Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 29, 2021, 10:32 a.m.	Sept. 29, 2021, 10:34 a.m.

Size	507.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`1a2cd8fff0b19363a096722678a0fd55`
SHA256	`53d45018a6164dbd7d2cfeeb0c158d67b60c32dc31a10b3810d714b6b179a843`
CRC32	`1189934F`
ssdeep	`12288:iDgUOPOh9FloV+R1R3IvHkaYm0I4uV3Bukz2pKSFV:iDqklm0jYM64uOpJ`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

server4.exe "C:\Users\test22\AppData\Local\Temp\server4.exe"
2420
- server4.exe "C:\Users\test22\AppData\Local\Temp\server4.exe"
  2156
  - images.exe "C:\ProgramData\images.exe"
    2400
    - images.exe "C:\ProgramData\images.exe"
      2984
      - powershell.exe powershell Add-MpPreference -ExclusionPath C:\
        1188
      - cmd.exe "C:\Windows\System32\cmd.exe"
        2496
  - powershell.exe powershell Add-MpPreference -ExclusionPath C:\
    1624
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
donafriend.ddns.net	A 51.195.167.0	51.195.167.0
cdn.discordapp.com	A 162.159.135.233 A 162.159.134.233 A 162.159.129.233 A 162.159.130.233 A 162.159.133.233	162.159.130.233

IP Address	Status	Action
162.159.129.233	Active	Moloch
162.159.133.233	Active	Moloch
164.124.101.2	Active	Moloch
51.195.167.0	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49163 -> 162.159.129.233:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49170 -> 162.159.133.233:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
UDP 192.168.56.102:58838 -> 164.124.101.2:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49163 162.159.129.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da
TLSv1 192.168.56.102:49170 162.159.133.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da

Queries for the computername (14 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 29, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 29, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 29, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 29, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 29, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 29, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 29, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 29, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 29, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 29, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 29, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 29, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 29, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 29, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 29, 2021, 10:32 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:32 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:32 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:32 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:32 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:32 a.m.			0	0

Command line console output was observed (19 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\ console_handle: 0x00000053	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\ console_handle: 0x00000053	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 29, 2021, 10:32 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 92 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fcb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f9f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f9f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f9f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f5f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f5f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f5f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f5f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f5f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f5f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f0f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f0f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f0f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fbf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fbf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fbf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fbf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fbf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fbf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fbf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fbf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fbf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fbf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024fab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f238 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f238 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f238 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f238 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f238 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f238 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f238 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0024f238 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e9ca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ea8e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ea8e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 29, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ea8e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 29, 2021, 10:32 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://cdn.discordapp.com/attachments/886962207051640872/892145008382205992/DADC604A.jpg

Connects to a Dynamic DNS Domain (1 event)

domain

donafriend.ddns.net

Performs some HTTP requests (1 event)

request

GET https://cdn.discordapp.com/attachments/886962207051640872/892145008382205992/DADC604A.jpg

Allocates read-write-execute memory (usually to unpack itself) (50 out of 570 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00820000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00760000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00552000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00585000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00577000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00651000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00652000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00653000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 process_handle: 0xffffffff	1	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Sept. 29, 2021, 10:25 a.m.	total_number_of_free_bytes: 10933055488 free_bytes_available: 10933055488 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell Add-MpPreference -ExclusionPath C:\
cmdline	C:\Windows\System32\cmd.exe

Executes one or more WMI queries (1 event)

wmi

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Sept. 29, 2021, 10:32 a.m.	thread_identifier: 2664 thread_handle: 0x000001e4 process_identifier: 2496 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000001dc	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 29, 2021, 10:32 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0007e000', u'virtual_address': u'0x00002000', u'entropy': 7.9166466924047425, u'name': u'.text', u'virtual_size': u'0x0007de44'}

entropy

7.9166466924

description

A section with a high entropy has been found

entropy

0.995064165844

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Sept. 29, 2021, 10:32 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 29, 2021, 10:32 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 29, 2021, 10:32 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 29, 2021, 10:32 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (34 events)

description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	email clients info stealer	rule	infoStealer_emailClients_Zero
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	email clients info stealer	rule	infoStealer_emailClients_Zero
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Allocates execute permission to another process indicative of possible code injection (4 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2156 region_size: 1396736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2984 region_size: 1396736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001f8	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00410000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001e8	1
NtProtectVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00410000 process_handle: 0x000001e8	1

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images

reg_value

C:\ProgramData\images.exe

Potential code injection by writing to the memory of another process (10 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $z]üÕ><><><ý3Í?<7D?<ý3Ï<<úÿ?<úü=<;0?<7D:<7D!<><Ù<UN<Um?<U?<Rich><PELûI_à0â\@@P@wð00¨ u@p.text«.0 `.rdataÎI@J4@@.dataØP~@À.rsrc0ð2@@.reloc¨0¶@B.bss@Æ@@ base_address: 0x00400000 process_identifier: 2156 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: Í@ï@þ@ @@+@:@\@k@@TÍ<¨K¢`Ý;UBÄôK A³ÝJpMÛ(PAPAUìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃ,mAd base_address: 0x00419000 process_identifier: 2156 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: 2öçpÃ¯u$)AàDÆ]]~ú ººÈÒ®sÇ ÀPµ:wÀF¶N<j0¾ºtßà+ý}]bò"¡¾SZn°ÈN VKcê×í,aÙiYs©ïbZÑç£§?ÙÿUI³â.o:h¬ÜZzuøk¢OY zâ`WËwK=¿ÍOMÞEMÇõ,¦«UpÅ:x base_address: 0x00554000 process_identifier: 2156 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2156 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $z]üÕ><><><ý3Í?<7D?<ý3Ï<<úÿ?<úü=<;0?<7D:<7D!<><Ù<UN<Um?<U?<Rich><PELûI_à0â\@@P@wð00¨ u@p.text«.0 `.rdataÎI@J4@@.dataØP~@À.rsrc0ð2@@.reloc¨0¶@B.bss@Æ@@ base_address: 0x00400000 process_identifier: 2984 process_handle: 0x000001f8	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: Í@ï@þ@ @@+@:@\@k@@TÍ<¨K¢`Ý;UBÄôK A³ÝJpMÛ(PAPAUìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃ,mAd base_address: 0x00419000 process_identifier: 2984 process_handle: 0x000001f8	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: 2öçpÃ¯u$)AàDÆ]]~ú ººÈÒ®sÇ ÀPµ:wÀF¶N<j0¾ºtßà+ý}]bò"¡¾SZn°ÈN VKcê×í,aÙiYs©ïbZÑç£§?ÙÿUI³â.o:h¬ÜZzuøk¢OY zâ`WËwK=¿ÍOMÞEMÇõ,¦«UpÅ:x base_address: 0x00554000 process_identifier: 2984 process_handle: 0x000001f8	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2984 process_handle: 0x000001f8	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: UìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃ,mAdÞöÌ base_address: 0x00410000 process_identifier: 2496 process_handle: 0x000001e8	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: ¨C:\ProgramData\images.exeñ(èyè$ò($ò(P,gu\|,guk¬ò(Ó$igÿÿÿÿÿÌñ(°ò(¨ù(à^iuÂáIòþÿÿÿ\|,gu 5guè base_address: 0x00420000 process_identifier: 2496 process_handle: 0x000001e8	1	1

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $z]üÕ><><><ý3Í?<7D?<ý3Ï<<úÿ?<úü=<;0?<7D:<7D!<><Ù<UN<Um?<U?<Rich><PELûI_à0â\@@P@wð00¨ u@p.text«.0 `.rdataÎI@J4@@.dataØP~@À.rsrc0ð2@@.reloc¨0¶@B.bss@Æ@@ base_address: 0x00400000 process_identifier: 2156 process_handle: 0x00000240	1	1	0
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $z]üÕ><><><ý3Í?<7D?<ý3Ï<<úÿ?<úü=<;0?<7D:<7D!<><Ù<UN<Um?<U?<Rich><PELûI_à0â\@@P@wð00¨ u@p.text«.0 `.rdataÎI@J4@@.dataØP~@À.rsrc0ð2@@.reloc¨0¶@B.bss@Æ@@ base_address: 0x00400000 process_identifier: 2984 process_handle: 0x000001f8	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2420 called NtSetContextThread to modify thread in remote process 2156
Process injection	Process 2400 called NtSetContextThread to modify thread in remote process 2984
NtSetContextThread Sept. 29, 2021, 10:32 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4218082 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000023c process_identifier: 2156	1	0	0
NtSetContextThread Sept. 29, 2021, 10:32 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4218082 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001ec process_identifier: 2984	1	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\ProgramData\images.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2420 resumed a thread in remote process 2156
Process injection	Process 2400 resumed a thread in remote process 2984
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 2156	1	0	0
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x000001ec suspend_count: 1 process_identifier: 2984	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Executed a process and injected code into it, probably while unpacking (50 out of 54 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2420	1	0
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2420	1	0
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2420	1	0
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x00000358 suspend_count: 1 process_identifier: 2420	1	0
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x000005cc suspend_count: 1 process_identifier: 2420	1	0
NtGetContextThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x000000e4	1	0
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2420	1	0
CreateProcessInternalW Sept. 29, 2021, 10:32 a.m.	thread_identifier: 2176 thread_handle: 0x0000023c process_identifier: 2156 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\server4.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\server4.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000240	1	1
NtGetContextThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x0000023c	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2156 region_size: 1396736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240	1	0
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $z]üÕ><><><ý3Í?<7D?<ý3Ï<<úÿ?<úü=<;0?<7D:<7D!<><Ù<UN<Um?<U?<Rich><PELûI_à0â\@@P@wð00¨ u@p.text«.0 `.rdataÎI@J4@@.dataØP~@À.rsrc0ð2@@.reloc¨0¶@B.bss@Æ@@ base_address: 0x00400000 process_identifier: 2156 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: base_address: 0x00401000 process_identifier: 2156 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: base_address: 0x00414000 process_identifier: 2156 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: Í@ï@þ@ @@+@:@\@k@@TÍ<¨K¢`Ý;UBÄôK A³ÝJpMÛ(PAPAUìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃ,mAd base_address: 0x00419000 process_identifier: 2156 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: base_address: 0x0054f000 process_identifier: 2156 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: base_address: 0x00553000 process_identifier: 2156 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: 2öçpÃ¯u$)AàDÆ]]~ú ººÈÒ®sÇ ÀPµ:wÀF¶N<j0¾ºtßà+ý}]bò"¡¾SZn°ÈN VKcê×í,aÙiYs©ïbZÑç£§?ÙÿUI³â.o:h¬ÜZzuøk¢OY zâ`WËwK=¿ÍOMÞEMÇõ,¦«UpÅ:x base_address: 0x00554000 process_identifier: 2156 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2156 process_handle: 0x00000240	1	1
NtSetContextThread Sept. 29, 2021, 10:32 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4218082 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000023c process_identifier: 2156	1	0
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 2156	1	0
CreateProcessInternalW Sept. 29, 2021, 10:32 a.m.	thread_identifier: 1904 thread_handle: 0x000001ec process_identifier: 1624 current_directory: filepath: track: 1 command_line: powershell Add-MpPreference -ExclusionPath C:\ filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001e4	1	1
CreateProcessInternalW Sept. 29, 2021, 10:32 a.m.	thread_identifier: 2292 thread_handle: 0x000001ec process_identifier: 2400 current_directory: filepath: C:\ProgramData\images.exe track: 1 command_line: filepath_r: C:\ProgramData\images.exe stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001f0	1	1
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 1624	1	0
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 1624	1	0
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x00000434 suspend_count: 1 process_identifier: 1624	1	0
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x00000494 suspend_count: 1 process_identifier: 1624	1	0
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2400	1	0
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2400	1	0
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x0000025c suspend_count: 1 process_identifier: 2400	1	0
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x0000034c suspend_count: 1 process_identifier: 2400	1	0
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x000005c0 suspend_count: 1 process_identifier: 2400	1	0
CreateProcessInternalW Sept. 29, 2021, 10:32 a.m.	thread_identifier: 540 thread_handle: 0x000001ec process_identifier: 2984 current_directory: filepath: C:\ProgramData\images.exe track: 1 command_line: filepath_r: C:\ProgramData\images.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000001f8	1	1
NtGetContextThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x000001ec	1	0
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2984 region_size: 1396736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001f8	1	0
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $z]üÕ><><><ý3Í?<7D?<ý3Ï<<úÿ?<úü=<;0?<7D:<7D!<><Ù<UN<Um?<U?<Rich><PELûI_à0â\@@P@wð00¨ u@p.text«.0 `.rdataÎI@J4@@.dataØP~@À.rsrc0ð2@@.reloc¨0¶@B.bss@Æ@@ base_address: 0x00400000 process_identifier: 2984 process_handle: 0x000001f8	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: base_address: 0x00401000 process_identifier: 2984 process_handle: 0x000001f8	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: base_address: 0x00414000 process_identifier: 2984 process_handle: 0x000001f8	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: Í@ï@þ@ @@+@:@\@k@@TÍ<¨K¢`Ý;UBÄôK A³ÝJpMÛ(PAPAUìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃ,mAd base_address: 0x00419000 process_identifier: 2984 process_handle: 0x000001f8	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: base_address: 0x0054f000 process_identifier: 2984 process_handle: 0x000001f8	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: base_address: 0x00553000 process_identifier: 2984 process_handle: 0x000001f8	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: 2öçpÃ¯u$)AàDÆ]]~ú ººÈÒ®sÇ ÀPµ:wÀF¶N<j0¾ºtßà+ý}]bò"¡¾SZn°ÈN VKcê×í,aÙiYs©ïbZÑç£§?ÙÿUI³â.o:h¬ÜZzuøk¢OY zâ`WËwK=¿ÍOMÞEMÇõ,¦«UpÅ:x base_address: 0x00554000 process_identifier: 2984 process_handle: 0x000001f8	1	1
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2984 process_handle: 0x000001f8	1	1
NtSetContextThread Sept. 29, 2021, 10:32 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4218082 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001ec process_identifier: 2984	1	0
NtResumeThread Sept. 29, 2021, 10:32 a.m.	thread_handle: 0x000001ec suspend_count: 1 process_identifier: 2984	1	0
CreateProcessInternalW Sept. 29, 2021, 10:32 a.m.	thread_identifier: 1104 thread_handle: 0x000001e4 process_identifier: 1188 current_directory: filepath: track: 1 command_line: powershell Add-MpPreference -ExclusionPath C:\ filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001dc	1	1
CreateProcessInternalW Sept. 29, 2021, 10:32 a.m.	thread_identifier: 2664 thread_handle: 0x000001e4 process_identifier: 2496 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000001dc	1	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00410000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001e8	1	0
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: UìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃ,mAdÞöÌ base_address: 0x00410000 process_identifier: 2496 process_handle: 0x000001e8	1	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:32 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x00420000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001e8	1	0
WriteProcessMemory Sept. 29, 2021, 10:32 a.m.	buffer: ¨C:\ProgramData\images.exeñ(èyè$ò($ò(P,gu\|,guk¬ò(Ó$igÿÿÿÿÿÌñ(°ò(¨ù(à^iuÂáIòþÿÿÿ\|,gu 5guè base_address: 0x00420000 process_identifier: 2496 process_handle: 0x000001e8	1	1

server4.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All