Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 3, 2021, 4:45 p.m.	May 3, 2021, 4:54 p.m.

Size	954.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`eef95dc191a017e573233a95dc280409`
SHA256	`a215dde71ddcdda75f000d90179e9a75f1b0b0d23f5bd14ff845ea8e53e4a211`
CRC32	`88BBADF6`
ssdeep	`24576:b9Mr32q+WYTKVA+cvqGcX8fmtIUzlrFoEC:Cqq+WDHQqvVzlrFz`
Yara	Malicious_Library_Zero - Malicious_Library Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

shedyx.exe "C:\Users\test22\AppData\Local\Temp\shedyx.exe"
1016
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\shedyx.exe"
  2480
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\cjuUophFRKyn.exe"
  2728
- schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cjuUophFRKyn" /XML "C:\Users\test22\AppData\Local\Temp\tmp2385.tmp"
  1556
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\cjuUophFRKyn.exe"
  1040

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (19 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2021, 4:54 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent May 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent May 3, 2021, 4:54 p.m.			0	0
IsDebuggerPresent May 3, 2021, 4:54 p.m.			0	0
IsDebuggerPresent May 3, 2021, 4:54 p.m.			0	0

Command line console output was observed (28 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\shed console_handle: 0x00000053	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: yx.exe console_handle: 0x0000005f	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\cjuUoph console_handle: 0x00000053	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: FRKyn.exe console_handle: 0x0000005f	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: SUCCESS: The scheduled task "Updates\cjuUophFRKyn" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\cjuUoph console_handle: 0x00000053	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: FRKyn.exe console_handle: 0x0000005f	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 3, 2021, 4:54 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 141 events)

Time & API	Arguments	Status	Return
CryptExportKey May 3, 2021, 4:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004bb130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004baa30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004baa30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378538 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378ab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378ab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378ab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378cb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378cb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378cb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378cb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378cb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378cb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003784f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003784f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003784f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378ab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378ab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378ab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003780f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378ab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378ab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378ab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378ab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378ab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378ab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378ab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00378d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002e8c38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 3, 2021, 4:45 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 488 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f10000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02020000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00622000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00655000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0065b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00657000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02060000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0062a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0064a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00647000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dde2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02061000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00646000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02062000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02063000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02064000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02065000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02066000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02067000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02068000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02069000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05110178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051101a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051101c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05187e4e process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05187e42 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05110208 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05161788 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051617ac process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051617b4 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051617b8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051617c0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051617c4 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051617c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051617cc process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051617d4 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051617d8 process_handle: 0xffffffff		3221225550

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (6 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\cjuUophFRKyn.exe"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cjuUophFRKyn" /XML "C:\Users\test22\AppData\Local\Temp\tmp2385.tmp"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\shedyx.exe"
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\cjuUophFRKyn.exe"
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\shedyx.exe"
cmdline	schtasks.exe /Create /TN "Updates\cjuUophFRKyn" /XML "C:\Users\test22\AppData\Local\Temp\tmp2385.tmp"

A process created a hidden window (4 events)

Time & API	Arguments	Status	Return
ShellExecuteExW May 3, 2021, 4:47 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\shedyx.exe" filepath: powershell	1	1
ShellExecuteExW May 3, 2021, 4:47 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\cjuUophFRKyn.exe" filepath: powershell	1	1
ShellExecuteExW May 3, 2021, 4:47 p.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\cjuUophFRKyn" /XML "C:\Users\test22\AppData\Local\Temp\tmp2385.tmp" filepath: schtasks.exe	1	1
ShellExecuteExW May 3, 2021, 4:47 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\cjuUophFRKyn.exe" filepath: powershell	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000ea400', u'virtual_address': u'0x00002000', u'entropy': 7.388392384733679, u'name': u'.text', u'virtual_size': u'0x000ea208'}

entropy

7.38839238473

description

A section with a high entropy has been found

entropy

0.982180293501

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW May 3, 2021, 4:47 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2021, 4:54 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2021, 4:54 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2021, 4:54 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Terminates another process (10 events)

Time & API	Arguments	Status
NtTerminateProcess May 3, 2021, 4:47 p.m.	status_code: 0xffffffff process_identifier: 2624 process_handle: 0x000003f8
NtTerminateProcess May 3, 2021, 4:47 p.m.	status_code: 0xffffffff process_identifier: 2624 process_handle: 0x000003f8	1
NtTerminateProcess May 3, 2021, 4:47 p.m.	status_code: 0xffffffff process_identifier: 2452 process_handle: 0x000003d8
NtTerminateProcess May 3, 2021, 4:47 p.m.	status_code: 0xffffffff process_identifier: 2452 process_handle: 0x000003d8	1
NtTerminateProcess May 3, 2021, 4:47 p.m.	status_code: 0xffffffff process_identifier: 2192 process_handle: 0x00000390
NtTerminateProcess May 3, 2021, 4:47 p.m.	status_code: 0xffffffff process_identifier: 2192 process_handle: 0x00000390	1
NtTerminateProcess May 3, 2021, 4:47 p.m.	status_code: 0xffffffff process_identifier: 1888 process_handle: 0x00000404
NtTerminateProcess May 3, 2021, 4:47 p.m.	status_code: 0xffffffff process_identifier: 1888 process_handle: 0x00000404	1
NtTerminateProcess May 3, 2021, 4:47 p.m.	status_code: 0xffffffff process_identifier: 2424 process_handle: 0x00000414
NtTerminateProcess May 3, 2021, 4:47 p.m.	status_code: 0xffffffff process_identifier: 2424 process_handle: 0x00000414	1

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cjuUophFRKyn" /XML "C:\Users\test22\AppData\Local\Temp\tmp2385.tmp"
cmdline	schtasks.exe /Create /TN "Updates\cjuUophFRKyn" /XML "C:\Users\test22\AppData\Local\Temp\tmp2385.tmp"

Allocates execute permission to another process indicative of possible code injection (5 events)

Time & API	Arguments	Return
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 2624 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000039c	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 2452 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003b8	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 2192 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003ec	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1888 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003fc	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 2424 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000408	3221225496

Manipulates memory of a non-child process indicative of process injection (10 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 1016 manipulating memory of non-child process 2624
Process injection	Process 1016 manipulating memory of non-child process 2452
Process injection	Process 1016 manipulating memory of non-child process 2192
Process injection	Process 1016 manipulating memory of non-child process 1888
Process injection	Process 1016 manipulating memory of non-child process 2424
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 2624 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000039c	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 2452 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003b8	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 2192 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003ec	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1888 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003fc	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 2424 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000408	3221225496	0

File has been identified by 14 AntiVirus engines on VirusTotal as malicious (14 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.eef95dc191a017e5
Malwarebytes	Malware.AI.4134295424
Symantec	Scr.Malcode!gdn30
ESET-NOD32	a variant of MSIL/Kryptik.AARY
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Cynet	Malicious (score: 100)
DrWeb	Trojan.PackedNET.624
Microsoft	Trojan:Win32/AgentTesla!ml
BitDefenderTheta	Gen:NN.ZemsilF.34686.7m0@aGkei!b
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/Kryptik.AARD!tr
AVG	Win32:PWSX-gen [Trj]

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Executed a process and injected code into it, probably while unpacking (38 events)

Time & API	Arguments	Status	Return
NtResumeThread May 3, 2021, 4:45 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1016	1	0
NtResumeThread May 3, 2021, 4:45 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1016	1	0
NtResumeThread May 3, 2021, 4:45 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 1016	1	0
NtResumeThread May 3, 2021, 4:47 p.m.	thread_handle: 0x00000254 suspend_count: 1 process_identifier: 1016	1	0
NtGetContextThread May 3, 2021, 4:47 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread May 3, 2021, 4:47 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread May 3, 2021, 4:47 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 1016	1	0
CreateProcessInternalW May 3, 2021, 4:47 p.m.	thread_identifier: 3020 thread_handle: 0x000003e4 process_identifier: 2480 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\shedyx.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003ec	1	1
CreateProcessInternalW May 3, 2021, 4:47 p.m.	thread_identifier: 1180 thread_handle: 0x000003b8 process_identifier: 2728 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\cjuUophFRKyn.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003d8	1	1
CreateProcessInternalW May 3, 2021, 4:47 p.m.	thread_identifier: 2800 thread_handle: 0x00000390 process_identifier: 1556 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cjuUophFRKyn" /XML "C:\Users\test22\AppData\Local\Temp\tmp2385.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003ec	1	1
CreateProcessInternalW May 3, 2021, 4:47 p.m.	thread_identifier: 1232 thread_handle: 0x00000390 process_identifier: 1040 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\cjuUophFRKyn.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000408	1	1
CreateProcessInternalW May 3, 2021, 4:47 p.m.	thread_identifier: 412 thread_handle: 0x000002b8 process_identifier: 2624 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\shedyx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\shedyx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000039c	1	1
NtGetContextThread May 3, 2021, 4:47 p.m.	thread_handle: 0x000002b8	1	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 2624 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000039c		3221225496
CreateProcessInternalW May 3, 2021, 4:47 p.m.	thread_identifier: 2804 thread_handle: 0x000003f8 process_identifier: 2452 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\shedyx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\shedyx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003b8	1	1
NtGetContextThread May 3, 2021, 4:47 p.m.	thread_handle: 0x000003f8	1	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 2452 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003b8		3221225496
CreateProcessInternalW May 3, 2021, 4:47 p.m.	thread_identifier: 2312 thread_handle: 0x000003d8 process_identifier: 2192 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\shedyx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\shedyx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003ec	1	1
NtGetContextThread May 3, 2021, 4:47 p.m.	thread_handle: 0x000003d8	1	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 2192 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003ec		3221225496
CreateProcessInternalW May 3, 2021, 4:47 p.m.	thread_identifier: 996 thread_handle: 0x00000390 process_identifier: 1888 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\shedyx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\shedyx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003fc	1	1
NtGetContextThread May 3, 2021, 4:47 p.m.	thread_handle: 0x00000390	1	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 1888 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003fc		3221225496
CreateProcessInternalW May 3, 2021, 4:47 p.m.	thread_identifier: 2552 thread_handle: 0x00000404 process_identifier: 2424 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\shedyx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\shedyx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000408	1	1
NtGetContextThread May 3, 2021, 4:47 p.m.	thread_handle: 0x00000404	1	0
NtAllocateVirtualMemory May 3, 2021, 4:47 p.m.	process_identifier: 2424 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000408		3221225496
NtResumeThread May 3, 2021, 4:54 p.m.	thread_handle: 0x00000298 suspend_count: 1 process_identifier: 2480	1	0
NtResumeThread May 3, 2021, 4:54 p.m.	thread_handle: 0x000002ec suspend_count: 1 process_identifier: 2480	1	0
NtResumeThread May 3, 2021, 4:54 p.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 2480	1	0
NtResumeThread May 3, 2021, 4:54 p.m.	thread_handle: 0x000004a8 suspend_count: 1 process_identifier: 2480	1	0
NtResumeThread May 3, 2021, 4:54 p.m.	thread_handle: 0x00000298 suspend_count: 1 process_identifier: 2728	1	0
NtResumeThread May 3, 2021, 4:54 p.m.	thread_handle: 0x000002ec suspend_count: 1 process_identifier: 2728	1	0
NtResumeThread May 3, 2021, 4:54 p.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 2728	1	0
NtResumeThread May 3, 2021, 4:54 p.m.	thread_handle: 0x000004a8 suspend_count: 1 process_identifier: 2728	1	0
NtResumeThread May 3, 2021, 4:54 p.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 1040	1	0
NtResumeThread May 3, 2021, 4:54 p.m.	thread_handle: 0x000002fc suspend_count: 1 process_identifier: 1040	1	0
NtResumeThread May 3, 2021, 4:54 p.m.	thread_handle: 0x00000458 suspend_count: 1 process_identifier: 1040	1	0
NtResumeThread May 3, 2021, 4:54 p.m.	thread_handle: 0x000004b8 suspend_count: 1 process_identifier: 1040	1	0

shedyx.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All