Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 7, 2021, 10:44 a.m.	July 7, 2021, 10:46 a.m.

Size	8.7MB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`e19685fb5d65e400f2dc9f6af799e637`
SHA256	`a60549d08d066eeb7cce46f19cd62b426b82f5f56512f9a6cd3c9781f3a67a6b`
CRC32	`D44337B3`
ssdeep	`196608:hDAQAUixXAdXU4ZkgCnU+Yu26kuA/CHksNE+fBJ+BM3D:hRAxxS/BCU+o6kJCHksK+VD`
Yara	NPKI_Zero - File included NPKI IsPE64 - (no description) PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

ConsoleApp2.exe "C:\Users\test22\AppData\Local\Temp\ConsoleApp2.exe"
3588
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\_Gorlno.vbs"
  8772
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Skype.exe'
    6324

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 7, 2021, 10:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 7, 2021, 10:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 7, 2021, 10:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 7, 2021, 10:38 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 7, 2021, 10:37 a.m.			0	0
IsDebuggerPresent July 7, 2021, 10:37 a.m.			0	0
IsDebuggerPresent July 7, 2021, 10:38 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (1 event)

Time & API	Arguments	Status	Return	Repeated
CryptExportKey July 7, 2021, 10:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000035f1a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 7, 2021, 10:37 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 7, 2021, 10:38 a.m.	stacktrace: K32InitializeProcessForWsWatch+0x16d K32EnumPageFilesW-0x333 kernel32+0x3f45d @ 0x76e7f45d K32EnumProcessModules+0x11 K32EnumPageFilesA-0x19f kernel32+0x53fe1 @ 0x76e93fe1 0x7fe92d2e534 0x7fe92d2e47e 0x7fe92d2ab89 0x7fe92d29f64 0x7fe92d1f598 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef23af713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef23af242 StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef23fb042 StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef23fad83 mscorlib+0x563bfc @ 0x7fef0173bfc mscorlib+0x486001 @ 0x7fef0096001 mscorlib+0x524b8e @ 0x7fef0134b8e 0x7fe92cf53db 0x7fe92cf521a 0x7fe92cf4062 0x7fe92cf36b5 0x7fe92cf34e9 system+0x30a7f9 @ 0x7feec68a7f9 system+0x2f5af4 @ 0x7feec675af4 system+0x2f5894 @ 0x7feec675894 system+0x308bc4 @ 0x7feec688bc4 system+0x2f856b @ 0x7feec67856b system+0x306acb @ 0x7feec686acb system+0x2f808a @ 0x7feec67808a system+0x8f83f7 @ 0x7feecc783f7 DestroyAssemblyConfigCookie+0x132aa PreBindAssembly-0xe5a6 clr+0xf482e @ 0x7fef245482e TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x770d9bd1 SetWindowTextW+0x277 SetWindowLongPtrW-0x3f5 user32+0x172cb @ 0x770d72cb IsDialogMessageW+0x169 SetTimer-0x107 user32+0x16829 @ 0x770d6829 KiUserCallbackDispatcher+0x1f KiUserExceptionDispatcher-0x25 ntdll+0x51225 @ 0x77211225 ShowWindow+0xa LoadMenuIndirectA-0xa6e user32+0x1193a @ 0x770d193a system+0x324bc7 @ 0x7feec6a4bc7 system+0x2f43b9 @ 0x7feec6743b9 system+0x305edd @ 0x7feec685edd system+0x31132a @ 0x7feec69132a system+0x31107f @ 0x7feec69107f 0x7fe92cf1493 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef23af713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef23af242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef23af30b _CorExeMain+0x335c ClrCreateManagedInstance-0x15ae4 clr+0x1e721c @ 0x7fef254721c _CorExeMain+0x3ab6 ClrCreateManagedInstance-0x1538a clr+0x1e7976 @ 0x7fef2547976 _CorExeMain+0x39b0 ClrCreateManagedInstance-0x15490 clr+0x1e7870 @ 0x7fef2547870 _CorExeMain+0x3526 ClrCreateManagedInstance-0x1591a clr+0x1e73e6 @ 0x7fef25473e6 _CorExeMain+0x347e ClrCreateManagedInstance-0x159c2 clr+0x1e733e @ 0x7fef254733e _CorExeMain+0x14 ClrCreateManagedInstance-0x18e2c clr+0x1e3ed4 @ 0x7fef2543ed4 _CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef3cd74e5 _CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef3eb5b21 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76e5652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x771ec521 exception.instruction_r: 49 89 04 cf eb 13 8b c8 ff 15 95 d7 05 00 8b c8 exception.symbol: K32InitializeProcessForWsWatch+0x16d K32EnumPageFilesW-0x333 kernel32+0x3f45d exception.instruction: mov qword ptr [r15 + rcx*8], rax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 259165 exception.address: 0x76e7f45d registers.r14: 0 registers.r15: 0 registers.rcx: 0 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 5635888 registers.r11: 514 registers.r8: 5623448 registers.r9: 5623504 registers.rdx: 0 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1204682752 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

July 7, 2021, 10:38 a.m.

stacktrace:

K32InitializeProcessForWsWatch+0x16d K32EnumPageFilesW-0x333 kernel32+0x3f45d @ 0x76e7f45d
K32EnumProcessModules+0x11 K32EnumPageFilesA-0x19f kernel32+0x53fe1 @ 0x76e93fe1
0x7fe92d2e534
0x7fe92d2e47e
0x7fe92d2ab89
0x7fe92d29f64
0x7fe92d1f598
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef23af713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef23af242
StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef23fb042
StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef23fad83
mscorlib+0x563bfc @ 0x7fef0173bfc
mscorlib+0x486001 @ 0x7fef0096001
mscorlib+0x524b8e @ 0x7fef0134b8e
0x7fe92cf53db
0x7fe92cf521a
0x7fe92cf4062
0x7fe92cf36b5
0x7fe92cf34e9
system+0x30a7f9 @ 0x7feec68a7f9
system+0x2f5af4 @ 0x7feec675af4
system+0x2f5894 @ 0x7feec675894
system+0x308bc4 @ 0x7feec688bc4
system+0x2f856b @ 0x7feec67856b
system+0x306acb @ 0x7feec686acb
system+0x2f808a @ 0x7feec67808a
system+0x8f83f7 @ 0x7feecc783f7
DestroyAssemblyConfigCookie+0x132aa PreBindAssembly-0xe5a6 clr+0xf482e @ 0x7fef245482e
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x770d9bd1
SetWindowTextW+0x277 SetWindowLongPtrW-0x3f5 user32+0x172cb @ 0x770d72cb
IsDialogMessageW+0x169 SetTimer-0x107 user32+0x16829 @ 0x770d6829
KiUserCallbackDispatcher+0x1f KiUserExceptionDispatcher-0x25 ntdll+0x51225 @ 0x77211225
ShowWindow+0xa LoadMenuIndirectA-0xa6e user32+0x1193a @ 0x770d193a
system+0x324bc7 @ 0x7feec6a4bc7
system+0x2f43b9 @ 0x7feec6743b9
system+0x305edd @ 0x7feec685edd
system+0x31132a @ 0x7feec69132a
system+0x31107f @ 0x7feec69107f
0x7fe92cf1493
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef23af713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef23af242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef23af30b
_CorExeMain+0x335c ClrCreateManagedInstance-0x15ae4 clr+0x1e721c @ 0x7fef254721c
_CorExeMain+0x3ab6 ClrCreateManagedInstance-0x1538a clr+0x1e7976 @ 0x7fef2547976
_CorExeMain+0x39b0 ClrCreateManagedInstance-0x15490 clr+0x1e7870 @ 0x7fef2547870
_CorExeMain+0x3526 ClrCreateManagedInstance-0x1591a clr+0x1e73e6 @ 0x7fef25473e6
_CorExeMain+0x347e ClrCreateManagedInstance-0x159c2 clr+0x1e733e @ 0x7fef254733e
_CorExeMain+0x14 ClrCreateManagedInstance-0x18e2c clr+0x1e3ed4 @ 0x7fef2543ed4
_CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef3cd74e5
_CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef3eb5b21
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76e5652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x771ec521

exception.instruction_r: 49 89 04 cf eb 13 8b c8 ff 15 95 d7 05 00 8b c8
exception.symbol: K32InitializeProcessForWsWatch+0x16d K32EnumPageFilesW-0x333 kernel32+0x3f45d
exception.instruction: mov qword ptr [r15 + rcx*8], rax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 259165
exception.address: 0x76e7f45d
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 5635888
registers.r11: 514
registers.r8: 5623448
registers.r9: 5623504
registers.rdx: 0
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1204682752
registers.r13: 0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 155 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000012c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000012e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2361000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef29fb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000970000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000970000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2364000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2364000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2364000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2364000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ca6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bdc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cf1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bda000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92beb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bc2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bdb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bcb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cf2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d33000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d34000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d35000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d36000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 7, 2021, 10:37 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\_Gorlno.vbs

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Skype.exe'
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Skype.exe'

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 7, 2021, 10:38 a.m.	show_type: 0 filepath_r: powershell parameters: Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Skype.exe' filepath: powershell	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00894200', u'virtual_address': u'0x00002000', u'entropy': 7.999766331338411, u'name': u'.text', u'virtual_size': u'0x008941b0'}

entropy

7.99976633134

description

A section with a high entropy has been found

entropy

0.981179492907

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 7, 2021, 10:38 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 7, 2021, 10:38 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 7, 2021, 10:38 a.m.	process_identifier: 2508 region_size: 8740864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000288	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

reg_value

explorer.exe,"C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Skype.exe",

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\_Gorlno.vbs

Manipulates memory of a non-child process indicative of process injection (3 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3588 manipulating memory of non-child process 2508
NtUnmapViewOfSection July 7, 2021, 10:38 a.m.	base_address: 0x0000000140000000 region_size: 8786417680384 process_identifier: 2508 process_handle: 0x0000000000000288		-1073741799	0
NtAllocateVirtualMemory July 7, 2021, 10:38 a.m.	process_identifier: 2508 region_size: 8740864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000288	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3588 injected into non-child 2508
WriteProcessMemory July 7, 2021, 10:38 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd÷.Ïð"00 @ `@@@ h. H.text4þ `.rsrch. 0@@ base_address: 0x0000000140000000 process_identifier: 2508 process_handle: 0x0000000000000288	1	1	0

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3588 injected into non-child 2508
WriteProcessMemory July 7, 2021, 10:38 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd÷.Ïð"00 @ `@@@ h. H.text4þ `.rsrch. 0@@ base_address: 0x0000000140000000 process_identifier: 2508 process_handle: 0x0000000000000288	1	1	0

File has been identified by 11 AntiVirus engines on VirusTotal as malicious (11 events)

MicroWorld-eScan	Gen:Variant.Bulz.492572
FireEye	Generic.mg.e19685fb5d65e400
ALYac	Gen:Variant.Bulz.492572
BitDefender	Gen:Variant.Bulz.492572
Ad-Aware	Gen:Variant.Bulz.492572
Emsisoft	Gen:Variant.Bulz.492572 (B)
MAX	malware (ai score=82)
GData	Gen:Variant.Bulz.492572
Fortinet	MSIL/Kryptik.ABUB!tr
AVG	Win64:CrypterX-gen [Trj]
Avast	Win64:CrypterX-gen [Trj]

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	powershell Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Skype.exe'
parent_process	wscript.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Skype.exe'

Executed a process and injected code into it, probably while unpacking (31 events)

Time & API	Arguments	Status	Return
NtResumeThread July 7, 2021, 10:37 a.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 3588	1	0
NtResumeThread July 7, 2021, 10:37 a.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 3588	1	0
NtResumeThread July 7, 2021, 10:37 a.m.	thread_handle: 0x000000000000017c suspend_count: 1 process_identifier: 3588	1	0
NtResumeThread July 7, 2021, 10:37 a.m.	thread_handle: 0x0000000000000260 suspend_count: 1 process_identifier: 3588	1	0
NtGetContextThread July 7, 2021, 10:37 a.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread July 7, 2021, 10:37 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 3588	1	0
NtGetContextThread July 7, 2021, 10:37 a.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 7, 2021, 10:37 a.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread July 7, 2021, 10:37 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 3588	1	0
NtGetContextThread July 7, 2021, 10:37 a.m.	thread_handle: 0x0000000000000134	1	0
NtGetContextThread July 7, 2021, 10:37 a.m.	thread_handle: 0x0000000000000134	1	0
NtResumeThread July 7, 2021, 10:37 a.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 3588	1	0
NtGetContextThread July 7, 2021, 10:37 a.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 7, 2021, 10:37 a.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread July 7, 2021, 10:37 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 3588	1	0
NtGetContextThread July 7, 2021, 10:37 a.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 7, 2021, 10:37 a.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread July 7, 2021, 10:37 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 3588	1	0
NtGetContextThread July 7, 2021, 10:37 a.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 7, 2021, 10:37 a.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread July 7, 2021, 10:37 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 3588	1	0
NtResumeThread July 7, 2021, 10:38 a.m.	thread_handle: 0x000000000000024c suspend_count: 1 process_identifier: 3588	1	0
CreateProcessInternalW July 7, 2021, 10:38 a.m.	thread_identifier: 6744 thread_handle: 0x0000000000000434 process_identifier: 8772 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\wscript.exe track: 1 command_line: "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\_Gorlno.vbs" filepath_r: C:\Windows\System32\WScript.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000000000000428	1	1
NtResumeThread July 7, 2021, 10:38 a.m.	thread_handle: 0x00000000000003cc suspend_count: 1 process_identifier: 3588	1	0
CreateProcessInternalW July 7, 2021, 10:38 a.m.	thread_identifier: 4780 thread_handle: 0x0000000000000438 process_identifier: 2508 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\RegAsm.exe filepath_r: stack_pivoted: 0 creation_flags: 12 (CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 1 process_handle: 0x0000000000000288	1	1
NtUnmapViewOfSection July 7, 2021, 10:38 a.m.	base_address: 0x0000000140000000 region_size: 8786417680384 process_identifier: 2508 process_handle: 0x0000000000000288		-1073741799
NtAllocateVirtualMemory July 7, 2021, 10:38 a.m.	process_identifier: 2508 region_size: 8740864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000288	1	0
WriteProcessMemory July 7, 2021, 10:38 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd÷.Ïð"00 @ `@@@ h. H.text4þ `.rsrch. 0@@ base_address: 0x0000000140000000 process_identifier: 2508 process_handle: 0x0000000000000288	1	1
CreateProcessInternalW July 7, 2021, 10:38 a.m.	thread_identifier: 4104 thread_handle: 0x00000000000002ec process_identifier: 6324 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Skype.exe' filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000000000002f4	1	1
NtResumeThread July 7, 2021, 10:38 a.m.	thread_handle: 0x000000000000028c suspend_count: 1 process_identifier: 6324	1	0
NtResumeThread July 7, 2021, 10:38 a.m.	thread_handle: 0x00000000000002e0 suspend_count: 1 process_identifier: 6324	1	0

The processes wscript.exe, powershell.exe wrote an executable file to disk which it then attempted to execute (20 events)

file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

ConsoleApp2.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All