winlog.exe

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 8, 2021, 5:45 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 8, 2021, 5:45 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5620 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f10000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 3804 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008b0000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\nsjFFB6.tmp\uyx3hk1pib54.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\nsjFFB6.tmp\uyx3hk1pib54.dll

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 8, 2021, 5:45 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host	172.217.25.14

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Process injection	Process 5620 called NtSetContextThread to modify thread in remote process 3804
Time & API	Arguments	Status	Return	Repeated
NtSetContextThread April 8, 2021, 5:45 p.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4313280 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000210 process_identifier: 3804	1	0	0

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

MicroWorld-eScan	Gen:Variant.Jaik.45029
FireEye	Gen:Variant.Jaik.45029
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
K7GW	Riskware ( 0040eff71 )
Cyren	W32/Injector.AGW.gen!Eldorado
ESET-NOD32	a variant of Win32/Injector.EPBH
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Jaik.45029
Ad-Aware	Gen:Variant.Jaik.45029
Emsisoft	Gen:Variant.Jaik.45029 (B)
MAX	malware (ai score=83)
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Win32.Trojan-Stealer.FormBook.AOR85Z
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win.Reputation.R415087
Rising	Trojan.Injector!8.C4 (TFE:dGZlOgamYCdEnTltqQ)
Fortinet	W32/Injector.EPBA!tr
AVG	Win32:PWSX-gen [Trj]
Qihoo-360	QVM42.0.Malware.Gen