Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 31, 2021, 1:25 p.m.	July 31, 2021, 1:28 p.m.

Size	1.0MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ea5a1e2c89dcac0afafaec73a375cd60`
SHA256	`9404674e08d2d675f2d304d6c80ab25b857281973d00d06dd3ca367b03f8eacd`
CRC32	`107EC6E0`
ssdeep	`24576:qxhnm5/d3Nq5r9Mlyi/ecb9KMpjpuLZO:UNBMlN/ecb9KyjpuL`
Yara	Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) UPX_Zero - UPX packed file IsPE32 - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals

WrI1MkLCElXhhWQ.exe "C:\Users\test22\AppData\Local\Temp\WrI1MkLCElXhhWQ.exe"
620
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\WrI1MkLCElXhhWQ.exe"
  2704
- WrI1MkLCElXhhWQ.exe "C:\Users\test22\AppData\Local\Temp\WrI1MkLCElXhhWQ.exe"
  2300

Name	Response	Post-Analysis Lookup
www.eesegismundopereira.com
www.caravaninfo.icu

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:61479 -> 164.124.101.2:53	2026888	ET INFO DNS Query for Suspicious .icu Domain	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 31, 2021, 1:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 31, 2021, 1:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:26 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 31, 2021, 1:25 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:26 p.m.			0	0

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 31, 2021, 1:26 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW July 31, 2021, 1:26 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW July 31, 2021, 1:26 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW July 31, 2021, 1:26 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW July 31, 2021, 1:26 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\WrI1 console_handle: 0x00000053	1	1
WriteConsoleW July 31, 2021, 1:26 p.m.	buffer: MkLCElXhhWQ.exe console_handle: 0x0000005f	1	1
WriteConsoleW July 31, 2021, 1:26 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW July 31, 2021, 1:26 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW July 31, 2021, 1:26 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c078 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c638 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c638 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c638 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c978 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c978 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c978 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c978 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c978 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c978 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c4f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c4f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c4f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c638 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c638 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c638 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c638 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c638 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c638 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c638 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c638 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c638 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c638 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bcf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042c1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 31, 2021, 1:25 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 199 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72831000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72832000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00402000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00403000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00404000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00406000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef60000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00417000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ef82000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00416000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00432000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00408000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00445000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00409000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04921000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04922000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04923000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04924000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04925000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04926000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04927000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04928000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04929000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0492a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\WrI1MkLCElXhhWQ.exe"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\WrI1MkLCElXhhWQ.exe"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 31, 2021, 1:26 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\WrI1MkLCElXhhWQ.exe" filepath: powershell	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00105c00', u'virtual_address': u'0x00002000', u'entropy': 7.2354341608516, u'name': u'.text', u'virtual_size': u'0x00105a24'}

entropy

7.23543416085

description

A section with a high entropy has been found

entropy

0.998093422307

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 31, 2021, 1:26 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 31, 2021, 1:26 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (9 events)

description	Communications smtp	rule	Network_SMTP_dotNet
description	Run a KeyLogger	rule	KeyLogger
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 31, 2021, 1:26 p.m.	process_identifier: 2300 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001ec	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 31, 2021, 1:26 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ôÍ¹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PEL&åDà Æ0ìà@à@.textÄÆ ` base_address: 0x00400000 process_identifier: 2300 process_handle: 0x000001ec	1	1	0
WriteProcessMemory July 31, 2021, 1:26 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2300 process_handle: 0x000001ec	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 31, 2021, 1:26 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ôÍ¹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PEL&åDà Æ0ìà@à@.textÄÆ ` base_address: 0x00400000 process_identifier: 2300 process_handle: 0x000001ec	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 620 called NtSetContextThread to modify thread in remote process 2300
NtSetContextThread July 31, 2021, 1:26 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4320304 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001f4 process_identifier: 2300	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 620 resumed a thread in remote process 2300
NtResumeThread July 31, 2021, 1:26 p.m.	thread_handle: 0x000001f4 suspend_count: 1 process_identifier: 2300	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Lionic	Trojan.Win32.Generic.m7QV
Elastic	malicious (high confidence)
FireEye	Generic.mg.ea5a1e2c89dcac0a
McAfee	Artemis!EA5A1E2C89DC
Cylance	Unsafe
Sangfor	Trojan.Win32.Generic.ky
Alibaba	Trojan:Win32/Kryptik.ali2000016
CrowdStrike	win/malicious_confidence_90% (W)
BitDefenderTheta	Gen:NN.ZemsilF.34050.bn0@aOHbVTm
Cyren	W32/MSIL_Kryptik.DSH.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Kryptik.ACEK
TrendMicro-HouseCall	TROJ_GEN.R002H07GU21
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Taskun.gen
Avast	Win32:PWSX-gen [Trj]
Comodo	TrojWare.Win32.UMal.mofhk@0
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Emsisoft	Trojan.Crypt (A)
APEX	Malicious
MaxSecure	Trojan.Malware.300983.susgen
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/AgentTesla!ml
GData	Win32.Trojan-Stealer.FormBook.TQ10ZE
AhnLab-V3	Trojan/Win.AgentTesla.R434889
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/Kryptik.ZXG!tr
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.b4b8e6

Executed a process and injected code into it, probably while unpacking (16 events)

Time & API	Arguments	Status	Return
NtResumeThread July 31, 2021, 1:25 p.m.	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 620	1	0
NtResumeThread July 31, 2021, 1:25 p.m.	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 620	1	0
NtResumeThread July 31, 2021, 1:26 p.m.	thread_handle: 0x00000338 suspend_count: 1 process_identifier: 620	1	0
CreateProcessInternalW July 31, 2021, 1:26 p.m.	thread_identifier: 1768 thread_handle: 0x0000035c process_identifier: 2704 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\WrI1MkLCElXhhWQ.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000364	1	1
CreateProcessInternalW July 31, 2021, 1:26 p.m.	thread_identifier: 812 thread_handle: 0x000001f4 process_identifier: 2300 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\WrI1MkLCElXhhWQ.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\WrI1MkLCElXhhWQ.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000001ec	1	1
NtGetContextThread July 31, 2021, 1:26 p.m.	thread_handle: 0x000001f4	1	0
NtAllocateVirtualMemory July 31, 2021, 1:26 p.m.	process_identifier: 2300 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001ec	1	0
WriteProcessMemory July 31, 2021, 1:26 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ôÍ¹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PEL&åDà Æ0ìà@à@.textÄÆ ` base_address: 0x00400000 process_identifier: 2300 process_handle: 0x000001ec	1	1
WriteProcessMemory July 31, 2021, 1:26 p.m.	buffer: base_address: 0x00401000 process_identifier: 2300 process_handle: 0x000001ec	1	1
WriteProcessMemory July 31, 2021, 1:26 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2300 process_handle: 0x000001ec	1	1
NtSetContextThread July 31, 2021, 1:26 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4320304 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001f4 process_identifier: 2300	1	0
NtResumeThread July 31, 2021, 1:26 p.m.	thread_handle: 0x000001f4 suspend_count: 1 process_identifier: 2300	1	0
NtResumeThread July 31, 2021, 1:26 p.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2704	1	0
NtResumeThread July 31, 2021, 1:26 p.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2704	1	0
NtResumeThread July 31, 2021, 1:26 p.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2704	1	0
NtResumeThread July 31, 2021, 1:26 p.m.	thread_handle: 0x000004a4 suspend_count: 1 process_identifier: 2704	1	0

WrI1MkLCElXhhWQ.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All