Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 19, 2021, 1:17 p.m.	May 19, 2021, 1:19 p.m.

Size	535.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`6eb844dc579b96afa6c2f361e2f7a410`
SHA256	`9af9895e0820e5f994b317dfb2a6fdfac7c17755985d91d2bb1b3626dbcac5bc`
CRC32	`2DCD11AA`
ssdeep	`12288:2WAY+9AUUCpc8BvRieUKWY6AjwdPS2exLlhrc+JDKz:2WAAfcbieUKWwjwdPS2KcHz`
Yara	Malicious_Library_Zero - Malicious_Library Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

Purchase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe "C:\Users\test22\AppData\Local\Temp\Purchase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe"
8212
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\Purchase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe"
  2600
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\AnJRatXEXZv.exe"
  3684
- schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnJRatXEXZv" /XML "C:\Users\test22\AppData\Local\Temp\tmpC216.tmp"
  5352
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\AnJRatXEXZv.exe"
  2728
- Purchase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe "C:\Users\test22\AppData\Local\Temp\Purchase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe"
  4168

Name	Response	Post-Analysis Lookup
erunski.duckdns.org	A 79.134.225.73	79.134.225.73

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
79.134.225.73	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.102:57660 -> 164.124.101.2:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity

Suricata TLS

No Suricata TLS

Queries for the computername (19 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (7 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 19, 2021, 1:17 p.m.			0	0
IsDebuggerPresent May 19, 2021, 1:17 p.m.			0	0
IsDebuggerPresent May 19, 2021, 1:19 p.m.			0	0
IsDebuggerPresent May 19, 2021, 1:19 p.m.			0	0
IsDebuggerPresent May 19, 2021, 1:19 p.m.			0	0
IsDebuggerPresent May 19, 2021, 1:19 p.m.			0	0
IsDebuggerPresent May 19, 2021, 1:19 p.m.			0	0

Command line console output was observed (28 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\Purc console_handle: 0x00000053	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: hase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe console_handle: 0x0000005f	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\AnJRatX console_handle: 0x00000053	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: EXZv.exe console_handle: 0x0000005f	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: SUCCESS: The scheduled task "Updates\AnJRatXEXZv" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\AnJRatX console_handle: 0x00000053	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: EXZv.exe console_handle: 0x0000005f	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 19, 2021, 1:19 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 138 events)

Time & API	Arguments	Status	Return
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e238 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045ddf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045ddf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045ddf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045e7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045df38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045df38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045df38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045df38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045df38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045df38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045df38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045df38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045df38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045df38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045df38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045df38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045df38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045df38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045ebb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045ebb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045ebb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045ebb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045ebb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045ebb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045ebb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0045ebb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00768020 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007685a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007685a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2021, 1:19 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007685a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 19, 2021, 1:17 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (1 event)

domain

erunski.duckdns.org

Allocates read-write-execute memory (usually to unpack itself) (50 out of 529 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00240000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00270000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02130000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00325000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0032b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00327000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0030c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00317000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0030a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 19, 2021, 1:17 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0030d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c20178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c201a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c201c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c9d2be process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c9d2b2 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c20208 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c76b10 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c76b34 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c76b3c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c76b40 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c76b48 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c76b4c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c76b50 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c76b54 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c76b5c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c76b60 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c76b68 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c76b6c process_handle: 0xffffffff		3221225550

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (6 events)

cmdline	schtasks.exe /Create /TN "Updates\AnJRatXEXZv" /XML "C:\Users\test22\AppData\Local\Temp\tmpC216.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnJRatXEXZv" /XML "C:\Users\test22\AppData\Local\Temp\tmpC216.tmp"
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\Purchase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\Purchase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe"
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\AnJRatXEXZv.exe"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\AnJRatXEXZv.exe"

A process created a hidden window (4 events)

Time & API	Arguments	Status	Return
ShellExecuteExW May 19, 2021, 1:19 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\Purchase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe" filepath: powershell	1	1
ShellExecuteExW May 19, 2021, 1:19 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\AnJRatXEXZv.exe" filepath: powershell	1	1
ShellExecuteExW May 19, 2021, 1:19 p.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\AnJRatXEXZv" /XML "C:\Users\test22\AppData\Local\Temp\tmpC216.tmp" filepath: schtasks.exe	1	1
ShellExecuteExW May 19, 2021, 1:19 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\AnJRatXEXZv.exe" filepath: powershell	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00085000', u'virtual_address': u'0x00002000', u'entropy': 7.874430361196526, u'name': u'.text', u'virtual_size': u'0x00084efc'}

entropy

7.8744303612

description

A section with a high entropy has been found

entropy

0.995322731525

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (5 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW May 19, 2021, 1:19 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 19, 2021, 1:19 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 19, 2021, 1:19 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 19, 2021, 1:19 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 19, 2021, 1:19 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (9 events)

description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	schtasks.exe /Create /TN "Updates\AnJRatXEXZv" /XML "C:\Users\test22\AppData\Local\Temp\tmpC216.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnJRatXEXZv" /XML "C:\Users\test22\AppData\Local\Temp\tmpC216.tmp"

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer	Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 4168 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000398	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 19, 2021, 1:19 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

Purchase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe tried to sleep 46378891 seconds, actually delayed analysis time by 46378891 seconds

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\tmpC216.tmp

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory May 19, 2021, 1:19 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ base_address: 0x00400000 process_identifier: 4168 process_handle: 0x00000398	1	1
WriteProcessMemory May 19, 2021, 1:19 p.m.	buffer: à7 base_address: 0x00420000 process_identifier: 4168 process_handle: 0x00000398	1	1
WriteProcessMemory May 19, 2021, 1:19 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 4168 process_handle: 0x00000398	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory May 19, 2021, 1:19 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ base_address: 0x00400000 process_identifier: 4168 process_handle: 0x00000398	1	1	0

Creates known NJRat files, registry keys and/or mutexes (1 event)

file	C:\Users\test22\AppData\Roaming\AnJRatXEXZv.exe

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 8212 called NtSetContextThread to modify thread in remote process 4168
NtSetContextThread May 19, 2021, 1:19 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003b4 process_identifier: 4168	1	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Local\Temp\Purchase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 8212 resumed a thread in remote process 4168
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000003b4 suspend_count: 1 process_identifier: 4168	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\msra.exe
file	C:\Windows\System32\recdisc.exe

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

Elastic	malicious (high confidence)
DrWeb	Trojan.PackedNET.747
FireEye	Generic.mg.6eb844dc579b96af
McAfee	Artemis!6EB844DC579B
Cylance	Unsafe
Cybereason	malicious.9ecb24
Cyren	W32/MSIL_Agent.BZB.gen!Eldorado
Symantec	Scr.Malcode!gdn30
ESET-NOD32	a variant of MSIL/Kryptik.AAZD
APEX	Malicious
Kaspersky	VHO:Trojan-Spy.MSIL.Noon.gen
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Fareit.hc
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Microsoft	Trojan:Win32/Woreflint.A!cl
Cynet	Malicious (score: 100)
Malwarebytes	Malware.AI.1133796971
Fortinet	MSIL/Kryptik.AAYT!tr
CrowdStrike	win/malicious_confidence_70% (W)

Executed a process and injected code into it, probably while unpacking (40 events)

Time & API	Arguments	Status	Return
NtResumeThread May 19, 2021, 1:17 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 8212	1	0
NtResumeThread May 19, 2021, 1:17 p.m.	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 8212	1	0
NtResumeThread May 19, 2021, 1:17 p.m.	thread_handle: 0x0000019c suspend_count: 1 process_identifier: 8212	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x00000258 suspend_count: 1 process_identifier: 8212	1	0
CreateProcessInternalW May 19, 2021, 1:19 p.m.	thread_identifier: 7476 thread_handle: 0x000003e0 process_identifier: 2600 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\Purchase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003e8	1	1
CreateProcessInternalW May 19, 2021, 1:19 p.m.	thread_identifier: 2648 thread_handle: 0x00000398 process_identifier: 3684 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\AnJRatXEXZv.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003d4	1	1
CreateProcessInternalW May 19, 2021, 1:19 p.m.	thread_identifier: 7908 thread_handle: 0x0000038c process_identifier: 5352 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnJRatXEXZv" /XML "C:\Users\test22\AppData\Local\Temp\tmpC216.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003e8	1	1
CreateProcessInternalW May 19, 2021, 1:19 p.m.	thread_identifier: 6460 thread_handle: 0x0000038c process_identifier: 2728 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\AnJRatXEXZv.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000404	1	1
CreateProcessInternalW May 19, 2021, 1:19 p.m.	thread_identifier: 6956 thread_handle: 0x000003b4 process_identifier: 4168 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\Purchase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\Purchase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000398	1	1
NtGetContextThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000003b4	1	0
NtAllocateVirtualMemory May 19, 2021, 1:19 p.m.	process_identifier: 4168 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000398	1	0
WriteProcessMemory May 19, 2021, 1:19 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ base_address: 0x00400000 process_identifier: 4168 process_handle: 0x00000398	1	1
WriteProcessMemory May 19, 2021, 1:19 p.m.	buffer: base_address: 0x00402000 process_identifier: 4168 process_handle: 0x00000398	1	1
WriteProcessMemory May 19, 2021, 1:19 p.m.	buffer: à7 base_address: 0x00420000 process_identifier: 4168 process_handle: 0x00000398	1	1
WriteProcessMemory May 19, 2021, 1:19 p.m.	buffer: base_address: 0x00422000 process_identifier: 4168 process_handle: 0x00000398	1	1
WriteProcessMemory May 19, 2021, 1:19 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 4168 process_handle: 0x00000398	1	1
NtSetContextThread May 19, 2021, 1:19 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003b4 process_identifier: 4168	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000003b4 suspend_count: 1 process_identifier: 4168	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000003f8 suspend_count: 1 process_identifier: 8212	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2600	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2600	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2600	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000004a4 suspend_count: 1 process_identifier: 2600	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x0000029c suspend_count: 1 process_identifier: 3684	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000002f0 suspend_count: 1 process_identifier: 3684	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x0000044c suspend_count: 1 process_identifier: 3684	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000004ac suspend_count: 1 process_identifier: 3684	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 2728	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000002fc suspend_count: 1 process_identifier: 2728	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x00000458 suspend_count: 1 process_identifier: 2728	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000004b8 suspend_count: 1 process_identifier: 2728	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 4168	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 4168	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000001bc suspend_count: 1 process_identifier: 4168	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x0000028c suspend_count: 1 process_identifier: 4168	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000002bc suspend_count: 1 process_identifier: 4168	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x0000032c suspend_count: 1 process_identifier: 4168	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000003ac suspend_count: 1 process_identifier: 4168	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000003c0 suspend_count: 1 process_identifier: 4168	1	0
NtResumeThread May 19, 2021, 1:19 p.m.	thread_handle: 0x000003d8 suspend_count: 1 process_identifier: 4168	1	0

Purchase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All