Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 1, 2021, 10:18 p.m.	Oct. 1, 2021, 10:24 p.m.

Size	5.7MB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`c1e0df4f2321e9375baee3a0a26fba64`
SHA256	`65a112982cc0d4e56c078c5333ed3553905bf4f3a639f2ff6e056ab518b6290e`
CRC32	`8A0F3C6E`
ssdeep	`49152:vTbWVRE2rb/T/vO90dL3BmAFd4A64nsfJ1g8Dl5oVIqmen/tjgO6YdFN9I9Ws/HD:vTiMvDEmAQQQQQQQQQQQQQ`
Yara	Malicious_Packer_Zero - Malicious Packer UPX_Zero - UPX packed file IsPE64 - (no description) PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware anti_vm_detect - Possibly employs anti-virtualization techniques Malicious_Library_Zero - Malicious_Library NPKI_Zero - File included NPKI

hy76tg.exe "C:\Users\test22\AppData\Local\Temp\hy76tg.exe"
2024
- powershell.exe "powershell.exe" -ep bypass & 'C:\Users\test22\AppData\Local\Temp\\ready.ps1'
  2324
  - csc.exe "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\wl8prs8j.cmdline"
    2736
    - cvtres.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RES9B1C.tmp" "c:\Users\test22\AppData\Local\Temp\CSC9ACD.tmp"
      2552
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
    2084

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 1, 2021, 10:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2021, 10:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2021, 10:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2021, 10:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2021, 10:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2021, 10:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 1, 2021, 10:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2021, 10:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2021, 10:20 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2021, 10:20 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2021, 10:20 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2021, 10:20 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 1, 2021, 10:11 p.m.			0	0
IsDebuggerPresent Oct. 1, 2021, 10:11 p.m.			0	0
IsDebuggerPresent Oct. 1, 2021, 10:12 p.m.			0	0
IsDebuggerPresent Oct. 1, 2021, 10:20 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 145 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002b9700 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c81b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c81b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c81b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002de9e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002de9e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002deb30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002deb30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002deb30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002deb30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002ded60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002ded60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002ded60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c7dc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c7dc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c7dc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c8450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c8450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c8450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c8450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c8450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c8450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c8450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c8450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002de900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002de900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002de900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002de900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002de900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df230 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df230 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002de900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002de900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002de900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df4d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df4d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df540 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df540 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7d9a90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7d9a90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002dec10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002dec10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002dec10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002dec10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002b9cb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002b9cb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002b9cb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002b9cb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002b9cb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 10:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002b94d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 1, 2021, 10:11 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.symtab

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 1, 2021, 10:13 p.m.	stacktrace: atol+0x62 qsort-0x202 ntdll+0x664e @ 0x7790664e strtol+0x16a __C_specific_handler-0x212 ntdll+0x182fa @ 0x779182fa KiUserApcDispatcher+0x2b KiUserCallbackDispatcher-0xdb ntdll+0x5112b @ 0x7795112b NtDelayExecution+0xa NtQueryDirectoryFile-0x6 ntdll+0x5165a @ 0x7795165a New_ntdll_NtDelayExecution+0xda New_ntdll_NtDeleteFile-0x64 @ 0x74e8135f SleepEx+0xb3 GetLastError-0x5d kernelbase+0x1203 @ 0x7fefde31203 TranslateSecurityAttributes+0xbd50 LegacyNGenTryEnumerateFusionCache-0x2ce0 mscorwks+0x727490 @ 0x7feeca57490 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7721652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x7792c521 exception.instruction_r: 8b 01 85 c0 0f 8e 35 1a 02 00 3d ff ff ff 7f 0f exception.symbol: atol+0x62 qsort-0x202 ntdll+0x664e exception.instruction: mov eax, dword ptr [rcx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 26190 exception.address: 0x7790664e registers.r14: 0 registers.r15: 0 registers.rcx: 8787503087616 registers.rsi: 0 registers.r10: 2422128 registers.rbx: 0 registers.rsp: 452919120 registers.r11: 452917272 registers.r8: 32 registers.r9: 461354128 registers.rdx: 452917200 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 8787503087615 registers.r13: 0	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 381 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028820000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000289d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028820000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000288b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef196b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028a50000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028a90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ffffef0000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ffffef0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b2a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000288b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000288b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b2c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bdc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91be0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000288b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000288b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b4d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b3b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ca0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ca1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b2b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 10:11 p.m.	process_identifier: 2024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ca2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (3 events)

file	c:\Users\test22\AppData\Local\Temp\wl8prs8j.dll
file	C:\Users\test22\AppData\Local\Temp\get-dnsprovider.PS1
file	C:\Users\test22\AppData\Local\Temp\ready.ps1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
cmdline	"powershell.exe" -ep bypass & 'C:\Users\test22\AppData\Local\Temp\\ready.ps1'

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\wl8prs8j.dll

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Oct. 1, 2021, 10:12 p.m.	thread_identifier: 2320 thread_handle: 0x00000000000001f0 process_identifier: 2324 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell.exe" -ep bypass & 'C:\Users\test22\AppData\Local\Temp\\ready.ps1' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000248	1	1	0
CreateProcessInternalW Oct. 1, 2021, 10:12 p.m.	thread_identifier: 2080 thread_handle: 0x0000000000000424 process_identifier: 2084 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000000000000043c	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 1, 2021, 10:12 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Oct. 1, 2021, 10:20 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\wl8prs8j.cmdline"

Deletes executed files from disk (2 events)

file	C:\Users\test22\AppData\Local\Temp\RES9B1C.tmp
file	c:\Users\test22\AppData\Local\Temp\CSC9ACD.tmp

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
parent_process	powershell.exe				martian_process	"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\wl8prs8j.cmdline"

Creates a suspicious Powershell process (3 events)

option	-noprofile	value	Does not load current user profile
option	-nologo	value	Hides the copyright banner when PowerShell launches
option	-ep bypass	value	Attempts to bypass execution policy

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Detects the presence of Wine emulator (1 event)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress Oct. 1, 2021, 10:11 p.m.	ordinal: 0 function_address: 0x000007feff1a7a50 function_name: wine_get_version module: ntdll module_address: 0x0000000077900000		-1073741511	0

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Lionic	Trojan.Win32.Cobalt.trRF
Elastic	malicious (high confidence)
DrWeb	PowerShell.Inject.56
MicroWorld-eScan	Trojan.GenericKD.37683449
Malwarebytes	Malware.AI.4021206680
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of WinGo/GoCLR.B
APEX	Malicious
ClamAV	Win.Malware.Bulz-9847817-0
Kaspersky	Trojan-Dropper.MSIL.Agent.seskpw
BitDefender	Trojan.GenericKD.37683449
Avast	Win64:Trojan-gen
Ad-Aware	Trojan.GenericKD.37683449
Emsisoft	Trojan.Agent (A)
McAfee-GW-Edition	BehavesLike.Win64.Generic.th
FireEye	Trojan.GenericKD.37683449
Sophos	Mal/Generic-S
Ikarus	Trojan.WinGo.Goclr
GData	Trojan.GenericKD.37683449
Jiangmin	Trojan.Generic.gzxxe
MAX	malware (ai score=87)
ZoneAlarm	Trojan-Dropper.MSIL.Agent.seskpw
Microsoft	Trojan:Script/Phonzy.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Agent.R442164
McAfee	Artemis!C1E0DF4F2321
Cylance	Unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0DIT21
Rising	HackTool.GoCLR!1.D71D (CLASSIC)
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_100%
Fortinet	W64/GoCLR.B!tr
AVG	Win64:Trojan-gen

hy76tg.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All