Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 17, 2021, 5:32 p.m.	Aug. 17, 2021, 5:51 p.m.

Size	8.5KB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`e557e609d2dddcf4ddb28062d142a5fc`
SHA256	`1ce97055a36b68819da35897b9230cdf3df6ec1b40d784e40be323972f55b2fa`
CRC32	`B6EF233E`
ssdeep	`192:rMIlOiU6O2sw7eIZw5b9BPItoDBlghgf7biro+Y:PlOVw7PZw5b91jDBlNmro+Y`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) Generic_Malware_Zero - Generic Malware Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

uni.exe "C:\Users\test22\AppData\Local\Temp\uni.exe"
1960
- cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "services32" & exit
  1376
  - schtasks.exe schtasks /delete /f /tn "services32"
    2252
- cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command Remove-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Remove-MpPreference -ExclusionPath '%AppData%' & powershell -Command Remove-MpPreference -ExclusionPath '%Temp%' & powershell -Command Remove-MpPreference -ExclusionPath '%SystemRoot%' & exit
  2240
  - powershell.exe powershell -Command Remove-MpPreference -ExclusionPath 'C:\Users\test22'
    2808
  - powershell.exe powershell -Command Remove-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Roaming'
    2340
  - powershell.exe powershell -Command Remove-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp'
    1188
  - powershell.exe powershell -Command Remove-MpPreference -ExclusionPath 'C:\Windows'
    2828

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
117.18.232.200	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (26 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 17, 2021, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 17, 2021, 5:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 17, 2021, 5:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 17, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 17, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 17, 2021, 5:32 p.m.			0	0
IsDebuggerPresent Aug. 17, 2021, 5:32 p.m.			0	0
IsDebuggerPresent Aug. 17, 2021, 5:42 p.m.			0	0
IsDebuggerPresent Aug. 17, 2021, 5:42 p.m.			0	0
IsDebuggerPresent Aug. 17, 2021, 5:43 p.m.			0	0
IsDebuggerPresent Aug. 17, 2021, 5:43 p.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Aug. 17, 2021, 5:42 p.m.	buffer: ERROR: console_handle: 0x000000000000000b	1	1	0
WriteConsoleW Aug. 17, 2021, 5:42 p.m.	buffer: The system cannot find the file specified. console_handle: 0x000000000000000b	1	1	0

Uses Windows APIs to generate a cryptographic key (50 out of 184 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000025e680 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b784b90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b784b90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b784b90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b790c80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b790c80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b790cf0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b790cf0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b790cf0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b790cf0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b791070 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b791070 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b791070 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b784c00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b784c00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b784c00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7914d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7914d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7914d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7914d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7914d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7914d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7914d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7914d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b791620 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b791620 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b791620 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b791620 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b791620 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b791540 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b791540 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b791620 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b791620 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b791620 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7918c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7918c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7918c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7918c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7c62d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7c62d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7c66c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7c66c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000025ebc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000025ebc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000025ebc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000025ebc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002ba320 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4d50e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4d50e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 17, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4d50e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 17, 2021, 5:32 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 748 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000aa0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1b6b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000022f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000023c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef14d4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e36000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d7b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91dac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d7d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d6a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ec0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e83000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e84000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e85000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e86000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e87000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:32 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:42 p.m.	process_identifier: 2808 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002950000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 17, 2021, 5:42 p.m.	process_identifier: 2808 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002b00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (9 events)

cmdline	powershell -Command Remove-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Roaming'
cmdline	cmd /c powershell -Command Remove-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Remove-MpPreference -ExclusionPath '%AppData%' & powershell -Command Remove-MpPreference -ExclusionPath '%Temp%' & powershell -Command Remove-MpPreference -ExclusionPath '%SystemRoot%' & exit
cmdline	powershell -Command Remove-MpPreference -ExclusionPath 'C:\Windows'
cmdline	cmd /c schtasks /delete /f /tn "services32" & exit
cmdline	"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "services32" & exit
cmdline	powershell -Command Remove-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp'
cmdline	schtasks /delete /f /tn "services32"
cmdline	powershell -Command Remove-MpPreference -ExclusionPath 'C:\Users\test22'
cmdline	"C:\Windows\System32\cmd.exe" /c powershell -Command Remove-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Remove-MpPreference -ExclusionPath '%AppData%' & powershell -Command Remove-MpPreference -ExclusionPath '%Temp%' & powershell -Command Remove-MpPreference -ExclusionPath '%SystemRoot%' & exit

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 17, 2021, 5:32 p.m.	show_type: 0 filepath_r: cmd parameters: /c schtasks /delete /f /tn "services32" & exit filepath: cmd	1	1	0
ShellExecuteExW Aug. 17, 2021, 5:32 p.m.	show_type: 0 filepath_r: cmd parameters: /c powershell -Command Remove-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Remove-MpPreference -ExclusionPath '%AppData%' & powershell -Command Remove-MpPreference -ExclusionPath '%Temp%' & powershell -Command Remove-MpPreference -ExclusionPath '%SystemRoot%' & exit filepath: cmd	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (5 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Aug. 17, 2021, 5:32 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Aug. 17, 2021, 5:42 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Aug. 17, 2021, 5:42 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Aug. 17, 2021, 5:43 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Aug. 17, 2021, 5:43 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	cmd /c schtasks /delete /f /tn "services32" & exit
cmdline	"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "services32" & exit
cmdline	schtasks /delete /f /tn "services32"

Communicates with host for which no DNS query was performed (1 event)

host

117.18.232.200

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.565484
FireEye	Generic.mg.e557e609d2dddcf4
Cyren	W64/MSIL_Troj.BCG.gen!Eldorado
ESET-NOD32	a variant of MSIL/Agent.UQS
APEX	Malicious
ClamAV	Win.Packed.Bulz-9883710-0
Kaspersky	HEUR:Trojan.MSIL.Vimditator.gen
BitDefender	Gen:Variant.Bulz.565484
Ad-Aware	Gen:Variant.Bulz.565484
Emsisoft	Gen:Variant.Bulz.565484 (B)
Sophos	ML/PE-A
SentinelOne	Static AI - Suspicious PE
Avira	HEUR/AGEN.1143065
MAX	malware (ai score=87)
Microsoft	Program:Win32/Wacapew.C!ml
ZoneAlarm	HEUR:Trojan.MSIL.Vimditator.gen
GData	Gen:Variant.Bulz.565484
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.Generic.C4566118
ALYac	Gen:Variant.Bulz.565484
Ikarus	Trojan.MSIL.Krypt
Fortinet	MSIL/Agent.UQS!tr

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

192.168.56.102:49171

uni.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All