Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 2, 2021, 5:32 p.m.	Sept. 2, 2021, 5:39 p.m.

Size	441.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`06caa44baa0dcf54689fd14dc3d92203`
SHA256	`9afde20b8b5405b0326cda263fc40b620730eef2076f51aaf959b2157f5f94e8`
CRC32	`D21D2E7E`
ssdeep	`6144:Vyq9nRc85gkG/WTJHelBjxHkIldUep56ghNmD6ZRQCh/4bpcUDwOnrb8P:VJ+kjJ+PuqJhKIQO/gyOnv8P`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

WIN32.exe "C:\Users\test22\AppData\Local\Temp\WIN32.exe"
2972
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
  2240
- WIN32.exe C:\Users\test22\AppData\Local\Temp\WIN32.exe
  2080
  - cmd.exe cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
    2696
    - reg.exe REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
      1456
  - images.exe "C:\ProgramData\images.exe"
    1972
    - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
      1536
explorer.exe C:\Windows\Explorer.EXE
1848

Name	Response	Post-Analysis Lookup
dns.google	A 8.8.4.4 A 8.8.8.8	8.8.4.4
8.8.8.8.in-addr.arpa	PTR dns.google
4.4.8.8.in-addr.arpa	PTR dns.google
time.google.com	A 216.239.35.4 A 216.239.35.0 A 216.239.35.8 A 216.239.35.12	216.239.35.8

IP Address	Status	Action
164.124.101.2	Active	Moloch
216.239.35.12	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (16 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 2, 2021, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 2, 2021, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:33 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:33 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:33 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:33 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 2, 2021, 5:33 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:33 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:33 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:33 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 2, 2021, 5:32 p.m.			0	0
IsDebuggerPresent Sept. 2, 2021, 5:32 p.m.			0	0
IsDebuggerPresent Sept. 2, 2021, 5:32 p.m.			0	0
IsDebuggerPresent Sept. 2, 2021, 5:33 p.m.			0	0
IsDebuggerPresent Sept. 2, 2021, 5:33 p.m.			0	0
IsDebuggerPresent Sept. 2, 2021, 5:33 p.m.			0	0

Command line console output was observed (29 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 2, 2021, 5:32 p.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 2, 2021, 5:32 p.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 2, 2021, 5:32 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.4.4 {} console_handle: 0x00000033	1	1
WriteConsoleW Sept. 2, 2021, 5:32 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.4.4 {} console_handle: 0x00000037	1	1
WriteConsoleW Sept. 2, 2021, 5:32 p.m.	buffer: TEST22-PC time.google.com 216.239.35.12 {} console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 2, 2021, 5:32 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.4.4 {} console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 2, 2021, 5:32 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.4.4 {} console_handle: 0x00000043	1	1
WriteConsoleW Sept. 2, 2021, 5:32 p.m.	buffer: TEST22-PC time.google.com 216.239.35.12 {} console_handle: 0x00000047	1	1
WriteConsoleW Sept. 2, 2021, 5:32 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.4.4 {} console_handle: 0x0000004b	1	1
WriteConsoleW Sept. 2, 2021, 5:32 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.4.4 {} console_handle: 0x00000013	1	1
WriteConsoleW Sept. 2, 2021, 5:32 p.m.	buffer: TEST22-PC time.google.com 216.239.35.12 {} console_handle: 0x00000017	1	1
WriteConsoleW Sept. 2, 2021, 5:32 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.4.4 {} console_handle: 0x0000001b	1	1
WriteConsoleW Sept. 2, 2021, 5:33 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.4.4 {} console_handle: 0x0000001f	1	1
WriteConsoleW Sept. 2, 2021, 5:33 p.m.	buffer: TEST22-PC time.google.com 216.239.35.12 {} console_handle: 0x00000023	1	1
WriteConsoleW Sept. 2, 2021, 5:33 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:33 p.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 2, 2021, 5:33 p.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 2, 2021, 5:33 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.4.4 {} console_handle: 0x00000033	1	1
WriteConsoleW Sept. 2, 2021, 5:33 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.4.4 {} console_handle: 0x00000037	1	1
WriteConsoleW Sept. 2, 2021, 5:33 p.m.	buffer: TEST22-PC time.google.com 216.239.35.12 {} console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 2, 2021, 5:33 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.4.4 {} console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 2, 2021, 5:33 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.4.4 {} console_handle: 0x00000043	1	1
WriteConsoleW Sept. 2, 2021, 5:33 p.m.	buffer: TEST22-PC time.google.com 216.239.35.12 {} console_handle: 0x00000047	1	1
WriteConsoleW Sept. 2, 2021, 5:33 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.4.4 {} console_handle: 0x0000004b	1	1
WriteConsoleW Sept. 2, 2021, 5:34 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.4.4 {} console_handle: 0x00000013	1	1
WriteConsoleW Sept. 2, 2021, 5:34 p.m.	buffer: TEST22-PC time.google.com 216.239.35.12 {} console_handle: 0x00000017	1	1
WriteConsoleW Sept. 2, 2021, 5:34 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.4.4 {} console_handle: 0x0000001b	1	1
WriteConsoleW Sept. 2, 2021, 5:34 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.4.4 {} console_handle: 0x0000001f	1	1
WriteConsoleW Sept. 2, 2021, 5:34 p.m.	buffer: TEST22-PC time.google.com 216.239.35.12 {} console_handle: 0x00000023	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 92 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 2, 2021, 5:33 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00417dc8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:33 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004183c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:33 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004183c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042b230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042ba70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042ba70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042ba70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bc30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bc30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bc30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bc30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bc30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bc30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042b070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042b070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042b070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042ba70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042ba70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042ba70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042b930 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042ba70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042ba70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042ba70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042ba70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042ba70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042ba70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042ba70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bdb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bdb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bdb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bdb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bdb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bdb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bdb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bdb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bdb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bdb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bdb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bdb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bdb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bdb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bcf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042bcf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x062695c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x062695c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x062695c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00653158 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00653a98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00653a98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:33 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003652f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 2, 2021, 5:32 p.m.		1	1	0

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Sept. 2, 2021, 5:33 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7575b37e 0x50d68c5 0x50d683a 0x50d3f0d 0x50d352b 0x50d199b 0x4d50f97 system+0x1d3f63 @ 0x6df33f63 0x72ebbd 0x72dfff system+0x19c522 @ 0x6e83c522 system+0x19e920 @ 0x6e83e920 system+0x19e803 @ 0x6e83e803 0x721531 system+0x1f9799 @ 0x6e899799 system+0x1f92c8 @ 0x6e8992c8 system+0x1eca74 @ 0x6e88ca74 system+0x1ec868 @ 0x6e88c868 system+0x1f82b8 @ 0x6e8982b8 system+0x1ee54d @ 0x6e88e54d system+0x1f70ea @ 0x6e8970ea system+0x1e56c0 @ 0x6e8856c0 system+0x1f8215 @ 0x6e898215 system+0x1f6f75 @ 0x6e896f75 system+0x1ee251 @ 0x6e88e251 system+0x1ee229 @ 0x6e88e229 system+0x1ee170 @ 0x6e88e170 0x53a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a system+0x1ebc85 @ 0x6e88bc85 system+0x1f683b @ 0x6e89683b system+0x1a5e44 @ 0x6e845e44 system+0x1fd8a0 @ 0x6e89d8a0 system+0x1fd792 @ 0x6e89d792 system+0x1a14bd @ 0x6e8414bd 0x720cad DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7575b479 registers.esp: 3794068 registers.edi: 1990713288 registers.eax: 16777216 registers.ebp: 3794272 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Sept. 2, 2021, 5:33 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7575b37e 0x50d68c5 0x50d683a 0x50d3f0d 0x50d352b 0x50d199b 0x4d50f97 system+0x1d3f63 @ 0x6df33f63 0x72ebbd 0x72dfff system+0x19c522 @ 0x6e83c522 system+0x19e920 @ 0x6e83e920 system+0x19e803 @ 0x6e83e803 0x721531 system+0x1f9799 @ 0x6e899799 system+0x1f92c8 @ 0x6e8992c8 system+0x1eca74 @ 0x6e88ca74 system+0x1ec868 @ 0x6e88c868 system+0x1f82b8 @ 0x6e8982b8 system+0x1ee54d @ 0x6e88e54d system+0x1f70ea @ 0x6e8970ea system+0x1e56c0 @ 0x6e8856c0 system+0x1f8215 @ 0x6e898215 system+0x1f6f75 @ 0x6e896f75 system+0x1ee251 @ 0x6e88e251 system+0x1ee229 @ 0x6e88e229 system+0x1ee170 @ 0x6e88e170 0x53a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a system+0x1ebc85 @ 0x6e88bc85 system+0x1f683b @ 0x6e89683b system+0x1a5e44 @ 0x6e845e44 system+0x1fd8a0 @ 0x6e89d8a0 system+0x1fd792 @ 0x6e89d792 system+0x1a14bd @ 0x6e8414bd 0x720cad DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7575b479 registers.esp: 3794068 registers.edi: 1990713288 registers.eax: 4194304 registers.ebp: 3794272 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Sept. 2, 2021, 5:33 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7575b37e 0x50d68c5 0x50d683a 0x50d3f0d 0x50d352b 0x50d199b 0x4d50f97 system+0x1d3f63 @ 0x6df33f63 0x72ebbd 0x72dfff system+0x19c522 @ 0x6e83c522 system+0x19e920 @ 0x6e83e920 system+0x19e803 @ 0x6e83e803 0x721531 system+0x1f9799 @ 0x6e899799 system+0x1f92c8 @ 0x6e8992c8 system+0x1eca74 @ 0x6e88ca74 system+0x1ec868 @ 0x6e88c868 system+0x1f82b8 @ 0x6e8982b8 system+0x1ee54d @ 0x6e88e54d system+0x1f70ea @ 0x6e8970ea system+0x1e56c0 @ 0x6e8856c0 system+0x1f8215 @ 0x6e898215 system+0x1f6f75 @ 0x6e896f75 system+0x1ee251 @ 0x6e88e251 system+0x1ee229 @ 0x6e88e229 system+0x1ee170 @ 0x6e88e170 0x53a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a system+0x1ebc85 @ 0x6e88bc85 system+0x1f683b @ 0x6e89683b system+0x1a5e44 @ 0x6e845e44 system+0x1fd8a0 @ 0x6e89d8a0 system+0x1fd792 @ 0x6e89d792 system+0x1a14bd @ 0x6e8414bd 0x720cad DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7575b479 registers.esp: 3794068 registers.edi: 1990713288 registers.eax: 18808832 registers.ebp: 3794272 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 2, 2021, 5:33 p.m.

stacktrace:

K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7575b37e
0x50d68c5
0x50d683a
0x50d3f0d
0x50d352b
0x50d199b
0x4d50f97
system+0x1d3f63 @ 0x6df33f63
0x72ebbd
0x72dfff
system+0x19c522 @ 0x6e83c522
system+0x19e920 @ 0x6e83e920
system+0x19e803 @ 0x6e83e803
0x721531
system+0x1f9799 @ 0x6e899799
system+0x1f92c8 @ 0x6e8992c8
system+0x1eca74 @ 0x6e88ca74
system+0x1ec868 @ 0x6e88c868
system+0x1f82b8 @ 0x6e8982b8
system+0x1ee54d @ 0x6e88e54d
system+0x1f70ea @ 0x6e8970ea
system+0x1e56c0 @ 0x6e8856c0
system+0x1f8215 @ 0x6e898215
system+0x1f6f75 @ 0x6e896f75
system+0x1ee251 @ 0x6e88e251
system+0x1ee229 @ 0x6e88e229
system+0x1ee170 @ 0x6e88e170
0x53a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a
system+0x1ebc85 @ 0x6e88bc85
system+0x1f683b @ 0x6e89683b
system+0x1a5e44 @ 0x6e845e44
system+0x1fd8a0 @ 0x6e89d8a0
system+0x1fd792 @ 0x6e89d792
system+0x1a14bd @ 0x6e8414bd
0x720cad
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x7575b479
registers.esp: 3794068
registers.edi: 1990713288
registers.eax: 16777216
registers.ebp: 3794272
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0

__exception__

Sept. 2, 2021, 5:33 p.m.

stacktrace:

K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7575b37e
0x50d68c5
0x50d683a
0x50d3f0d
0x50d352b
0x50d199b
0x4d50f97
system+0x1d3f63 @ 0x6df33f63
0x72ebbd
0x72dfff
system+0x19c522 @ 0x6e83c522
system+0x19e920 @ 0x6e83e920
system+0x19e803 @ 0x6e83e803
0x721531
system+0x1f9799 @ 0x6e899799
system+0x1f92c8 @ 0x6e8992c8
system+0x1eca74 @ 0x6e88ca74
system+0x1ec868 @ 0x6e88c868
system+0x1f82b8 @ 0x6e8982b8
system+0x1ee54d @ 0x6e88e54d
system+0x1f70ea @ 0x6e8970ea
system+0x1e56c0 @ 0x6e8856c0
system+0x1f8215 @ 0x6e898215
system+0x1f6f75 @ 0x6e896f75
system+0x1ee251 @ 0x6e88e251
system+0x1ee229 @ 0x6e88e229
system+0x1ee170 @ 0x6e88e170
0x53a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a
system+0x1ebc85 @ 0x6e88bc85
system+0x1f683b @ 0x6e89683b
system+0x1a5e44 @ 0x6e845e44
system+0x1fd8a0 @ 0x6e89d8a0
system+0x1fd792 @ 0x6e89d792
system+0x1a14bd @ 0x6e8414bd
0x720cad
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x7575b479
registers.esp: 3794068
registers.edi: 1990713288
registers.eax: 4194304
registers.ebp: 3794272
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0

__exception__

Sept. 2, 2021, 5:33 p.m.

stacktrace:

K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7575b37e
0x50d68c5
0x50d683a
0x50d3f0d
0x50d352b
0x50d199b
0x4d50f97
system+0x1d3f63 @ 0x6df33f63
0x72ebbd
0x72dfff
system+0x19c522 @ 0x6e83c522
system+0x19e920 @ 0x6e83e920
system+0x19e803 @ 0x6e83e803
0x721531
system+0x1f9799 @ 0x6e899799
system+0x1f92c8 @ 0x6e8992c8
system+0x1eca74 @ 0x6e88ca74
system+0x1ec868 @ 0x6e88c868
system+0x1f82b8 @ 0x6e8982b8
system+0x1ee54d @ 0x6e88e54d
system+0x1f70ea @ 0x6e8970ea
system+0x1e56c0 @ 0x6e8856c0
system+0x1f8215 @ 0x6e898215
system+0x1f6f75 @ 0x6e896f75
system+0x1ee251 @ 0x6e88e251
system+0x1ee229 @ 0x6e88e229
system+0x1ee170 @ 0x6e88e170
0x53a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a
system+0x1ebc85 @ 0x6e88bc85
system+0x1f683b @ 0x6e89683b
system+0x1a5e44 @ 0x6e845e44
system+0x1fd8a0 @ 0x6e89d8a0
system+0x1fd792 @ 0x6e89d792
system+0x1a14bd @ 0x6e8414bd
0x720cad
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x7575b479
registers.esp: 3794068
registers.edi: 1990713288
registers.eax: 18808832
registers.ebp: 3794272
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 398 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00650000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aa0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00522000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00721000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72142000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:32 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00546000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00722000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00729000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0072a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0072e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0072f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d5f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06210000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06211000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06214000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0621b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0621c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0621d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0621e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09e90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 61440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09e91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05060000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Sept. 2, 2021, 5:33 p.m.	total_number_of_free_bytes: 13719109632 free_bytes_available: 13719109632 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	powershell Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
cmdline	cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com

Executes one or more WMI queries (1 event)

wmi	Select * from Win32_PingStatus where ((Address='8.8.8.8' Or Address='8.8.4.4' Or Address='time.google.com') And TimeToLive=80 And BufferSize=32)

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 2, 2021, 5:32 p.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath: powershell	1	1	0
ShellExecuteExW Sept. 2, 2021, 5:33 p.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath: powershell	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0006ce00', u'virtual_address': u'0x00002000', u'entropy': 7.9799498025032145, u'name': u'.text', u'virtual_size': u'0x0006cdb4'}

entropy

7.9799498025

description

A section with a high entropy has been found

entropy

0.987528344671

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Sept. 2, 2021, 5:33 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 2, 2021, 5:32 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 2, 2021, 5:34 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 2, 2021, 5:33 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (16 events)

description	Communications use DNS	rule	Network_DNS
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	email clients info stealer	rule	infoStealer_emailClients_Zero
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
cmdline	REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 7327900db24eaa59b9617a83afac9c0740357524

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2080 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000254	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load

reg_value

C:\ProgramData\images.exe

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 2, 2021, 5:33 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,°à0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x00400000 process_identifier: 2080 process_handle: 0x00000254	1	1
WriteProcessMemory Sept. 2, 2021, 5:33 p.m.	buffer: 2xl`ñúÿò,ã#æsyù$Iêin}FåFã¥÷ÞîèLbÎÌDéäÊèP¡,ÓkWÝÉó`H1e¬«l®Vd{7xzÓ)IðF'Ü»ÖÝf& ürZaDë XSe¹=Åª¤ ¸ÔqKu¾%ÃøzñþT3Ø[Þ¶àÈjïM {s8Ñçh¥þ¤Ö{ã;=ïG°(d base_address: 0x0055d000 process_identifier: 2080 process_handle: 0x00000254	1	1
WriteProcessMemory Sept. 2, 2021, 5:33 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2080 process_handle: 0x00000254	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 2, 2021, 5:33 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,°à0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x00400000 process_identifier: 2080 process_handle: 0x00000254	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2972 called NtSetContextThread to modify thread in remote process 2080
NtSetContextThread Sept. 2, 2021, 5:33 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4218408 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000170 process_identifier: 2080	1	0	0

Powershell script adds registry entries (1 event)

cmd

c:\users\test22\appdata\local\temp\win32.exepowershell test-connection 8.8.8.8, 8.8.4.4, time.google.comcmd.exe /c reg add "hkcu\software\microsoft\windows nt\currentversion\windows" /f /v load /t reg_sz /d "c:\programdata\images.exe"c:\programdata\images.exereg add "hkcu\software\microsoft\windows nt\currentversion\windows" /f /v load /t reg_sz /d "c:\programdata\images.exe""c:\windows\system32\windowspowershell\v1.0\powershell.exe" test-connection 8.8.8.8, 8.8.4.4, time.google.com

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\ProgramData\images.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2972 resumed a thread in remote process 2080
NtResumeThread Sept. 2, 2021, 5:33 p.m.	thread_handle: 0x00000170 suspend_count: 1 process_identifier: 2080	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (31 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 2, 2021, 5:32 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2972	1	0
NtResumeThread Sept. 2, 2021, 5:32 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2972	1	0
NtResumeThread Sept. 2, 2021, 5:32 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2972	1	0
CreateProcessInternalW Sept. 2, 2021, 5:32 p.m.	thread_identifier: 2244 thread_handle: 0x00000380 process_identifier: 2240 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000388	1	1
CreateProcessInternalW Sept. 2, 2021, 5:33 p.m.	thread_identifier: 2216 thread_handle: 0x00000170 process_identifier: 2080 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\WIN32.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000254	1	1
NtGetContextThread Sept. 2, 2021, 5:33 p.m.	thread_handle: 0x00000170	1	0
NtAllocateVirtualMemory Sept. 2, 2021, 5:33 p.m.	process_identifier: 2080 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000254	1	0
WriteProcessMemory Sept. 2, 2021, 5:33 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,°à0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x00400000 process_identifier: 2080 process_handle: 0x00000254	1	1
WriteProcessMemory Sept. 2, 2021, 5:33 p.m.	buffer: base_address: 0x00401000 process_identifier: 2080 process_handle: 0x00000254	1	1
WriteProcessMemory Sept. 2, 2021, 5:33 p.m.	buffer: base_address: 0x00417000 process_identifier: 2080 process_handle: 0x00000254	1	1
WriteProcessMemory Sept. 2, 2021, 5:33 p.m.	buffer: base_address: 0x0041c000 process_identifier: 2080 process_handle: 0x00000254	1	1
WriteProcessMemory Sept. 2, 2021, 5:33 p.m.	buffer: base_address: 0x0055b000 process_identifier: 2080 process_handle: 0x00000254	1	1
WriteProcessMemory Sept. 2, 2021, 5:33 p.m.	buffer: 2xl`ñúÿò,ã#æsyù$Iêin}FåFã¥÷ÞîèLbÎÌDéäÊèP¡,ÓkWÝÉó`H1e¬«l®Vd{7xzÓ)IðF'Ü»ÖÝf& ürZaDë XSe¹=Åª¤ ¸ÔqKu¾%ÃøzñþT3Ø[Þ¶àÈjïM {s8Ñçh¥þ¤Ö{ã;=ïG°(d base_address: 0x0055d000 process_identifier: 2080 process_handle: 0x00000254	1	1
WriteProcessMemory Sept. 2, 2021, 5:33 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2080 process_handle: 0x00000254	1	1
NtSetContextThread Sept. 2, 2021, 5:33 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4218408 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000170 process_identifier: 2080	1	0
NtResumeThread Sept. 2, 2021, 5:33 p.m.	thread_handle: 0x00000170 suspend_count: 1 process_identifier: 2080	1	0
NtResumeThread Sept. 2, 2021, 5:32 p.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2240	1	0
NtResumeThread Sept. 2, 2021, 5:32 p.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2240	1	0
NtResumeThread Sept. 2, 2021, 5:32 p.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2240	1	0
NtResumeThread Sept. 2, 2021, 5:33 p.m.	thread_handle: 0x000003c4 suspend_count: 1 process_identifier: 2240	1	0
CreateProcessInternalW Sept. 2, 2021, 5:33 p.m.	thread_identifier: 1808 thread_handle: 0x000001f0 process_identifier: 2696 current_directory: filepath: track: 1 command_line: cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001f8	1	1
CreateProcessInternalW Sept. 2, 2021, 5:33 p.m.	thread_identifier: 2072 thread_handle: 0x000001f0 process_identifier: 1972 current_directory: filepath: C:\ProgramData\images.exe track: 1 command_line: filepath_r: C:\ProgramData\images.exe stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001f8	1	1
CreateProcessInternalW Sept. 2, 2021, 5:33 p.m.	thread_identifier: 2324 thread_handle: 0x00000084 process_identifier: 1456 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\reg.exe track: 1 command_line: REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe" filepath_r: C:\Windows\system32\reg.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
NtResumeThread Sept. 2, 2021, 5:33 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1972	1	0
NtResumeThread Sept. 2, 2021, 5:33 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 1972	1	0
NtResumeThread Sept. 2, 2021, 5:33 p.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 1972	1	0
CreateProcessInternalW Sept. 2, 2021, 5:33 p.m.	thread_identifier: 492 thread_handle: 0x00000388 process_identifier: 1536 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000390	1	1
NtResumeThread Sept. 2, 2021, 5:33 p.m.	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 1536	1	0
NtResumeThread Sept. 2, 2021, 5:33 p.m.	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 1536	1	0
NtResumeThread Sept. 2, 2021, 5:33 p.m.	thread_handle: 0x00000454 suspend_count: 1 process_identifier: 1536	1	0
NtResumeThread Sept. 2, 2021, 5:34 p.m.	thread_handle: 0x000003dc suspend_count: 1 process_identifier: 1536	1	0

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37518616
Cylance	Unsafe
Alibaba	Trojan:MSIL/GenKryptik.ee241bea
Cybereason	malicious.6d39b8
Arcabit	Trojan.Generic.D23C7D18
Cyren	W32/MSIL_Troj.BKV.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GenKryptik.FJQK
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Downloader.MSIL.Seraph.gen
BitDefender	Trojan.GenericKD.37518616
Avast	Win32:MalwareX-gen [Trj]
Tencent	Msil.Trojan-downloader.Seraph.Gvq
Ad-Aware	Trojan.GenericKD.37518616
Sophos	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
FireEye	Generic.mg.06caa44baa0dcf54
Emsisoft	Trojan.GenericKD.37518616 (B)
SentinelOne	Static AI - Malicious PE
Microsoft	Trojan:Script/Phonzy.C!ml
ZoneAlarm	HEUR:Trojan-Downloader.MSIL.Seraph.gen
GData	Win32.Malware.Injector.TA3BG5
McAfee	Artemis!06CAA44BAA0D
MAX	malware (ai score=87)
Malwarebytes	Trojan.Downloader.MSIL
Ikarus	Win32.Outbreak
eGambit	Unsafe.AI_Score_99%
Fortinet	MSIL/Kryptik.ACNM!tr
BitDefenderTheta	Gen:NN.ZemsilF.34126.Bm0@aelw!zo
AVG	Win32:MalwareX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)
MaxSecure	Trojan.Malware.300983.susgen

WIN32.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All