Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 15, 2021, 9:21 a.m.	Sept. 15, 2021, 9:41 a.m.

Size	1.2MB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`e07ce1ac09be171289b93538009c471c`
SHA256	`d6140622785d188975ff7d8886fc4bf675597d064c939efe0d391e3dec0610d8`
CRC32	`E50F948B`
ssdeep	`24576:QDNgWUB2AkeR7nTXTQXKmZUXQbYlXJmTvx8:QBgWUB2AkeBnIXK0elXMT+`
Yara	IsPE64 - (no description) PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

vmnet.exe "C:\Users\test22\AppData\Local\Temp\vmnet.exe"
1960
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com
  3064

Name	Response	Post-Analysis Lookup
www.youtube.com	A 142.250.66.78 A 142.250.66.46 A 142.250.207.78 A 172.217.174.206 A 142.250.204.110 A 142.250.66.142 A 142.250.204.46 A 142.250.199.78 A 142.250.204.78 A 142.250.204.142 A 172.217.31.238 A 142.250.66.110 CNAME youtube-ui.l.google.com A 216.58.200.78 A 172.217.161.174 A 172.217.24.78	172.217.161.46
www.google.com	A 142.250.66.132	142.250.196.100

IP Address	Status	Action
142.250.204.78	Active	Moloch
142.250.66.132	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (8 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 15, 2021, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 15, 2021, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 9:41 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 15, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Sept. 15, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Sept. 15, 2021, 9:41 a.m.			0	0

Command line console output was observed (10 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 15, 2021, 9:41 a.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x0000000000000023	1	1
WriteConsoleW Sept. 15, 2021, 9:41 a.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x000000000000002b	1	1
WriteConsoleW Sept. 15, 2021, 9:41 a.m.	buffer: TEST22-PC www.google.com 142.250.66.132 {} console_handle: 0x0000000000000033	1	1
WriteConsoleW Sept. 15, 2021, 9:41 a.m.	buffer: TEST22-PC www.youtube.com 142.250.204.78 {} console_handle: 0x0000000000000037	1	1
WriteConsoleW Sept. 15, 2021, 9:41 a.m.	buffer: TEST22-PC www.youtube.com 142.250.204.78 {} console_handle: 0x000000000000003b	1	1
WriteConsoleW Sept. 15, 2021, 9:41 a.m.	buffer: TEST22-PC www.google.com 142.250.66.132 {} console_handle: 0x000000000000003f	1	1
WriteConsoleW Sept. 15, 2021, 9:41 a.m.	buffer: TEST22-PC www.youtube.com 142.250.204.78 {} console_handle: 0x0000000000000043	1	1
WriteConsoleW Sept. 15, 2021, 9:41 a.m.	buffer: TEST22-PC www.google.com 142.250.66.132 {} console_handle: 0x0000000000000013	1	1
WriteConsoleW Sept. 15, 2021, 9:41 a.m.	buffer: TEST22-PC www.youtube.com 142.250.204.78 {} console_handle: 0x0000000000000017	1	1
WriteConsoleW Sept. 15, 2021, 9:41 a.m.	buffer: TEST22-PC www.google.com 142.250.66.132 {} console_handle: 0x000000000000001b	1	1

Uses Windows APIs to generate a cryptographic key (43 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000308770 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8d3f90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8d3f90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8d3f90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8d3a50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8d3a50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8d4000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8d4000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8d4000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8d4000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee350 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee350 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee350 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8d3c80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8d3c80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8d3c80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee890 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee890 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee890 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee970 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee970 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8ee900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8eea50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8eea50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8eea50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8eea50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b90ec80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b90ec80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9327f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b932860 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 15, 2021, 9:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9328d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 15, 2021, 9:13 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 270 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 2424832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000009e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000bb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1241000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef18db000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 2490368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002560000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1242000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1242000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1242000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1242000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1242000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1242000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1242000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1242000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1242000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1242000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1242000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1244000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1244000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1244000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1244000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91a9a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b76000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91aac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91aaa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91abb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91aec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91abd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91a92000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91aab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91a9b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c03000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c04000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefb037000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c05000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:13 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c07000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com
cmdline	powershell Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com

Executes one or more WMI queries (1 event)

wmi	Select * from Win32_PingStatus where ((Address='www.google.com' Or Address='www.youtube.com' Or Address='www.google.com' Or Address='www.youtube.com' Or Address='www.google.com' Or Address='www.youtube.com') And TimeToLive=80 And BufferSize=32)

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 15, 2021, 9:15 a.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com filepath: powershell	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0011d200', u'virtual_address': u'0x00002000', u'entropy': 7.464906040029326, u'name': u'.text', u'virtual_size': u'0x0011d160'}

entropy

7.46490604003

description

A section with a high entropy has been found

entropy

0.961230509903

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 15, 2021, 9:41 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Generates some ICMP traffic

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

Lionic	Trojan.Win32.Bulz.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Bulz.710216
Malwarebytes	Trojan.Crypt
CrowdStrike	win/malicious_confidence_80% (W)
Alibaba	TrojanDownloader:MSIL/Seraph.b3045a40
K7GW	Trojan ( 005823971 )
K7AntiVirus	Trojan ( 005823971 )
Arcabit	Trojan.Bulz.DAD648
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Kryptik.ACTE
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Downloader.MSIL.Seraph.gen
BitDefender	Gen:Variant.Bulz.710216
MicroWorld-eScan	Gen:Variant.Bulz.710216
Avast	Win64:PWSX-gen [Trj]
Tencent	Msil.Trojan-downloader.Seraph.Ahya
Ad-Aware	Gen:Variant.Bulz.710216
F-Secure	Heuristic.HEUR/AGEN.1143851
DrWeb	Trojan.Siggen15.14820
McAfee-GW-Edition	Artemis!Trojan
FireEye	Gen:Variant.Bulz.710216
Emsisoft	Gen:Variant.Bulz.710216 (B)
Ikarus	Trojan.MSIL.Crypt
Webroot	W32.Trojan.FL
Avira	HEUR/AGEN.1143851
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Sabsik.FL.A!ml
ZoneAlarm	HEUR:Trojan-Downloader.MSIL.Seraph.gen
GData	Gen:Variant.Bulz.710216
McAfee	Artemis!E07CE1AC09BE
MAX	malware (ai score=84)
Cylance	Unsafe
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	MSIL/Kryptik.ACTE!tr
AVG	Win64:PWSX-gen [Trj]

vmnet.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All