Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 4, 2021, 11 a.m.	July 4, 2021, 11:02 a.m.

Size	203.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`a1e165e1926c0c83123c89fce6b1af56`
SHA256	`2d64df6be5fbabdd41d304644e18d6dcab3d1a889df58fa962111e1c76ad2215`
CRC32	`A2E6B437`
ssdeep	`6144:SnSNM0tFUkfgEYxE91e/QkqCh+FjvTBiG+:SSN3zgpxooF3h+FjvTor`
Yara	PE_Header_Zero - PE File Signature Antivirus - Contains references to security software IsPE32 - (no description)

windef.exe "C:\Users\test22\AppData\Local\Temp\windef.exe"
6240
- MicrosoftEdgeCPS.exe "C:\Users\test22\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
  7688
  - powershell.exe "powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1
    3500
- powershell.exe "powershell" Start-Sleep -s 10; Remove-Item -Path 'C:\Users\test22\AppData\Local\Temp\windef.exe' -Force -Recurse
  5192

Name	Response	Post-Analysis Lookup
diamond.serivice.com	A 195.133.40.146	195.133.40.146

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
195.133.40.146	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49807 -> 195.133.40.146:80	2022818	ET MALWARE Generic gate[.].php GET with minimal headers	A Network Trojan was detected
TCP 192.168.56.102:49807 -> 195.133.40.146:80	2030802	ET HUNTING Suspicious GET To gate.php with no Referer	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 4, 2021, 11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2021, 11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2021, 11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2021, 11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 4, 2021, 11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2021, 11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2021, 11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2021, 11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2021, 11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2021, 11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 4, 2021, 11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2021, 11 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 4, 2021, 11 a.m.			0	0
IsDebuggerPresent July 4, 2021, 11 a.m.			0	0

Command line console output was observed (8 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 4, 2021, 11 a.m.	buffer: The term 'Set-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW July 4, 2021, 11 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW July 4, 2021, 11 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW July 4, 2021, 11 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW July 4, 2021, 11 a.m.	buffer: + Set-MpPreference <<<< -DisableRealtimeMonitoring 1 console_handle: 0x00000053	1	1
WriteConsoleW July 4, 2021, 11 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Set-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW July 4, 2021, 11 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW July 4, 2021, 11 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 88 events)

Time & API	Arguments	Status	Return
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028be08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c388 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c388 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c388 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bf08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bf08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bf08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bf08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bf08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bf08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028b9c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028b9c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028b9c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c388 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c388 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c388 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c288 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c388 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c388 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c388 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c388 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c388 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c388 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c388 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bb08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bb08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bb08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bb08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bb08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bb08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bb08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bb08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bb08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bb08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bb08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bb08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bb08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028bb08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c788 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c788 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c788 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0028c788 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003b8bf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003b9430 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003b9430 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003b9430 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003b95f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003b95f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003b95f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2021, 11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003b95f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 4, 2021, 11 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.code

The executable uses a known packer (1 event)

packer

PureBasic 4.x -> Neil Hodgson

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 4, 2021, 11 a.m.	stacktrace: New_wininet_InternetSetOptionA@16+0x91 New_wininet_InternetSetStatusCallback@8-0x6a @ 0x729ca889 InternetSetOptionW+0xe0 InternetQueryOptionW-0x54 wininet+0x3536a @ 0x7514536a microsoftedgecps+0x88c6 @ 0x4088c6 exception.instruction_r: 8b 1b 89 5d 98 c7 45 fc fe ff ff ff 85 c9 0f 85 exception.symbol: InternetOpenA+0x731 InternetCrackUrlA-0x2565 wininet+0x1dd19 exception.instruction: mov ebx, dword ptr [ebx] exception.module: WININET.dll exception.exception_code: 0xc0000005 exception.offset: 122137 exception.address: 0x7512dd19 registers.esp: 1637344 registers.edi: 0 registers.eax: 1 registers.ebp: 1637592 registers.edx: 0 registers.ebx: 1000 registers.esi: 2 registers.ecx: 5708920	1	0	0

Performs some HTTP requests (1 event)

request

GET http://diamond.serivice.com/panel/gate.php?ct=1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 265 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fc91000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0269a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fc92000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02692000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ac1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ac2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0269b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02960000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02961000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02962000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02963000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02964000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02965000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02966000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02967000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02968000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02969000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0296a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0296b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0296c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0296d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0296e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0296f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a73000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a74000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates hidden or system file (2 events)

Time & API	Arguments	Status	Return	Repeated
SetFileAttributesW July 4, 2021, 11 a.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\test22\AppData\Roaming\EdgeCP\ filepath: C:\Users\test22\AppData\Roaming\EdgeCP\	1	1	0
SetFileAttributesW July 4, 2021, 11 a.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\test22\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe filepath: C:\Users\test22\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe	1	1	0

Creates a shortcut to an executable file (2 events)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
file	C:\Users\test22\AppData\Roaming\EdgeCP\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1
cmdline	"powershell" Start-Sleep -s 10; Remove-Item -Path 'C:\Users\test22\AppData\Local\Temp\windef.exe' -Force -Recurse

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\windef.exe

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00006800', u'virtual_address': u'0x0002a000', u'entropy': 7.507146602053799, u'name': u'.rdata', u'virtual_size': u'0x0000675c'}

entropy

7.50714660205

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 4, 2021, 11 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 4, 2021, 11 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\msra.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\recdisc.exe

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Fugrafa.133115
FireEye	Generic.mg.a1e165e1926c0c83
CAT-QuickHeal	Trojan.Snojan
McAfee	GenericRXOV-MJ!A1E165E1926C
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Snojan.875aad7d
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.a4b852
BitDefenderTheta	Gen:NN.ZexaF.34790.mqW@aS!FA6g
Cyren	W32/Rbot.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Agent.ACSB
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	Trojan.Win32.Snojan.ctjj
BitDefender	Gen:Variant.Fugrafa.133115
NANO-Antivirus	Trojan.Win32.SpyEyes.iukpuu
Paloalto	generic.ml
AegisLab	Trojan.Win32.Snojan.4!c
Tencent	Win32.Trojan.Snojan.Lndx
Ad-Aware	Gen:Variant.Fugrafa.133115
Emsisoft	Gen:Variant.Fugrafa.133115 (B)
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R011C0GFE21
McAfee-GW-Edition	BehavesLike.Win32.Swizzor.dh
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Agent
Jiangmin	Trojan.Snojan.dmo
Avira	HEUR/AGEN.1142606
Antiy-AVL	Trojan/Generic.ASMalwS.3377950
Microsoft	Trojan:Win32/Tiggre!rfn
Arcabit	Trojan.Fugrafa.D207FB
GData	Gen:Variant.Fugrafa.133115
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4432449
Acronis	suspicious
VBA32	BScope.TrojanSpy.SpyEyes
ALYac	Gen:Variant.Fugrafa.133115
MAX	malware (ai score=88)
Malwarebytes	Spyware.DiamondFox
TrendMicro-HouseCall	TROJ_GEN.R011C0GFE21
Rising	Backdoor.Diamondfox!1.D569 (CLASSIC)
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Snojan.ACSB!tr
MaxSecure	Trojan.Malware.73764767.susgen

windef.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All