Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 7, 2021, 8:23 a.m.	Sept. 7, 2021, 8:33 a.m.

Size	107.5KB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`6557d0d59d2e4dee77c7960695ac8969`
SHA256	`ec824dc94c928a1168e2847795af356a5465ee32eadbd1c2d6dcf84db2b19140`
CRC32	`88F8A68F`
ssdeep	`3072:B6yCMfaHsYIaTADHTLSplJi6GiIxJmtObwm4b:B6y9fAtIaCT2Ji6/Ijbz4`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) Generic_Malware_Zero - Generic Malware Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Launcher.exe "C:\Users\test22\AppData\Local\Temp\Launcher.exe"
2548
- cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
  2240
  - powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22'
    584
  - powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Roaming'
    2948
  - powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp'
    1436
  - powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
    1396
- cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\test22\AppData\Local\Temp\svchost32.exe "C:\Users\test22\AppData\Local\Temp\Launcher.exe"
  2196
  - svchost32.exe C:\Users\test22\AppData\Local\Temp\svchost32.exe "C:\Users\test22\AppData\Local\Temp\Launcher.exe"
    2412
    - cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
      240
      - schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
        2084
    - services32.exe "C:\Windows\system32\services32.exe"
      2164
      - cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
        2880
        
        powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22'
        2892
        
        powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Roaming'
        2488
        
        powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp'
        2828
      - cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\test22\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"
        2800
        
        svchost32.exe C:\Users\test22\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"
        1744
        
        cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
        1852
        
        schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
        2224
        
        sihost32.exe "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
        2868
    - cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\test22\AppData\Local\Temp\svchost32.exe"
      192
      - choice.exe choice /C Y /N /D Y /T 3
        1492

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
104.21.31.210	Active	Moloch
104.21.33.188	Active	Moloch
104.21.59.252	Active	Moloch
154.38.97.90	Active	Moloch
172.67.158.82	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (37 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 7, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 7, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 7, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:25 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:25 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:25 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 7, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (16 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 7, 2021, 8:23 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:23 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:23 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:23 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:23 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:23 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:23 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:23 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:24 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:24 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:24 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:24 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:24 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:25 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:24 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:24 a.m.			0	0

Command line console output was observed (3 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 7, 2021, 8:23 a.m.	buffer: SUCCESS: The scheduled task "services32" has successfully been created. console_handle: 0x0000000000000007	1	1
WriteConsoleW Sept. 7, 2021, 8:23 a.m.	buffer: Y console_handle: 0x0000000000000007	1	1
WriteConsoleW Sept. 7, 2021, 8:24 a.m.	buffer: SUCCESS: The scheduled task "services32" has successfully been created. console_handle: 0x0000000000000007	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 243 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003337a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a4f00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a4f00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a4f00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910270 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910270 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910660 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910660 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910660 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910ac0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910ac0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910ac0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910ac0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910ac0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910ac0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910ac0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910ac0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910b30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910b30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910b30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910ba0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910ba0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000333ab0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000333ab0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910970 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910970 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910970 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910d60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910d60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910e40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910e40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b932ce0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b932ce0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b933140 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b933140 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910660 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910660 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910660 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b910660 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000033cb30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003acf60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003acf60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 7, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003acf60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 7, 2021, 8:23 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 1263 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 7, 2021, 8:22 a.m.	process_identifier: 2548 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000850000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:22 a.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:22 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1321000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:22 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef19bb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 2490368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002280000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002460000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b7a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c2c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c56000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ca0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b7b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bcc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ce0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 584 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002a80000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 584 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002c20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feee661000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feee8de000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feee8de000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feee8df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feee8df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feee8df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feee8df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feee8df000 process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

svchost32.exe tried to sleep 121 seconds, actually delayed analysis time by 121 seconds

Creates executable files on the filesystem (2 events)

file	C:\Windows\System32\Microsoft\Telemetry\sihost32.exe
file	C:\Users\test22\AppData\Local\Temp\svchost32.exe

Creates a shortcut to an executable file (2 events)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
file	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (16 events)

cmdline	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
cmdline	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp'
cmdline	C:\Users\test22\AppData\Local\Temp\svchost32.exe "C:\Users\test22\AppData\Local\Temp\Launcher.exe"
cmdline	schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
cmdline	C:\Users\test22\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"
cmdline	"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
cmdline	cmd /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
cmdline	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Roaming'
cmdline	cmd /c C:\Users\test22\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"
cmdline	"C:\Windows\System32\cmd.exe" /c C:\Users\test22\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"
cmdline	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22'
cmdline	"C:\Windows\System32\cmd.exe" /c C:\Users\test22\AppData\Local\Temp\svchost32.exe "C:\Users\test22\AppData\Local\Temp\Launcher.exe"
cmdline	cmd /C choice /C Y /N /D Y /T 3 & Del "C:\Users\test22\AppData\Local\Temp\svchost32.exe"
cmdline	cmd /c C:\Users\test22\AppData\Local\Temp\svchost32.exe "C:\Users\test22\AppData\Local\Temp\Launcher.exe"
cmdline	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\test22\AppData\Local\Temp\svchost32.exe"
cmdline	powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'

A process created a hidden window (9 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Sept. 7, 2021, 8:23 a.m.	thread_identifier: 2244 thread_handle: 0x00000000000001f4 process_identifier: 2240 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000000000001fc	1	1
ShellExecuteExW Sept. 7, 2021, 8:23 a.m.	show_type: 0 filepath_r: cmd parameters: /c C:\Users\test22\AppData\Local\Temp\svchost32.exe "C:\Users\test22\AppData\Local\Temp\Launcher.exe" filepath: cmd	1	1
ShellExecuteExW Sept. 7, 2021, 8:23 a.m.	show_type: 0 filepath_r: cmd parameters: /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit filepath: cmd	1	1
ShellExecuteExW Sept. 7, 2021, 8:23 a.m.	show_type: 0 filepath_r: C:\Windows\system32\services32.exe parameters: filepath: C:\Windows\System32\services32.exe	1	1
ShellExecuteExW Sept. 7, 2021, 8:23 a.m.	show_type: 0 filepath_r: cmd parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\test22\AppData\Local\Temp\svchost32.exe" filepath: cmd	1	1
CreateProcessInternalW Sept. 7, 2021, 8:23 a.m.	thread_identifier: 1828 thread_handle: 0x00000000000001f4 process_identifier: 2880 current_directory: C:\Windows\system32 filepath: track: 1 command_line: "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000000000001fc	1	1
ShellExecuteExW Sept. 7, 2021, 8:24 a.m.	show_type: 0 filepath_r: cmd parameters: /c C:\Users\test22\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe" filepath: cmd	1	1
ShellExecuteExW Sept. 7, 2021, 8:24 a.m.	show_type: 0 filepath_r: cmd parameters: /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit filepath: cmd	1	1
ShellExecuteExW Sept. 7, 2021, 8:24 a.m.	show_type: 0 filepath_r: C:\Windows\system32\Microsoft\Telemetry\sihost32.exe parameters: filepath: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0001a400', u'virtual_address': u'0x00002000', u'entropy': 7.8088248692312945, u'name': u'.text', u'virtual_size': u'0x0001a314'}

entropy

7.80882486923

description

A section with a high entropy has been found

entropy

0.981308411215

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (8 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Sept. 7, 2021, 8:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 7, 2021, 8:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 7, 2021, 8:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 7, 2021, 8:24 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 7, 2021, 8:24 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 7, 2021, 8:24 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 7, 2021, 8:24 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 7, 2021, 8:25 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Uses Windows utilities for basic Windows functionality (5 events)

cmdline	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
cmdline	schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
cmdline	cmd /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
cmdline	cmd /C choice /C Y /N /D Y /T 3 & Del "C:\Users\test22\AppData\Local\Temp\svchost32.exe"
cmdline	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\test22\AppData\Local\Temp\svchost32.exe"

Communicates with host for which no DNS query was performed (5 events)

host	104.21.31.210
host	104.21.33.188
host	104.21.59.252
host	154.38.97.90
host	172.67.158.82

Installs itself for autorun at Windows startup (3 events)

cmdline	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
cmdline	schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
cmdline	cmd /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\svchost32.exe
file	C:\Windows\System32\Microsoft\Telemetry\sihost32.exe

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.668351
FireEye	Generic.mg.6557d0d59d2e4dee
McAfee	Artemis!6557D0D59D2E
Cyren	W64/MSIL_Troj.BCG.gen!Eldorado
ESET-NOD32	a variant of MSIL/TrojanDropper.Agent.FHJ
APEX	Malicious
Kaspersky	HEUR:Trojan.MSIL.Tasker.gen
BitDefender	Gen:Variant.Bulz.668351
Ad-Aware	Gen:Variant.Bulz.668351
McAfee-GW-Edition	BehavesLike.Win64.CoinMiner.cc
Emsisoft	Gen:Variant.Bulz.668351 (B)
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_99%
Avira	HEUR/AGEN.1143065
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Gen:Variant.Bulz.668351
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Bulz.668351
MAX	malware (ai score=82)
Ikarus	Trojan.MSIL.CoinMiner
MaxSecure	Trojan.Malware.300983.susgen

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 events)

dead_host	104.21.31.210:443
dead_host	154.38.97.90:8060

Launcher.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All