Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 25, 2021, 11:05 a.m.	Sept. 25, 2021, 11:17 a.m.

Size	5.7MB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`83d119a963e7050995f9bf6be8841b95`
SHA256	`d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486`
CRC32	`D5C0F05F`
ssdeep	`49152:OZxqAErb/T/vO90dL3BmAFd4A64nsfJ49fEM5QcLTmk/2PU3oq5Z/tXGKSXzDBme:OZZ0hEumAQQQQQQQQQQQQQ`
Yara	Malicious_Packer_Zero - Malicious Packer UPX_Zero - UPX packed file IsPE64 - (no description) PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware anti_vm_detect - Possibly employs anti-virtualization techniques Malicious_Library_Zero - Malicious_Library NPKI_Zero - File included NPKI

clr.exe "C:\Users\test22\AppData\Local\Temp\clr.exe"
2480
- powershell.exe "powershell.exe" -ep bypass & 'C:\Users\test22\AppData\Local\Temp\\ready.ps1'
  508
  - csc.exe "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\2ytid-uw.cmdline"
    1664
    - cvtres.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RES9BE7.tmp" "c:\Users\test22\AppData\Local\Temp\CSC9B98.tmp"
      2296
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
    624

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 25, 2021, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 25, 2021, 10:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:59 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 25, 2021, 10:58 a.m.			0	0
IsDebuggerPresent Sept. 25, 2021, 10:58 a.m.			0	0
IsDebuggerPresent Sept. 25, 2021, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 25, 2021, 10:59 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 145 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003e3c00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f4d60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f4d60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f4d60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4350 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4350 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4350 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4350 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4580 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4580 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4580 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f4970 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f4970 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f4970 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f5000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f5000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f5000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f5000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f5000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f5000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f5000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f5000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4a50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4a50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4cf0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4cf0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4d60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4d60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b2900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b2900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4890 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4890 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4890 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4890 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4f20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4f20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4f20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4f20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b4f20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:59 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b9b2b30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 25, 2021, 10:58 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.symtab

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 25, 2021, 11 a.m.	stacktrace: atol+0x62 qsort-0x202 ntdll+0x664e @ 0x7790664e strtol+0x16a __C_specific_handler-0x212 ntdll+0x182fa @ 0x779182fa KiUserApcDispatcher+0x2b KiUserCallbackDispatcher-0xdb ntdll+0x5112b @ 0x7795112b NtDelayExecution+0xa NtQueryDirectoryFile-0x6 ntdll+0x5165a @ 0x7795165a New_ntdll_NtDelayExecution+0xda New_ntdll_NtDeleteFile-0x64 @ 0x74e8135f SleepEx+0xb3 GetLastError-0x5d kernelbase+0x1203 @ 0x7fefde31203 TranslateSecurityAttributes+0xbd50 LegacyNGenTryEnumerateFusionCache-0x2ce0 mscorwks+0x727490 @ 0x7feeca57490 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7721652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x7792c521 exception.instruction_r: 8b 01 85 c0 0f 8e 35 1a 02 00 3d ff ff ff 7f 0f exception.symbol: atol+0x62 qsort-0x202 ntdll+0x664e exception.instruction: mov eax, dword ptr [rcx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 26190 exception.address: 0x7790664e registers.r14: 0 registers.r15: 0 registers.rcx: 8787503087616 registers.rsi: 0 registers.r10: 3682352 registers.rbx: 0 registers.rsp: 498596320 registers.r11: 498594472 registers.r8: 32 registers.r9: 463481520 registers.rdx: 498594400 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 8787503087615 registers.r13: 0	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 381 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 2555904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028810000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028840000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028900000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef196b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028b40000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028b60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ffffef0000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ffffef0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028902000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028904000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bfc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c26000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028906000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028907000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b6d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:58 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cc2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\get-dnsprovider.PS1
file	c:\Users\test22\AppData\Local\Temp\2ytid-uw.dll
file	C:\Users\test22\AppData\Local\Temp\ready.ps1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
cmdline	"powershell.exe" -ep bypass & 'C:\Users\test22\AppData\Local\Temp\\ready.ps1'

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\2ytid-uw.dll

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Sept. 25, 2021, 10:58 a.m.	thread_identifier: 276 thread_handle: 0x0000000000000244 process_identifier: 508 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell.exe" -ep bypass & 'C:\Users\test22\AppData\Local\Temp\\ready.ps1' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000248	1	1	0
CreateProcessInternalW Sept. 25, 2021, 10:59 a.m.	thread_identifier: 2384 thread_handle: 0x000000000000042c process_identifier: 624 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000444	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 25, 2021, 10:59 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 25, 2021, 10:59 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\2ytid-uw.cmdline"

Deletes executed files from disk (2 events)

file	C:\Users\test22\AppData\Local\Temp\RES9BE7.tmp
file	c:\Users\test22\AppData\Local\Temp\CSC9B98.tmp

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\2ytid-uw.cmdline"
parent_process	powershell.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile

Creates a suspicious Powershell process (3 events)

option	-noprofile	value	Does not load current user profile
option	-nologo	value	Hides the copyright banner when PowerShell launches
option	-ep bypass	value	Attempts to bypass execution policy

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Detects the presence of Wine emulator (1 event)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress Sept. 25, 2021, 10:58 a.m.	ordinal: 0 function_address: 0x000007feff1a7a50 function_name: wine_get_version module: ntdll module_address: 0x0000000077900000		-1073741511	0

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.47025613
FireEye	Trojan.GenericKD.47025613
McAfee	Artemis!83D119A963E7
Cylance	Unsafe
K7AntiVirus	Trojan ( 00580cbe1 )
K7GW	Trojan ( 00580cbe1 )
CrowdStrike	win/malicious_confidence_60% (W)
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of WinGo/GoCLR.B
APEX	Malicious
ClamAV	Win.Malware.Bulz-9847817-0
Kaspersky	Trojan-Dropper.MSIL.Agent.seskpn
BitDefender	Trojan.GenericKD.47025613
NANO-Antivirus	Trojan.Win64.Generic.jcifsf
Avast	Win64:Trojan-gen
Tencent	Win32.Trojan.Goclr.Ebqn
Ad-Aware	Trojan.GenericKD.47025613
Emsisoft	Trojan.GenericKD.47025613 (B)
DrWeb	PowerShell.Inject.56
McAfee-GW-Edition	BehavesLike.Win64.Generic.th
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Jiangmin	Trojan.Generic.gzxxe
Avira	TR/Drop.Agent.fdymx
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Trojan.GenericKD.47025613
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Agent.R442164
ALYac	Trojan.GenericKD.47025613
MAX	malware (ai score=88)
Malwarebytes	Malware.AI.4021206680
TrendMicro-HouseCall	TROJ_GEN.R002H0DIN21
Rising	HackTool.GoCLR!1.D71D (CLASSIC)
Ikarus	Win32.Outbreak
Fortinet	W64/GoCLR.B!tr
AVG	Win64:Trojan-gen
Panda	Trj/CI.A

clr.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All