Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 17, 2021, 9:44 a.m.	Sept. 17, 2021, 10:02 a.m.

Size	637.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ea3e64c8d0945a81842d2a3a925949d7`
SHA256	`b6547b90fce8a68583625129bc0cb96317b82d47363efec1678b87898389459c`
CRC32	`AF4BC5EC`
ssdeep	`12288:Rczbx3FkE1IliLVTg2Ysq6Pfw1+iiK0YFWBM04OyrkPN:RczbxJMaZIs5PfwlT00Z04Jw1`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description)

SJFIIEESD-7.exe "C:\Users\test22\AppData\Local\Temp\SJFIIEESD-7.exe"
1648
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\test22\AppData\Local\Temp\SJFIIEESD-7.exe" -Force
  2812

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (8 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 17, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 17, 2021, 9:44 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:44 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 10:01 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (42 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fec60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe9a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe9a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe9a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe5a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe5a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe5a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe5a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe5a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe5a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe0a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe0a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe0a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004feba0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004feba0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004feba0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe760 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004feba0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004feba0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004feba0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004feba0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004feba0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004feba0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004feba0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fea60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fea60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fea60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fea60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fea60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fea60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fea60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fea60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fea60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fea60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fea60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fea60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fea60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fea60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe1e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe1e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe1e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004fe1e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 17, 2021, 9:44 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 17, 2021, 9:44 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x73351194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73222ba1 mscorlib+0x32d284 @ 0x7250d284 mscorlib+0x32d233 @ 0x7250d233 mscorlib+0x32d12a @ 0x7250d12a 0x6510f6 mscorlib+0x2d5861 @ 0x724b5861 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x357ee CorDllMainForThunk-0x56d0d clr+0xfa867 @ 0x7329a867 DllGetClassObjectInternal+0x358c6 CorDllMainForThunk-0x56c35 clr+0xfa93f @ 0x7329a93f PreBindAssemblyEx+0x107ff StrongNameSignatureVerification-0x174c clr+0x18836a @ 0x7332836a PreBindAssemblyEx+0x108ef StrongNameSignatureVerification-0x165c clr+0x18845a @ 0x7332845a CreateAssemblyNameObject+0x28676 GetMetaDataInternalInterface-0xfdf9 clr+0x55b0f @ 0x731f5b0f GetPrivateContextsPerfCounters+0x13ac DllGetActivationFactoryImpl-0x134b9 clr+0x8932e @ 0x7322932e mscorlib+0x2d5eb7 @ 0x724b5eb7 mscorlib+0x2d5c33 @ 0x724b5c33 mscorlib+0x2d7894 @ 0x724b7894 mscorlib+0x2d74ff @ 0x724b74ff mscorlib+0x2d71c3 @ 0x724b71c3 mscorlib+0x2d48ea @ 0x724b48ea mscorlib+0x36990b @ 0x7254990b 0x651ec2 0x651d63 0x6511ab system+0x19c522 @ 0x70c3c522 system+0x19e920 @ 0x70c3e920 system+0x19e803 @ 0x70c3e803 0x650dbe system+0x1f9799 @ 0x70c99799 system+0x1f92c8 @ 0x70c992c8 system+0x1eca74 @ 0x70c8ca74 system+0x1ec868 @ 0x70c8c868 system+0x1f82b8 @ 0x70c982b8 system+0x1ee54d @ 0x70c8e54d system+0x1f70ea @ 0x70c970ea system+0x1e56c0 @ 0x70c856c0 system+0x1f8215 @ 0x70c98215 system+0x1f6f75 @ 0x70c96f75 system+0x1ee251 @ 0x70c8e251 system+0x1ee229 @ 0x70c8e229 system+0x1ee170 @ 0x70c8e170 0x42a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77af011a system+0x1ebc85 @ 0x70c8bc85 system+0x1f683b @ 0x70c9683b system+0x1a5e44 @ 0x70c45e44 system+0x1fd8a0 @ 0x70c9d8a0 system+0x1fd792 @ 0x70c9d792 system+0x1a14bd @ 0x70c414bd 0x6500f2 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 2871320 registers.edi: 0 registers.eax: 2871320 registers.ebp: 2871400 registers.edx: 0 registers.ebx: 5446968 registers.esi: 5005136 registers.ecx: 1798465465	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 17, 2021, 9:44 a.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x73351194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73222ba1
mscorlib+0x32d284 @ 0x7250d284
mscorlib+0x32d233 @ 0x7250d233
mscorlib+0x32d12a @ 0x7250d12a
0x6510f6
mscorlib+0x2d5861 @ 0x724b5861
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95
DllGetClassObjectInternal+0x357ee CorDllMainForThunk-0x56d0d clr+0xfa867 @ 0x7329a867
DllGetClassObjectInternal+0x358c6 CorDllMainForThunk-0x56c35 clr+0xfa93f @ 0x7329a93f
PreBindAssemblyEx+0x107ff StrongNameSignatureVerification-0x174c clr+0x18836a @ 0x7332836a
PreBindAssemblyEx+0x108ef StrongNameSignatureVerification-0x165c clr+0x18845a @ 0x7332845a
CreateAssemblyNameObject+0x28676 GetMetaDataInternalInterface-0xfdf9 clr+0x55b0f @ 0x731f5b0f
GetPrivateContextsPerfCounters+0x13ac DllGetActivationFactoryImpl-0x134b9 clr+0x8932e @ 0x7322932e
mscorlib+0x2d5eb7 @ 0x724b5eb7
mscorlib+0x2d5c33 @ 0x724b5c33
mscorlib+0x2d7894 @ 0x724b7894
mscorlib+0x2d74ff @ 0x724b74ff
mscorlib+0x2d71c3 @ 0x724b71c3
mscorlib+0x2d48ea @ 0x724b48ea
mscorlib+0x36990b @ 0x7254990b
0x651ec2
0x651d63
0x6511ab
system+0x19c522 @ 0x70c3c522
system+0x19e920 @ 0x70c3e920
system+0x19e803 @ 0x70c3e803
0x650dbe
system+0x1f9799 @ 0x70c99799
system+0x1f92c8 @ 0x70c992c8
system+0x1eca74 @ 0x70c8ca74
system+0x1ec868 @ 0x70c8c868
system+0x1f82b8 @ 0x70c982b8
system+0x1ee54d @ 0x70c8e54d
system+0x1f70ea @ 0x70c970ea
system+0x1e56c0 @ 0x70c856c0
system+0x1f8215 @ 0x70c98215
system+0x1f6f75 @ 0x70c96f75
system+0x1ee251 @ 0x70c8e251
system+0x1ee229 @ 0x70c8e229
system+0x1ee170 @ 0x70c8e170
0x42a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77af011a
system+0x1ebc85 @ 0x70c8bc85
system+0x1f683b @ 0x70c9683b
system+0x1a5e44 @ 0x70c45e44
system+0x1fd8a0 @ 0x70c9d8a0
system+0x1fd792 @ 0x70c9d792
system+0x1a14bd @ 0x70c414bd
0x6500f2
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x7566b727
registers.esp: 2871320
registers.edi: 0
registers.eax: 2871320
registers.ebp: 2871400
registers.edx: 0
registers.ebx: 5446968
registers.esi: 5005136
registers.ecx: 1798465465

Allocates read-write-execute memory (usually to unpack itself) (50 out of 182 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00db0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00412000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00445000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00437000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70692000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00436000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00651000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00652000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00653000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0065a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0065b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0065f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04af0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04af1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04af2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0122f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01220000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04af3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06b30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 61440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06b31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01290000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01291000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01292000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01293000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01295000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01296000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01297000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01221000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01298000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01299000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef48000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\test22\AppData\Local\Temp\SJFIIEESD-7.exe" -Force
cmdline	powershell Start-Sleep -s 5; Remove-Item -Path "C:\Users\test22\AppData\Local\Temp\SJFIIEESD-7.exe" -Force

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\SJFIIEESD-7.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 17, 2021, 9:44 a.m.	show_type: 0 filepath_r: powershell parameters: Start-Sleep -s 5; Remove-Item -Path "C:\Users\test22\AppData\Local\Temp\SJFIIEESD-7.exe" -Force filepath: powershell	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 17, 2021, 9:44 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 17, 2021, 10:01 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\SJFIIEESD-7.exe

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Executed a process and injected code into it, probably while unpacking (21 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1648	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1648	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 1648	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x00000264 suspend_count: 1 process_identifier: 1648	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 1648	1	0
NtGetContextThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000000e0	1	0
NtSetContextThread Sept. 17, 2021, 9:44 a.m.	registers.eip: 1931619204 registers.esp: 2871528 registers.edi: 60589100 registers.eax: 22 registers.ebp: 2871544 registers.edx: 87 registers.ebx: 62805832 registers.esi: 61944300 registers.ecx: 16365 thread_handle: 0x000000e0 process_identifier: 1648	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 1648	1	0
NtGetContextThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 1648	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000002c0 suspend_count: 1 process_identifier: 1648	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000002fc suspend_count: 1 process_identifier: 1648	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x00000368 suspend_count: 1 process_identifier: 1648	1	0
CreateProcessInternalW Sept. 17, 2021, 9:44 a.m.	thread_identifier: 2412 thread_handle: 0x000004ac process_identifier: 2812 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\test22\AppData\Local\Temp\SJFIIEESD-7.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004e0	1	1
NtResumeThread Sept. 17, 2021, 10:01 a.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2812	1	0
NtResumeThread Sept. 17, 2021, 10:01 a.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2812	1	0
NtResumeThread Sept. 17, 2021, 10:01 a.m.	thread_handle: 0x00000434 suspend_count: 1 process_identifier: 2812	1	0
NtResumeThread Sept. 17, 2021, 10:01 a.m.	thread_handle: 0x00000480 suspend_count: 1 process_identifier: 2812	1	0

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.46718981
FireEye	Generic.mg.ea3e64c8d0945a81
ALYac	Trojan.GenericKD.46718981
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0058031d1 )
Alibaba	TrojanDownloader:MSIL/Seraph.c2d406f9
K7GW	Trojan ( 0058031d1 )
Cybereason	malicious.013fa5
Cyren	W32/Trojan.QQPM-8651
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of MSIL/GenKryptik.FJVC
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Downloader.MSIL.Seraph.gen
BitDefender	Trojan.GenericKD.46718981
Avast	Win32:MalwareX-gen [Trj]
Tencent	Msil.Trojan-downloader.Seraph.Akfe
Ad-Aware	Trojan.GenericKD.46718981
Emsisoft	Trojan.GenericKD.46718981 (B)
Zillya	Downloader.Seraph.Win32.1073
TrendMicro	TROJ_GEN.R02DC0PGV21
McAfee-GW-Edition	AgentTesla-FDAW!EA3E64C8D094
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Krypt
Jiangmin	TrojanDownloader.MSIL.adfy
Webroot	W32.Malware.Gen
Avira	TR/Kryptik.cocmv
Antiy-AVL	Trojan/Generic.ASMalwS.3454A82
Gridinsoft	Malware.Win32.GenericMC.cc
Microsoft	Trojan:Win32/AgentTesla!mclg
GData	Trojan.GenericKD.46718981
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.AgentTesla.C4572492
McAfee	AgentTesla-FDAW!EA3E64C8D094
MAX	malware (ai score=100)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Spyware.PasswordStealer
TrendMicro-HouseCall	TROJ_GEN.R02DC0PGV21
SentinelOne	Static AI - Malicious PE
Fortinet	W32/Seraph.FIEL!tr.dldr
BitDefenderTheta	Gen:NN.ZemsilF.34142.Nm0@a4FEzBo
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_90% (W)
MaxSecure	Trojan.Malware.74570710.susgen

SJFIIEESD-7.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All