Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 2, 2021, 5:59 p.m.	Sept. 2, 2021, 6:06 p.m.

Size	513.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`5bf7c4b2b2980b4796c0c93b00dcf602`
SHA256	`038468b4bce04705f5f08025f029ca8f327540d31f8f373892248b42750f5a00`
CRC32	`15EBA1F5`
ssdeep	`12288:J4vWZxUrGqLftSjwxRP5I3J9qLLRiHDdV7JikiwJ:J4uT9wcwlICLNQDdVlii`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

TOBI.exe "C:\Users\test22\AppData\Local\Temp\TOBI.exe"
2768
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
  2236
- TOBI.exe C:\Users\test22\AppData\Local\Temp\TOBI.exe
  1852
  - cmd.exe cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\sys64.exe"
    1556
    - reg.exe REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\sys64.exe"
      804
  - sys64.exe "C:\ProgramData\sys64.exe"
    2620
    - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
      844
explorer.exe C:\Windows\Explorer.EXE
1848

Name	Response	Post-Analysis Lookup
dns.google	A 8.8.4.4 A 8.8.8.8	8.8.4.4
8.8.8.8.in-addr.arpa	PTR dns.google
4.4.8.8.in-addr.arpa	PTR dns.google
time.google.com	A 216.239.35.4 A 216.239.35.8 A 216.239.35.0 A 216.239.35.12	216.239.35.8

IP Address	Status	Action
164.124.101.2	Active	Moloch
216.239.35.8	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (16 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 2, 2021, 5:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 2, 2021, 5:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 6 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 6 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 6 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 6 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 2, 2021, 6 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 6 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 6 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 6 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 2, 2021, 5:59 p.m.			0	0
IsDebuggerPresent Sept. 2, 2021, 5:59 p.m.			0	0
IsDebuggerPresent Sept. 2, 2021, 5:59 p.m.			0	0
IsDebuggerPresent Sept. 2, 2021, 6 p.m.			0	0
IsDebuggerPresent Sept. 2, 2021, 6 p.m.			0	0
IsDebuggerPresent Sept. 2, 2021, 6 p.m.			0	0

Command line console output was observed (29 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 2, 2021, 5:59 p.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 2, 2021, 5:59 p.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 2, 2021, 5:59 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.4.4 {} console_handle: 0x00000033	1	1
WriteConsoleW Sept. 2, 2021, 5:59 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.4.4 {} console_handle: 0x00000037	1	1
WriteConsoleW Sept. 2, 2021, 5:59 p.m.	buffer: TEST22-PC time.google.com 216.239.35.8 {} console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 2, 2021, 5:59 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.4.4 {} console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 2, 2021, 5:59 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.4.4 {} console_handle: 0x00000043	1	1
WriteConsoleW Sept. 2, 2021, 5:59 p.m.	buffer: TEST22-PC time.google.com 216.239.35.8 {} console_handle: 0x00000047	1	1
WriteConsoleW Sept. 2, 2021, 5:59 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.4.4 {} console_handle: 0x0000004b	1	1
WriteConsoleW Sept. 2, 2021, 5:59 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.4.4 {} console_handle: 0x00000013	1	1
WriteConsoleW Sept. 2, 2021, 5:59 p.m.	buffer: TEST22-PC time.google.com 216.239.35.8 {} console_handle: 0x00000017	1	1
WriteConsoleW Sept. 2, 2021, 5:59 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.4.4 {} console_handle: 0x0000001b	1	1
WriteConsoleW Sept. 2, 2021, 5:59 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.4.4 {} console_handle: 0x0000001f	1	1
WriteConsoleW Sept. 2, 2021, 5:59 p.m.	buffer: TEST22-PC time.google.com 216.239.35.8 {} console_handle: 0x00000023	1	1
WriteConsoleW Sept. 2, 2021, 6 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 6 p.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 2, 2021, 6 p.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 2, 2021, 6 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.4.4 {} console_handle: 0x00000033	1	1
WriteConsoleW Sept. 2, 2021, 6 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.4.4 {} console_handle: 0x00000037	1	1
WriteConsoleW Sept. 2, 2021, 6 p.m.	buffer: TEST22-PC time.google.com 216.239.35.8 {} console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 2, 2021, 6 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.4.4 {} console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 2, 2021, 6 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.4.4 {} console_handle: 0x00000043	1	1
WriteConsoleW Sept. 2, 2021, 6 p.m.	buffer: TEST22-PC time.google.com 216.239.35.8 {} console_handle: 0x00000047	1	1
WriteConsoleW Sept. 2, 2021, 6 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.4.4 {} console_handle: 0x0000004b	1	1
WriteConsoleW Sept. 2, 2021, 6 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.4.4 {} console_handle: 0x00000013	1	1
WriteConsoleW Sept. 2, 2021, 6 p.m.	buffer: TEST22-PC time.google.com 216.239.35.8 {} console_handle: 0x00000017	1	1
WriteConsoleW Sept. 2, 2021, 6 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.8.8 {} console_handle: 0x0000001b	1	1
WriteConsoleW Sept. 2, 2021, 6 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.8.8 {} console_handle: 0x0000001f	1	1
WriteConsoleW Sept. 2, 2021, 6 p.m.	buffer: TEST22-PC time.google.com 216.239.35.8 {} console_handle: 0x00000023	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 92 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00656740 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00656880 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00656880 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00517f48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005593c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005593c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005593c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00559640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00559640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00559640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00559640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00559640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00559640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00559500 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00559500 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00559500 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005593c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005593c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005593c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00559540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005593c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005593c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005593c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005593c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005593c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005593c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005593c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005596c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005596c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005596c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005596c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005596c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005596c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005596c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005596c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005596c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005596c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005596c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005596c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005596c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005596c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00559780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00559780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00559a40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00559a40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 5:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00559a40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 6 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00813020 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 6 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008128a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 6 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008128a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2021, 6 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dd70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 2, 2021, 5:59 p.m.		1	1	0

One or more processes crashed (6 events)

Time & API	Arguments	Status
__exception__ Sept. 2, 2021, 6 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7575b37e 0x5b72dad 0x5b72d22 0x5b70ac4 0x9e6fc4b 0x9e6e94d 0x5540f97 system+0x1d3f63 @ 0x6ede3f63 0x555539d 0x55547ef system+0x19c522 @ 0x6e18c522 system+0x19e920 @ 0x6e18e920 system+0x19e803 @ 0x6e18e803 0xe440f1 system+0x1f9799 @ 0x6e1e9799 system+0x1f92c8 @ 0x6e1e92c8 system+0x1eca74 @ 0x6e1dca74 system+0x1ec868 @ 0x6e1dc868 system+0x1f82b8 @ 0x6e1e82b8 system+0x1ee54d @ 0x6e1de54d system+0x1f70ea @ 0x6e1e70ea system+0x1e56c0 @ 0x6e1d56c0 system+0x1f8215 @ 0x6e1e8215 system+0x1f6f75 @ 0x6e1e6f75 system+0x1ee251 @ 0x6e1de251 system+0x1ee229 @ 0x6e1de229 system+0x1ee170 @ 0x6e1de170 0x3ba17a gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a system+0x1ebc85 @ 0x6e1dbc85 system+0x1f683b @ 0x6e1e683b system+0x1a5e44 @ 0x6e195e44 system+0x1fd8a0 @ 0x6e1ed8a0 system+0x1fd792 @ 0x6e1ed792 system+0x1a14bd @ 0x6e1914bd 0x5bd460 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7575b479 registers.esp: 3532328 registers.edi: 1990713288 registers.eax: 16777216 registers.ebp: 3532532 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Sept. 2, 2021, 6 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7575b37e 0x5b72dad 0x5b72d22 0x5b70ac4 0x9e6fc4b 0x9e6e94d 0x5540f97 system+0x1d3f63 @ 0x6ede3f63 0x555539d 0x55547ef system+0x19c522 @ 0x6e18c522 system+0x19e920 @ 0x6e18e920 system+0x19e803 @ 0x6e18e803 0xe440f1 system+0x1f9799 @ 0x6e1e9799 system+0x1f92c8 @ 0x6e1e92c8 system+0x1eca74 @ 0x6e1dca74 system+0x1ec868 @ 0x6e1dc868 system+0x1f82b8 @ 0x6e1e82b8 system+0x1ee54d @ 0x6e1de54d system+0x1f70ea @ 0x6e1e70ea system+0x1e56c0 @ 0x6e1d56c0 system+0x1f8215 @ 0x6e1e8215 system+0x1f6f75 @ 0x6e1e6f75 system+0x1ee251 @ 0x6e1de251 system+0x1ee229 @ 0x6e1de229 system+0x1ee170 @ 0x6e1de170 0x3ba17a gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a system+0x1ebc85 @ 0x6e1dbc85 system+0x1f683b @ 0x6e1e683b system+0x1a5e44 @ 0x6e195e44 system+0x1fd8a0 @ 0x6e1ed8a0 system+0x1fd792 @ 0x6e1ed792 system+0x1a14bd @ 0x6e1914bd 0x5bd460 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7575b479 registers.esp: 3532328 registers.edi: 1990713288 registers.eax: 4194304 registers.ebp: 3532532 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Sept. 2, 2021, 6 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7575b37e 0x5b72dad 0x5b72d22 0x5b70ac4 0x9e6fc4b 0x9e6e94d 0x5540f97 system+0x1d3f63 @ 0x6ede3f63 0x555539d 0x55547ef system+0x19c522 @ 0x6e18c522 system+0x19e920 @ 0x6e18e920 system+0x19e803 @ 0x6e18e803 0xe440f1 system+0x1f9799 @ 0x6e1e9799 system+0x1f92c8 @ 0x6e1e92c8 system+0x1eca74 @ 0x6e1dca74 system+0x1ec868 @ 0x6e1dc868 system+0x1f82b8 @ 0x6e1e82b8 system+0x1ee54d @ 0x6e1de54d system+0x1f70ea @ 0x6e1e70ea system+0x1e56c0 @ 0x6e1d56c0 system+0x1f8215 @ 0x6e1e8215 system+0x1f6f75 @ 0x6e1e6f75 system+0x1ee251 @ 0x6e1de251 system+0x1ee229 @ 0x6e1de229 system+0x1ee170 @ 0x6e1de170 0x3ba17a gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a system+0x1ebc85 @ 0x6e1dbc85 system+0x1f683b @ 0x6e1e683b system+0x1a5e44 @ 0x6e195e44 system+0x1fd8a0 @ 0x6e1ed8a0 system+0x1fd792 @ 0x6e1ed792 system+0x1a14bd @ 0x6e1914bd 0x5bd460 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7575b479 registers.esp: 3532328 registers.edi: 1990713288 registers.eax: 19922944 registers.ebp: 3532532 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Sept. 2, 2021, 6 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7575b37e 0x5b72dad 0x5b72d22 0x5b70ac4 0x9e6fc4b 0x9e6e94d 0x5540f97 system+0x1d3f63 @ 0x6ede3f63 0x555539d 0x55547ef system+0x19c522 @ 0x6e18c522 system+0x19e920 @ 0x6e18e920 system+0x19e803 @ 0x6e18e803 0xe440f1 system+0x1f9799 @ 0x6e1e9799 system+0x1f92c8 @ 0x6e1e92c8 system+0x1eca74 @ 0x6e1dca74 system+0x1ec868 @ 0x6e1dc868 system+0x1f82b8 @ 0x6e1e82b8 system+0x1ee54d @ 0x6e1de54d system+0x1f70ea @ 0x6e1e70ea system+0x1e56c0 @ 0x6e1d56c0 system+0x1f8215 @ 0x6e1e8215 system+0x1f6f75 @ 0x6e1e6f75 system+0x1ee251 @ 0x6e1de251 system+0x1ee229 @ 0x6e1de229 system+0x1ee170 @ 0x6e1de170 0x3ba17a gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a system+0x1ebc85 @ 0x6e1dbc85 system+0x1f683b @ 0x6e1e683b system+0x1a5e44 @ 0x6e195e44 system+0x1fd8a0 @ 0x6e1ed8a0 system+0x1fd792 @ 0x6e1ed792 system+0x1a14bd @ 0x6e1914bd 0x5bd460 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7575b479 registers.esp: 3532328 registers.edi: 1990713288 registers.eax: 16777216 registers.ebp: 3532532 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Sept. 2, 2021, 6 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7575b37e 0x5b72dad 0x5b72d22 0x5b70ac4 0x9e6fc4b 0x9e6e94d 0x5540f97 system+0x1d3f63 @ 0x6ede3f63 0x555539d 0x55547ef system+0x19c522 @ 0x6e18c522 system+0x19e920 @ 0x6e18e920 system+0x19e803 @ 0x6e18e803 0xe440f1 system+0x1f9799 @ 0x6e1e9799 system+0x1f92c8 @ 0x6e1e92c8 system+0x1eca74 @ 0x6e1dca74 system+0x1ec868 @ 0x6e1dc868 system+0x1f82b8 @ 0x6e1e82b8 system+0x1ee54d @ 0x6e1de54d system+0x1f70ea @ 0x6e1e70ea system+0x1e56c0 @ 0x6e1d56c0 system+0x1f8215 @ 0x6e1e8215 system+0x1f6f75 @ 0x6e1e6f75 system+0x1ee251 @ 0x6e1de251 system+0x1ee229 @ 0x6e1de229 system+0x1ee170 @ 0x6e1de170 0x3ba17a gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a system+0x1ebc85 @ 0x6e1dbc85 system+0x1f683b @ 0x6e1e683b system+0x1a5e44 @ 0x6e195e44 system+0x1fd8a0 @ 0x6e1ed8a0 system+0x1fd792 @ 0x6e1ed792 system+0x1a14bd @ 0x6e1914bd 0x5bd460 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7575b479 registers.esp: 3532328 registers.edi: 1990713288 registers.eax: 4194304 registers.ebp: 3532532 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Sept. 2, 2021, 6 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7575b37e 0x5b72dad 0x5b72d22 0x5b70ac4 0x9e6fc4b 0x9e6e94d 0x5540f97 system+0x1d3f63 @ 0x6ede3f63 0x555539d 0x55547ef system+0x19c522 @ 0x6e18c522 system+0x19e920 @ 0x6e18e920 system+0x19e803 @ 0x6e18e803 0xe440f1 system+0x1f9799 @ 0x6e1e9799 system+0x1f92c8 @ 0x6e1e92c8 system+0x1eca74 @ 0x6e1dca74 system+0x1ec868 @ 0x6e1dc868 system+0x1f82b8 @ 0x6e1e82b8 system+0x1ee54d @ 0x6e1de54d system+0x1f70ea @ 0x6e1e70ea system+0x1e56c0 @ 0x6e1d56c0 system+0x1f8215 @ 0x6e1e8215 system+0x1f6f75 @ 0x6e1e6f75 system+0x1ee251 @ 0x6e1de251 system+0x1ee229 @ 0x6e1de229 system+0x1ee170 @ 0x6e1de170 0x3ba17a gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a system+0x1ebc85 @ 0x6e1dbc85 system+0x1f683b @ 0x6e1e683b system+0x1a5e44 @ 0x6e195e44 system+0x1fd8a0 @ 0x6e1ed8a0 system+0x1fd792 @ 0x6e1ed792 system+0x1a14bd @ 0x6e1914bd 0x5bd460 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7575b479 registers.esp: 3532328 registers.edi: 1990713288 registers.eax: 19922944 registers.ebp: 3532532 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 417 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00700000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00700000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72644000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005be000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x720a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e45000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e49000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05550000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05551000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0554f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05540000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05556000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05559000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00841000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00845000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09ce0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09ce1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09ce8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003be000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09ce9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09cea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09e60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 53248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09e61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:59 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09e6e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Sept. 2, 2021, 5:53 p.m.	total_number_of_free_bytes: 13726093312 free_bytes_available: 13726093312 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	powershell Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
cmdline	cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\sys64.exe"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com

Executes one or more WMI queries (1 event)

wmi	Select * from Win32_PingStatus where ((Address='8.8.8.8' Or Address='8.8.4.4' Or Address='time.google.com') And TimeToLive=80 And BufferSize=32)

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 2, 2021, 5:59 p.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath: powershell	1	1	0
ShellExecuteExW Sept. 2, 2021, 6 p.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath: powershell	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0007d000', u'virtual_address': u'0x00002000', u'entropy': 7.746264654781473, u'name': u'.text', u'virtual_size': u'0x0007ceb4'}

entropy

7.74626465478

description

A section with a high entropy has been found

entropy

0.975609756098

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Sept. 2, 2021, 5:59 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 2, 2021, 5:59 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 2, 2021, 6 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 2, 2021, 6 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (16 events)

description	Communications use DNS	rule	Network_DNS
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	email clients info stealer	rule	infoStealer_emailClients_Zero
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Sept. 2, 2021, 6 p.m.	status_code: 0xffffffff process_identifier: 2564 process_handle: 0x00000260		0	0
NtTerminateProcess Sept. 2, 2021, 6 p.m.	status_code: 0xffffffff process_identifier: 2564 process_handle: 0x00000260	1	0	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\sys64.exe"
cmdline	REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\sys64.exe"

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 4cbe934202c8b1e29da319b1a75bd52c2277cfe0

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 2, 2021, 6 p.m.	process_identifier: 2564 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000029c		3221225496	0
NtAllocateVirtualMemory Sept. 2, 2021, 6 p.m.	process_identifier: 1852 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000254	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load

reg_value

C:\ProgramData\sys64.exe

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2768 manipulating memory of non-child process 2564
NtAllocateVirtualMemory Sept. 2, 2021, 6 p.m.	process_identifier: 2564 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000029c		3221225496	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 2, 2021, 6 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,°à0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x00400000 process_identifier: 1852 process_handle: 0x00000254	1	1
WriteProcessMemory Sept. 2, 2021, 6 p.m.	buffer: 2ßø»2NDp)r°eåÔ7ð_f/÷(ôä`)QÚBLsæë0"Åji¦X×Ú¸b"R°Û£ât^H£è>¢è;Åðb´¤¦+'=_àðqêËÌÚ%~êæËÉÊy±áÑº å? Úkb; ¹QsñÒÄ¾ýh¾O(J1ÿKZq*©à base_address: 0x0055d000 process_identifier: 1852 process_handle: 0x00000254	1	1
WriteProcessMemory Sept. 2, 2021, 6 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1852 process_handle: 0x00000254	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 2, 2021, 6 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,°à0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x00400000 process_identifier: 1852 process_handle: 0x00000254	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2768 called NtSetContextThread to modify thread in remote process 1852
NtSetContextThread Sept. 2, 2021, 6 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4218408 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000260 process_identifier: 1852	1	0	0

Powershell script adds registry entries (1 event)

cmd

powershell test-connection 8.8.8.8, 8.8.4.4, time.google.comc:\programdata\sys64.execmd.exe /c reg add "hkcu\software\microsoft\windows nt\currentversion\windows" /f /v load /t reg_sz /d "c:\programdata\sys64.exe"reg add "hkcu\software\microsoft\windows nt\currentversion\windows" /f /v load /t reg_sz /d "c:\programdata\sys64.exe""c:\windows\system32\windowspowershell\v1.0\powershell.exe" test-connection 8.8.8.8, 8.8.4.4, time.google.comc:\users\test22\appdata\local\temp\tobi.exe

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\ProgramData\sys64.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2768 resumed a thread in remote process 1852
NtResumeThread Sept. 2, 2021, 6 p.m.	thread_handle: 0x00000260 suspend_count: 1 process_identifier: 1852	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (34 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 2, 2021, 5:59 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2768	1	0
NtResumeThread Sept. 2, 2021, 5:59 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2768	1	0
NtResumeThread Sept. 2, 2021, 5:59 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2768	1	0
CreateProcessInternalW Sept. 2, 2021, 5:59 p.m.	thread_identifier: 1836 thread_handle: 0x000003b4 process_identifier: 2236 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003bc	1	1
CreateProcessInternalW Sept. 2, 2021, 6 p.m.	thread_identifier: 1296 thread_handle: 0x00000170 process_identifier: 2564 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\TOBI.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000029c	1	1
NtGetContextThread Sept. 2, 2021, 6 p.m.	thread_handle: 0x00000170	1	0
NtAllocateVirtualMemory Sept. 2, 2021, 6 p.m.	process_identifier: 2564 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000029c		3221225496
CreateProcessInternalW Sept. 2, 2021, 6 p.m.	thread_identifier: 3024 thread_handle: 0x00000260 process_identifier: 1852 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\TOBI.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000254	1	1
NtGetContextThread Sept. 2, 2021, 6 p.m.	thread_handle: 0x00000260	1	0
NtAllocateVirtualMemory Sept. 2, 2021, 6 p.m.	process_identifier: 1852 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000254	1	0
WriteProcessMemory Sept. 2, 2021, 6 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,°à0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x00400000 process_identifier: 1852 process_handle: 0x00000254	1	1
WriteProcessMemory Sept. 2, 2021, 6 p.m.	buffer: base_address: 0x00401000 process_identifier: 1852 process_handle: 0x00000254	1	1
WriteProcessMemory Sept. 2, 2021, 6 p.m.	buffer: base_address: 0x00417000 process_identifier: 1852 process_handle: 0x00000254	1	1
WriteProcessMemory Sept. 2, 2021, 6 p.m.	buffer: base_address: 0x0041c000 process_identifier: 1852 process_handle: 0x00000254	1	1
WriteProcessMemory Sept. 2, 2021, 6 p.m.	buffer: base_address: 0x0055b000 process_identifier: 1852 process_handle: 0x00000254	1	1
WriteProcessMemory Sept. 2, 2021, 6 p.m.	buffer: 2ßø»2NDp)r°eåÔ7ð_f/÷(ôä`)QÚBLsæë0"Åji¦X×Ú¸b"R°Û£ât^H£è>¢è;Åðb´¤¦+'=_àðqêËÌÚ%~êæËÉÊy±áÑº å? Úkb; ¹QsñÒÄ¾ýh¾O(J1ÿKZq*©à base_address: 0x0055d000 process_identifier: 1852 process_handle: 0x00000254	1	1
WriteProcessMemory Sept. 2, 2021, 6 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1852 process_handle: 0x00000254	1	1
NtSetContextThread Sept. 2, 2021, 6 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4218408 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000260 process_identifier: 1852	1	0
NtResumeThread Sept. 2, 2021, 6 p.m.	thread_handle: 0x00000260 suspend_count: 1 process_identifier: 1852	1	0
NtResumeThread Sept. 2, 2021, 5:59 p.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2236	1	0
NtResumeThread Sept. 2, 2021, 5:59 p.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2236	1	0
NtResumeThread Sept. 2, 2021, 5:59 p.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2236	1	0
NtResumeThread Sept. 2, 2021, 5:59 p.m.	thread_handle: 0x00000514 suspend_count: 1 process_identifier: 2236	1	0
CreateProcessInternalW Sept. 2, 2021, 6 p.m.	thread_identifier: 2852 thread_handle: 0x000001f0 process_identifier: 1556 current_directory: filepath: track: 1 command_line: cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\sys64.exe" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001f8	1	1
CreateProcessInternalW Sept. 2, 2021, 6 p.m.	thread_identifier: 656 thread_handle: 0x000001f0 process_identifier: 2620 current_directory: filepath: C:\ProgramData\sys64.exe track: 1 command_line: filepath_r: C:\ProgramData\sys64.exe stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001f8	1	1
CreateProcessInternalW Sept. 2, 2021, 6 p.m.	thread_identifier: 2876 thread_handle: 0x00000084 process_identifier: 804 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\reg.exe track: 1 command_line: REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\sys64.exe" filepath_r: C:\Windows\system32\reg.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
NtResumeThread Sept. 2, 2021, 6 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2620	1	0
NtResumeThread Sept. 2, 2021, 6 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2620	1	0
NtResumeThread Sept. 2, 2021, 6 p.m.	thread_handle: 0x000001c8 suspend_count: 1 process_identifier: 2620	1	0
CreateProcessInternalW Sept. 2, 2021, 6 p.m.	thread_identifier: 2824 thread_handle: 0x000003c0 process_identifier: 844 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003c8	1	1
NtResumeThread Sept. 2, 2021, 6 p.m.	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 844	1	0
NtResumeThread Sept. 2, 2021, 6 p.m.	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 844	1	0
NtResumeThread Sept. 2, 2021, 6 p.m.	thread_handle: 0x00000454 suspend_count: 1 process_identifier: 844	1	0
NtResumeThread Sept. 2, 2021, 6 p.m.	thread_handle: 0x000003d4 suspend_count: 1 process_identifier: 844	1	0

File has been identified by 32 AntiVirus engines on VirusTotal as malicious (32 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.621167
FireEye	Generic.mg.5bf7c4b2b2980b47
McAfee	Artemis!5BF7C4B2B298
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0058131c1 )
K7GW	Trojan ( 0058131c1 )
CrowdStrike	win/malicious_confidence_80% (W)
Cyren	W32/MSIL_Kryptik.UZ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GenKryptik.FIRM
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:Trojan-Downloader.MSIL.Seraph.gen
BitDefender	Gen:Variant.Bulz.621167
Ad-Aware	Gen:Variant.Bulz.621167
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Gen:Variant.Bulz.621167 (B)
eGambit	Unsafe.AI_Score_100%
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Win32.Malware.Injector.OQRQ7J
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZemsilF.34126.Gm0@aymuLze
ALYac	Gen:Variant.Bulz.621167
MAX	malware (ai score=83)
Malwarebytes	Trojan.MalPack
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenKryptik.FIRM!tr
Cybereason	malicious.d4d9ac

TOBI.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All