 9059616 registers.ecx: 475199765	1
__exception__ March 9, 2021, 6:13 p.m.	stacktrace: 0x5a444b4 0x60b32b3 0x55dfe9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x72769df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x72769e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x72769efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x72769fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x727c564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x7279be63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x7279b998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x7279b726 CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x7279bf68 CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x7279bce4 DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x7275cca4 DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x7275cd37 DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x72848841 LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x727c14e9 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d36ad @ 0x6ff136ad mscorlib+0x308f2d @ 0x6ff48f2d microsoft+0x50c17 @ 0x6f130c17 microsoft+0x3f33f @ 0x6f11f33f microsoft+0x3edf8 @ 0x6f11edf8 microsoft+0x3e3b9 @ 0x6f11e3b9 microsoft+0x17e980 @ 0x6f25e980 0x55dfc6 0x55d929 0x5501d6 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 f2 5a 47 6a c7 45 e8 00 00 00 00 c7 45 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5a455eb registers.esp: 4249876 registers.edi: 4249896 registers.eax: 0 registers.ebp: 4249908 registers.edx: 35983912 registers.ebx: 4250704 registers.esi: 35983912 registers.ecx: 0	1
__exception__ March 9, 2021, 6:13 p.m.	stacktrace: 0x5a45585 0x60b32b3 0x55dfe9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x72769df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x72769e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x72769efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x72769fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x727c564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x7279be63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x7279b998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x7279b726 CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x7279bf68 CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x7279bce4 DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x7275cca4 DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x7275cd37 DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x72848841 LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x727c14e9 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d36ad @ 0x6ff136ad mscorlib+0x308f2d @ 0x6ff48f2d microsoft+0x50c17 @ 0x6f130c17 microsoft+0x3f33f @ 0x6f11f33f microsoft+0x3edf8 @ 0x6f11edf8 microsoft+0x3e3b9 @ 0x6f11e3b9 microsoft+0x17e980 @ 0x6f25e980 0x55dfc6 0x55d929 0x5501d6 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 f2 5a 47 6a c7 45 e8 00 00 00 00 c7 45 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5a455eb registers.esp: 4249876 registers.edi: 4249896 registers.eax: 0 registers.ebp: 4249908 registers.edx: 191509132 registers.ebx: 4250704 registers.esi: 191509132 registers.ecx: 0	1
__exception__ March 9, 2021, 6:13 p.m.	stacktrace: 0x5a4ac9e 0x5a4a1f7 0x5a4581f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d36ad @ 0x6ff136ad mscorlib+0x308f2d @ 0x6ff48f2d microsoft+0x50c17 @ 0x6f130c17 microsoft+0x3f33f @ 0x6f11f33f microsoft+0x3edf8 @ 0x6f11edf8 microsoft+0x3e3b9 @ 0x6f11e3b9 microsoft+0x17e980 @ 0x6f25e980 0x55dfc6 0x55d929 0x5501d6 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 01 eb 3e 8d 55 e0 0f b6 01 88 02 0f b6 41 01 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: mscorlib+0x324f62 exception.address: 0x6ff64f62 registers.esp: 4252676 registers.edi: 4252700 registers.eax: 0 registers.ebp: 4252712 registers.edx: 0 registers.ebx: 191787852 registers.esi: 4194364 registers.ecx: 4194364	1
__exception__ March 9, 2021, 6:13 p.m.	stacktrace: 0x791790 0x790fbb DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 e0 8b 4d dc e8 93 d7 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x791c03 registers.esp: 3469872 registers.edi: 3469896 registers.eax: 0 registers.ebp: 3469908 registers.edx: 195 registers.ebx: 3470164 registers.esi: 39294096 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (3 events)

request	GET http://liverpoolofcfanclub.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-D09875ECB32701709B40B53A5F5953C6.html
request	GET http://liverpoolofcfanclub.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-8CD82D0342D740A849EDB3CF376DC9E0.html
request	GET http://liverpoolofcfanclub.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-A7626AB2E55D65F8A60E268E24EFC7D5.html

Allocates read-write-execute memory (usually to unpack itself) (50 out of 210 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00230000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02210000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00292000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00305000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0030b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00307000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0029a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:12 p.m.	process_identifier: 2088 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00551000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2088 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0029c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2088 region_size: 118784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2088 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060be000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2088 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a43000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2088 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a46000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a47000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a48000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a49000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2412 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb71000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb72000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2412 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a62000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0220a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (4 events)

cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\bobox.exe" -Force
cmdline	cmd.exe /c timeout 1
cmdline	"C:\Windows\System32\cmd.exe" /c timeout 1
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\bobox.exe" -Force

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW March 9, 2021, 6:13 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\bobox.exe" -Force filepath: powershell	1	1	0
ShellExecuteExW March 9, 2021, 6:13 p.m.	show_type: 0 filepath_r: cmd.exe parameters: /c timeout 1 filepath: cmd.exe	1	1	0

Moves the original executable to a new location (1 event)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW March 9, 2021, 6:13 p.m.	newfilepath_r: C:\Users\test22\AppData\Local\IEventBindingService\bobox.exe_Url_vmbt4uhnulbmcftyeu0k2ecn20uspdqp\8.574.360.234\user.config flags: 1 oldfilepath_r: C:\Users\test22\AppData\Local\IEventBindingService\bobox.exe_Url_vmbt4uhnulbmcftyeu0k2ecn20uspdqp\8.574.360.234\3sxs52jb.newcfg newfilepath: C:\Users\test22\AppData\Local\IEventBindingService\bobox.exe_Url_vmbt4uhnulbmcftyeu0k2ecn20uspdqp\8.574.360.234\user.config oldfilepath: C:\Users\test22\AppData\Local\IEventBindingService\bobox.exe_Url_vmbt4uhnulbmcftyeu0k2ecn20uspdqp\8.574.360.234\3sxs52jb.newcfg	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 9, 2021, 6:12 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW March 9, 2021, 6:13 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 9, 2021, 6:13 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 9, 2021, 6:13 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Potentially malicious URLs were found in the process memory dump (50 out of 547 events)

url	http://go2.microsoft.com/fwlink/?LinkId=131738
url	http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
url	http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
url	http://microsoft.com0
url	http://XPYnIl.com
url	https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%hash%%torpass%https://www.theonionrouter.com/dist.torproject.org/torbrowser/
url	http://127.0.0.1
url	http://www.microsoft.com/pkiops/docs/primarycps.htm0
url	http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0
url	http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
url	http://beta.visualstudio.net/net/sdk/feedback.asp
url	http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
url	http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
url	http://www.microsoft.com/PKI/docs/CPS/default.htm0
url	http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0
url	http://DynDns.comDynDNS
url	http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
url	http://www.expedia.com/favicon.ico
url	http://uk.ask.com/favicon.ico
url	http://www.priceminister.com/
url	http://crl.identrust.com/DSTROOTCAX3CRL.crl0
url	http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
url	http://www.iask.com/favicon.ico
url	http://www.merlin.com.pl/favicon.ico
url	http://www.cnet.com/favicon.ico
url	http://search.nifty.com/
url	http://ns.adobe.com/exif/1.0/
url	http://www.etmall.com.tw/
url	http://search.goo.ne.jp/
url	http://fr.wikipedia.org/favicon.ico
url	http://busca.estadao.com.br/favicon.ico
url	http://search.hanafos.com/favicon.ico
url	http://search.chol.com/favicon.ico
url	http://amazon.fr/
url	http://www.amazon.co.jp/
url	http://www.mtv.com/favicon.ico
url	http://busqueda.aol.com.mx/
url	http://search.live.com/results.aspx?FORM=SOLTDF
url	http://msdn.microsoft.com/
url	http://www.sogou.com/favicon.ico
url	http://www.sify.com/favicon.ico
url	http://yellowpages.superpages.com/
url	http://suche.freenet.de/
url	http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson
url	http://search.aol.com/
url	http://browse.guardian.co.uk/
url	http://www.mercadolibre.com.mx/
url	http://www.auction.co.kr/auction.ico
url	http://www.facebook.com/
url	http://si.wikipedia.org/favicon.ico

Yara rule detected in process memory (50 out of 247 events)

description	Listen for incoming communication	rule	network_tcp_listen
description	Communications smtp	rule	network_smtp_dotNet
description	Run a keylogger	rule	keylogger
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	email clients info stealer	rule	infoStealer_emailClients_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Create a windows service	rule	create_service
description	Create a COM server	rule	create_com_service
description	Communications over UDP network	rule	network_udp_sock
description	Listen for incoming communication	rule	network_tcp_listen
description	Communications smtp	rule	network_smtp_dotNet
description	Communications over P2P network	rule	network_p2p_win
description	Communications over HTTP	rule	network_http
description	File downloader/dropper	rule	network_dropper
description	Communications over FTP	rule	network_ftp
description	Communications over RAW socket	rule	network_tcp_socket
description	Communications use DNS	rule	network_dns
description	Communication using dga	rule	network_dga
description	Escalade priviledges	rule	escalate_priv
description	Take screenshot	rule	screenshot
description	Dynamic DNS	rule	dyndns
description	Run a keylogger	rule	keylogger
description	Steal credential	rule	cred_local
description	Record Audio	rule	sniff_audio
description	Steal Firefox credential	rule	cred_ff
description	APC queue tasks migration	rule	migrate_apc
description	Malware can spread east-west file	rule	spreading_file
description	Malware can spread east-west using share drive	rule	spreading_share
description	Remote Administration toolkit VNC	rule	rat_vnc
description	Create or check mutex	rule	win_mutex
description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_private_profile
description	Affect private profile	rule	win_files_operation
description	Match Winsock 2 API library declaration	rule	Str_Win32_Winsock2_Library
description	Match Windows Inet API library declaration	rule	Str_Win32_Wininet_Library
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	ftp clients info stealer	rule	infoStealer_ftpClients_Zero
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess March 9, 2021, 6:13 p.m.	status_code: 0xffffffff process_identifier: 2088 process_handle: 0x00000230		0	0
NtTerminateProcess March 9, 2021, 6:13 p.m.	status_code: 0xffffffff process_identifier: 2088 process_handle: 0x00000230	1	0	0

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 1684 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000694	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation March 9, 2021, 6:13 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

bobox.exe tried to sleep 8184628 seconds, actually delayed analysis time by 8184628 seconds

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory March 9, 2021, 6:13 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELM?`àXNv @ À@øuSÀ H.textTV X `.rsrcÀZ@@.reloc ^@B base_address: 0x00400000 process_identifier: 1684 process_handle: 0x00000694	1	1
WriteProcessMemory March 9, 2021, 6:13 p.m.	buffer: 0 HXhäh4VS_VERSION_INFO½ïþ?ÈStringFileInfo¤040904b1, CommentsFURj BFYm(CompanyNameEgc8FileDescriptionALm LBx0FileVersion8.0.5.7: InternalNameRfze TtM.exez+LegalCopyrightCopyright 2020 © Jiu. All rights reserved.2LegalTrademarksYMhKB OriginalFilenameRfze TtM.exe2 ProductNameRfze TtM4ProductVersion1.2.5.68Assembly Version1.2.5.6DVarFileInfo$Translation PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING base_address: 0x00438000 process_identifier: 1684 process_handle: 0x00000694	1	1
WriteProcessMemory March 9, 2021, 6:13 p.m.	buffer: pP6 base_address: 0x0043a000 process_identifier: 1684 process_handle: 0x00000694	1	1
WriteProcessMemory March 9, 2021, 6:13 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 1684 process_handle: 0x00000694	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 9, 2021, 6:13 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELM?`àXNv @ À@øuSÀ H.textTV X `.rsrcÀZ@@.reloc ^@B base_address: 0x00400000 process_identifier: 1684 process_handle: 0x00000694	1	1	0

File has been identified by 11 AntiVirus engines on VirusTotal as malicious (11 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.b180f2a24d5dc06c
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.53da63
BitDefenderTheta	Gen:NN.ZemsilF.34608.om1@aCBq7Tmi
APEX	Malicious
Microsoft	Program:Win32/Wacapew.C!ml
Cynet	Malicious (score: 100)
Malwarebytes	Malware.AI.1759459124
Fortinet	MSIL/Agent.HNL!tr.dldr

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2088 called NtSetContextThread to modify thread in remote process 1684
NtSetContextThread March 9, 2021, 6:13 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4421198 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000698 process_identifier: 1684	1	0	0

Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) (1 event)

url	http://127.0.0.1

url	https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%hash%%torpass%https://www.theonionrouter.com/dist.torproject.org/torbrowser/

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2088 resumed a thread in remote process 1684
NtResumeThread March 9, 2021, 6:13 p.m.	thread_handle: 0x00000698 suspend_count: 1 process_identifier: 1684	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Disables Windows Security features (1 event)

description

attempts to disable user access control

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA

Executed a process and injected code into it, probably while unpacking (50 out of 70 events)

Time & API	Arguments	Status	Return
NtResumeThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2088	1	0
NtResumeThread March 9, 2021, 6:12 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2088	1	0
NtResumeThread March 9, 2021, 6:12 p.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 2088	1	0
NtResumeThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000005a8 suspend_count: 1 process_identifier: 2088	1	0
NtResumeThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000005f8 suspend_count: 1 process_identifier: 2088	1	0
NtGetContextThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2088	1	0
NtGetContextThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2088	1	0
NtGetContextThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2088	1	0
NtGetContextThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2088	1	0
NtGetContextThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2088	1	0
NtGetContextThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2088	1	0
NtGetContextThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread March 9, 2021, 6:12 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2088	1	0
NtGetContextThread March 9, 2021, 6:13 p.m.	thread_handle: 0x000005a8	1	0
NtGetContextThread March 9, 2021, 6:13 p.m.	thread_handle: 0x000005a8	1	0
NtResumeThread March 9, 2021, 6:13 p.m.	thread_handle: 0x000005a8 suspend_count: 1 process_identifier: 2088	1	0
NtResumeThread March 9, 2021, 6:13 p.m.	thread_handle: 0x0000046c suspend_count: 1 process_identifier: 2088	1	0
NtGetContextThread March 9, 2021, 6:13 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 9, 2021, 6:13 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread March 9, 2021, 6:13 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2088	1	0
NtGetContextThread March 9, 2021, 6:13 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 9, 2021, 6:13 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 9, 2021, 6:13 p.m.	thread_handle: 0x000000e4	1	0
NtSetContextThread March 9, 2021, 6:13 p.m.	registers.eip: 1920740228 registers.esp: 4254816 registers.edi: 2111494 registers.eax: 2097207 registers.ebp: 4254820 registers.edx: 59498808 registers.ebx: 58937640 registers.esi: 1830926 registers.ecx: 110600184 thread_handle: 0x000000e4 process_identifier: 2088	1	0
NtResumeThread March 9, 2021, 6:13 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2088	1	0
NtGetContextThread March 9, 2021, 6:13 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 9, 2021, 6:13 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 9, 2021, 6:13 p.m.	thread_handle: 0x000000e4	1	0
NtSetContextThread March 9, 2021, 6:13 p.m.	registers.eip: 1920740228 registers.esp: 4254836 registers.edi: 2111494 registers.eax: 3538993 registers.ebp: 4254840 registers.edx: 64319848 registers.ebx: 63160680 registers.esi: 1531926 registers.ecx: 115421184 thread_handle: 0x000000e4 process_identifier: 2088	1	0
NtResumeThread March 9, 2021, 6:13 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2088	1	0
NtResumeThread March 9, 2021, 6:13 p.m.	thread_handle: 0x0000020c suspend_count: 1 process_identifier: 2088	1	0
CreateProcessInternalW March 9, 2021, 6:13 p.m.	thread_identifier: 852 thread_handle: 0x00000684 process_identifier: 2412 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\bobox.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000688	1	1
NtResumeThread March 9, 2021, 6:13 p.m.	thread_handle: 0x0000066c suspend_count: 1 process_identifier: 2088	1	0
CreateProcessInternalW March 9, 2021, 6:13 p.m.	thread_identifier: 2776 thread_handle: 0x00000690 process_identifier: 2416 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c timeout 1 filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000006a4	1	1
CreateProcessInternalW March 9, 2021, 6:13 p.m.	thread_identifier: 2072 thread_handle: 0x00000698 process_identifier: 1684 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\bobox.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\bobox.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000694	1	1
NtGetContextThread March 9, 2021, 6:13 p.m.	thread_handle: 0x00000698	1	0
NtAllocateVirtualMemory March 9, 2021, 6:13 p.m.	process_identifier: 1684 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000694	1	0

bobox.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All