winlog.exe

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 13, 2021, 9:04 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 13, 2021, 9:04 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 13, 2021, 9:04 a.m.	process_identifier: 5944 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01c80000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 13, 2021, 9:04 a.m.	process_identifier: 5780 region_size: 2600960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006b0000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\nslDD50.tmp\e4utfxiuc.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\nslDD50.tmp\e4utfxiuc.dll

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 13, 2021, 9:04 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Process injection	Process 5944 called NtSetContextThread to modify thread in remote process 5780
Time & API	Arguments	Status	Return	Repeated
NtSetContextThread April 13, 2021, 9:04 a.m.	registers.eip: 2007855256 registers.esp: 1245168 registers.edi: 0 registers.eax: 4313232 registers.ebp: 0 registers.edx: 0 registers.ebx: 2147332096 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001f8 process_identifier: 5780	1	0	0

File has been identified by 43 AntiVirus engines on VirusTotal as malicious (43 events)

MicroWorld-eScan	Gen:Variant.Jaik.45029
ALYac	Trojan.Agent.FormBook
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanSpy:Win32/Predator.b0419902
K7GW	Riskware ( 0040eff71 )
Arcabit	Trojan.Jaik.DAFE5
Cyren	W32/Injector.AGW.gen!Eldorado
Symantec	Trojan Horse
ESET-NOD32	a variant of Win32/Injector.EPBH
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan-Spy.Win32.Noon.gen
BitDefender	Gen:Variant.Jaik.45029
Paloalto	generic.ml
Rising	Trojan.Injector!8.C4 (CLOUD)
Ad-Aware	Gen:Variant.Jaik.45029
Sophos	Mal/Generic-S
Comodo	Malware@#1e1xk51pokd1p
DrWeb	Trojan.Siggen9.48175
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Dropper.dc
FireEye	Gen:Variant.Jaik.45029
Emsisoft	Trojan.Injector (A)
Ikarus	Trojan.Win32.Injector
Webroot	W32.Trojan.Gen
Avira	TR/AD.Swotter.zxrlt
MAX	malware (ai score=88)
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft	Trojan.Win32.Downloader.oa
Microsoft	Trojan:Win32/Predator.MXR!MTB
AegisLab	Trojan.Win32.Jaik.4!c
GData	Win32.Trojan-Stealer.FormBook.UKESDV
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win.Reputation.R415087
McAfee	RDN/Generic.dx
Malwarebytes	Malware.AI.3434765971
Fortinet	W32/Injector.EPBA!tr
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_60% (W)
Qihoo-360	Win32/Trojan.Generic.HyoDcf0A