popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

75796491.exe

Generic Malware Antivirus PWS AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Sept. 22, 2021, 9:44 a.m. Sept. 22, 2021, 9:53 a.m.
Size 769.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 c9da7eeb35209ea9a47fcde193e77266
SHA256 6861164d09d90910f41f977e32f0d4ecf23441c143b56f3b2a12fdd1d2d8da20
CRC32 D7E4B5B9
ssdeep 12288:XZG+/gecNU2zqX6lUB2AkeR3ACtjm94vD0n5P+MmZZL:pG7DNgWUB2AkeR3APuLWI
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "MyApp" has successfully been created.
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005f4f70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005f4330
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005f4330
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00710140
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070fe80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070fe80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070fe80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070fa80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070fa80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070fa80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070fa80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070fa80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070fa80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070f580
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070f580
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070f580
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00710080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00710080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00710080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070fc40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00710080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00710080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00710080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00710080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00710080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00710080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00710080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070ff40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070ff40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070ff40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070ff40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070ff40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070ff40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070ff40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070ff40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070ff40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070ff40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070ff40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070ff40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070ff40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070ff40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070f6c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0070f6c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x76a6b37e
0x6396f9d
0x639623d
0x639484e
0x639473a
0x63c00cf
system+0x1d3f63 @ 0x70073f63
0x88ce85
0x88cbca
0x88027b
system+0x1f9799 @ 0x70c99799
system+0x1f92c8 @ 0x70c992c8
system+0x1eca74 @ 0x70c8ca74
system+0x1ec868 @ 0x70c8c868
system+0x1f82b8 @ 0x70c982b8
system+0x1ee54d @ 0x70c8e54d
system+0x1f70ea @ 0x70c970ea
system+0x1e56c0 @ 0x70c856c0
system+0x1f8215 @ 0x70c98215
system+0x1f6f75 @ 0x70c96f75
system+0x1ee251 @ 0x70c8e251
system+0x1ee229 @ 0x70c8e229
system+0x1ee170 @ 0x70c8e170
0x47a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77af011a
system+0x1ebc85 @ 0x70c8bc85
system+0x1f683b @ 0x70c9683b
system+0x1a5e44 @ 0x70c45e44
system+0x1fd8a0 @ 0x70c9d8a0
system+0x1fd792 @ 0x70c9d792
system+0x1a14bd @ 0x70c414bd
0x8800af
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x740df5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74d37f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74d34de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x76a6b479
registers.esp: 1370356
registers.edi: 1969676232
registers.eax: 12255232
registers.ebp: 1370560
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00340000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00340000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1092
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x731a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1092
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x731a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a40000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00462000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00495000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0049b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00497000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00880000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0046a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0048a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00487000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1092
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70692000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00486000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00881000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00888000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00889000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0088d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0088e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06390000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0046c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0048b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x063cf000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x063c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06391000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06392000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06393000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06394000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06395000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06396000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0048c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06397000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1092
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00488000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6eca1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6eca2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b21000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b22000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021fa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021d3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021d4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline cmd.exe /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline powershell Start-Sleep -s 20
cmdline schtasks /create /tn MyApp /tr C:\Users\test22\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 20
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: Start-Sleep -s 20
filepath: powershell
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: cmd.exe
parameters: /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
filepath: cmd.exe
1 1 0
section {u'size_of_data': u'0x000b0a00', u'virtual_address': u'0x00002000', u'entropy': 6.918571253373602, u'name': u'.text', u'virtual_size': u'0x000b0964'} entropy 6.91857125337 description A section with a high entropy has been found
entropy 0.937624419376 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
url http://crl4.digicert.com/sha2-assured-ts.crl0
url http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
url http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
url https://www.nuget.org/packages/Newtonsoft.Json.Bson
url http://ocsp.digicert.com0O
url http://ocsp.digicert.com0K
url http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
url http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
url http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
url https://www.newtonsoft.com/jsonschema
url http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
url http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
url https://www.newtonsoft.com/json
url http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
url http://ocsp.digicert.com0N
url http://ocsp.digicert.com0C
url http://crl3.digicert.com/sha2-assured-ts.crl02
url https://www.digicert.com/CPS0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline cmd.exe /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline schtasks /create /tn MyApp /tr C:\Users\test22\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2756
region_size: 57344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000016c
1 0 0
cmdline cmd.exe /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline schtasks /create /tn MyApp /tr C:\Users\test22\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELl±Ý`à Lt`@àRQ °œÐ±.text$JL`P`.data(`P@0À.rdata0pR@0@.eh_framd€X@0@.bssp €0À.idataœ°l@0À.CRTÀt@0À.tls Ðv@0À
base_address: 0x00400000
process_identifier: 2756
process_handle: 0x0000016c
1 1 0

WriteProcessMemory

 buffer: service.exeýÿÿÿ@ Z@ÿÿÿÿ
base_address: 0x00406000
process_identifier: 2756
process_handle: 0x0000016c
1 1 0

WriteProcessMemory

 buffer: libgcc_s_dw2-1.dll__register_frame_info__deregister_frame_infolibgcj-16.dll_Jv_RegisterClassesaddr1qx86697cpa5gepdy50uhgtdltgcsndhqtgpycv3q0j54wty045tasrmg3jz6fglewskm7k33pxmwqkszfsezql9f2ukqu5n8ht48ZPwUfPqVDLruBkyFhGgwRd5z4JnFDqo9mbnVa8Cv8SHw9Wt2U98pDUGXZEp9J2xVD3XcSTfn2bjUeXRyn41kAyKt6TmY4%APPDATA%\service.exe/C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /fcmd.exeopen%APPDATA%%s\%s5@Mingw runtime failure: VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d. Unknown pseudo relocation bit size %d. .glob-1.0-mingw32.GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (MinGW.org GCC-6.3.0-1) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0
base_address: 0x00407000
process_identifier: 2756
process_handle: 0x0000016c
1 1 0

WriteProcessMemory

 buffer: x°¼¶±à°Ô¶ø±ì°`·²p±p·ˆ²x±·²¨²´²Ì²ä²ò²³³,³<³J³\³l³‚³–³¨³¶³Ä³Ô³ð³´´6´>´L´^´n´x´„´”´¤´´´Â´Ô´Þ´è´ô´µµµµ(µ4µ<µFµPµXµbµlµxµ‚µŒµ–µ¢µ¬µ¶µÀµÊµÔµàµìµüµ¶ ¶4¶D¶¨²´²Ì²ä²ò²³³,³<³J³\³l³‚³–³¨³¶³Ä³Ô³ð³´´6´>´L´^´n´x´„´”´¤´´´Â´Ô´Þ´è´ô´µµµµ(µ4µ<µFµPµXµbµlµxµ‚µŒµ–µ¢µ¬µ¶µÀµÊµÔµàµìµüµ¶ ¶4¶D¶pCopyFileAÏDeleteCriticalSectionìEnterCriticalSectionExitProcessExpandEnvironmentStringsA,FindClose0FindFirstFileAAFindNextFileA`FreeLibrary„GetCommandLineAþGetLastErrorGetModuleFileNameAGetModuleHandleAAGetProcAddress¯GlobalAllocºGlobalLockÁGlobalUnlockÞInitializeCriticalSection.LeaveCriticalSection1LoadLibraryAtSetUnhandledExceptionFilter€Sleep•TlsGetValue½VirtualProtect¿VirtualQueryP_strdupR_stricollX__getmainargsw__mb_cur_maxƒ__p__environ…__p__fmode™__set_app_typeÛ_cexit_errnoD_fpreset^_fullpath¡_iob¦_isctype±_onexitº_pctypeñ_setmode;abortCatexitJcallockfreevfwrite£mallocªmbstowcs¯memcpyÄreallocÆrenameËsetlocaleÍsignalÐsprintfÚstrcollástrlenýtolowervfprintf-wcstombsShellExecuteA=CloseClipboard±EmptyClipboardîGetClipboardDataÇOpenClipboard SetClipboardData°°°°°°°°°°°°°°°°°°°°°°°°°KERNEL32.dll°°msvcrt.dll(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°msvcrt.dll<°SHELL32.DLLP°P°P°P°P°USER32.dll
base_address: 0x0040b000
process_identifier: 2756
process_handle: 0x0000016c
1 1 0

WriteProcessMemory

 buffer: 5@À4@
base_address: 0x0040c000
process_identifier: 2756
process_handle: 0x0000016c
1 1 0

WriteProcessMemory

 buffer: Ð@Ð@8 @À@
base_address: 0x0040d000
process_identifier: 2756
process_handle: 0x0000016c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2756
process_handle: 0x0000016c
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELl±Ý`à Lt`@àRQ °œÐ±.text$JL`P`.data(`P@0À.rdata0pR@0@.eh_framd€X@0@.bssp €0À.idataœ°l@0À.CRTÀt@0À.tls Ðv@0À
base_address: 0x00400000
process_identifier: 2756
process_handle: 0x0000016c
1 1 0
Process injection Process 1092 called NtSetContextThread to modify thread in remote process 2756
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4199168
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000404
process_identifier: 2756
1 0 0
Process injection Process 1092 resumed a thread in remote process 2756
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000404
suspend_count: 1
process_identifier: 2756
1 0 0
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
cmdline cmd.exe /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline schtasks /create /tn MyApp /tr C:\Users\test22\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1092
1 0 0

NtResumeThread

 thread_handle: 0x0000014c
suspend_count: 1
process_identifier: 1092
1 0 0

NtResumeThread

 thread_handle: 0x00000188
suspend_count: 1
process_identifier: 1092
1 0 0

CreateProcessInternalW

 thread_identifier: 1260
thread_handle: 0x000003e4
process_identifier: 2752
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 20
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000003d8
1 1 0

CreateProcessInternalW

 thread_identifier: 1788
thread_handle: 0x00000404
process_identifier: 2756
current_directory:
filepath:
track: 1
command_line: C:\Users\test22\AppData\Local\Temp\75796491.exe
filepath_r:
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000016c
1 1 0

NtGetContextThread

 thread_handle: 0x00000404
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2756
region_size: 57344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000016c
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELl±Ý`à Lt`@àRQ °œÐ±.text$JL`P`.data(`P@0À.rdata0pR@0@.eh_framd€X@0@.bssp €0À.idataœ°l@0À.CRTÀt@0À.tls Ðv@0À
base_address: 0x00400000
process_identifier: 2756
process_handle: 0x0000016c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2756
process_handle: 0x0000016c
1 1 0

WriteProcessMemory

 buffer: service.exeýÿÿÿ@ Z@ÿÿÿÿ
base_address: 0x00406000
process_identifier: 2756
process_handle: 0x0000016c
1 1 0

WriteProcessMemory

 buffer: libgcc_s_dw2-1.dll__register_frame_info__deregister_frame_infolibgcj-16.dll_Jv_RegisterClassesaddr1qx86697cpa5gepdy50uhgtdltgcsndhqtgpycv3q0j54wty045tasrmg3jz6fglewskm7k33pxmwqkszfsezql9f2ukqu5n8ht48ZPwUfPqVDLruBkyFhGgwRd5z4JnFDqo9mbnVa8Cv8SHw9Wt2U98pDUGXZEp9J2xVD3XcSTfn2bjUeXRyn41kAyKt6TmY4%APPDATA%\service.exe/C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /fcmd.exeopen%APPDATA%%s\%s5@Mingw runtime failure: VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d. Unknown pseudo relocation bit size %d. .glob-1.0-mingw32.GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (MinGW.org GCC-6.3.0-1) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0
base_address: 0x00407000
process_identifier: 2756
process_handle: 0x0000016c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00408000
process_identifier: 2756
process_handle: 0x0000016c
1 1 0

WriteProcessMemory

 buffer: x°¼¶±à°Ô¶ø±ì°`·²p±p·ˆ²x±·²¨²´²Ì²ä²ò²³³,³<³J³\³l³‚³–³¨³¶³Ä³Ô³ð³´´6´>´L´^´n´x´„´”´¤´´´Â´Ô´Þ´è´ô´µµµµ(µ4µ<µFµPµXµbµlµxµ‚µŒµ–µ¢µ¬µ¶µÀµÊµÔµàµìµüµ¶ ¶4¶D¶¨²´²Ì²ä²ò²³³,³<³J³\³l³‚³–³¨³¶³Ä³Ô³ð³´´6´>´L´^´n´x´„´”´¤´´´Â´Ô´Þ´è´ô´µµµµ(µ4µ<µFµPµXµbµlµxµ‚µŒµ–µ¢µ¬µ¶µÀµÊµÔµàµìµüµ¶ ¶4¶D¶pCopyFileAÏDeleteCriticalSectionìEnterCriticalSectionExitProcessExpandEnvironmentStringsA,FindClose0FindFirstFileAAFindNextFileA`FreeLibrary„GetCommandLineAþGetLastErrorGetModuleFileNameAGetModuleHandleAAGetProcAddress¯GlobalAllocºGlobalLockÁGlobalUnlockÞInitializeCriticalSection.LeaveCriticalSection1LoadLibraryAtSetUnhandledExceptionFilter€Sleep•TlsGetValue½VirtualProtect¿VirtualQueryP_strdupR_stricollX__getmainargsw__mb_cur_maxƒ__p__environ…__p__fmode™__set_app_typeÛ_cexit_errnoD_fpreset^_fullpath¡_iob¦_isctype±_onexitº_pctypeñ_setmode;abortCatexitJcallockfreevfwrite£mallocªmbstowcs¯memcpyÄreallocÆrenameËsetlocaleÍsignalÐsprintfÚstrcollástrlenýtolowervfprintf-wcstombsShellExecuteA=CloseClipboard±EmptyClipboardîGetClipboardDataÇOpenClipboard SetClipboardData°°°°°°°°°°°°°°°°°°°°°°°°°KERNEL32.dll°°msvcrt.dll(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°(°msvcrt.dll<°SHELL32.DLLP°P°P°P°P°USER32.dll
base_address: 0x0040b000
process_identifier: 2756
process_handle: 0x0000016c
1 1 0

WriteProcessMemory

 buffer: 5@À4@
base_address: 0x0040c000
process_identifier: 2756
process_handle: 0x0000016c
1 1 0

WriteProcessMemory

 buffer: Ð@Ð@8 @À@
base_address: 0x0040d000
process_identifier: 2756
process_handle: 0x0000016c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2756
process_handle: 0x0000016c
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4199168
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000404
process_identifier: 2756
1 0 0

NtResumeThread

 thread_handle: 0x00000404
suspend_count: 1
process_identifier: 2756
1 0 0

NtResumeThread

 thread_handle: 0x00000294
suspend_count: 1
process_identifier: 2752
1 0 0

NtResumeThread

 thread_handle: 0x000002e8
suspend_count: 1
process_identifier: 2752
1 0 0

NtResumeThread

 thread_handle: 0x00000434
suspend_count: 1
process_identifier: 2752
1 0 0

NtResumeThread

 thread_handle: 0x00000480
suspend_count: 1
process_identifier: 2752
1 0 0

CreateProcessInternalW

 thread_identifier: 1972
thread_handle: 0x0000028c
process_identifier: 1820
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000294
1 1 0

CreateProcessInternalW

 thread_identifier: 2244
thread_handle: 0x00000084
process_identifier: 2976
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: schtasks /create /tn MyApp /tr C:\Users\test22\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
filepath_r: C:\Windows\system32\schtasks.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000088
1 1 0
Lionic Trojan.MSIL.Injuke.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.46975633
FireEye Generic.mg.c9da7eeb35209ea9
ALYac Trojan.GenericKD.46975633
Zillya Trojan.Kryptik.Win32.3440717
K7AntiVirus Trojan ( 005824571 )
Alibaba Trojan:MSIL/Injuke.0d35ec24
K7GW Trojan ( 005824571 )
Cyren W32/MSIL_Kryptik.FOA.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Kryptik.ACTY
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan.MSIL.Injuke.gen
BitDefender Trojan.GenericKD.46975633
Avast Win32:PWSX-gen [Trj]
Tencent Win32.Trojan.Falsesign.Tbsk
Ad-Aware Trojan.GenericKD.46975633
Emsisoft Trojan.GenericKD.46975633 (B)
DrWeb Trojan.PackedNET.1029
McAfee-GW-Edition PWS-FCYR!C9DA7EEB3520
Sophos Mal/Generic-S
Ikarus Trojan.MSIL.Crypt
Webroot Vir.Tool.Gen
Avira TR/Kryptik.yyixq
Antiy-AVL Trojan/Generic.ASMalwS.349CDC2
Gridinsoft Trojan.Win32.Kryptik.vb
Microsoft Trojan:Win32/Sabsik.FL.B!ml
GData Trojan.GenericKD.46975633
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.C4634019
McAfee PWS-FCYR!C9DA7EEB3520
MAX malware (ai score=86)
VBA32 TScope.Trojan.MSIL
Malwarebytes Trojan.MalPack.MSIL
TrendMicro-HouseCall TROJ_GEN.R002H0CIG21
SentinelOne Static AI - Malicious PE
Fortinet MSIL/Kryptik.AAWK!tr
BitDefenderTheta Gen:NN.ZemsilF.34142.Wm2@aykEeih
AVG Win32:PWSX-gen [Trj]
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_100% (W)