Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 8, 2021, 5:25 p.m.	Oct. 8, 2021, 5:27 p.m.

Size	450.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`020f8ee721322add5d0305a08bc865e2`
SHA256	`8df8e8c7290b457ad53bb515b1c3b4a039243a87c8a36e44a80ae9c15e5fbbbb`
CRC32	`A1D18F17`
ssdeep	`12288:pU5owFL3L58NiCxOfaa2qViPJBlQawAH:25dF7SsCxgaa2IiBleA`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

REVISED PURCHASE ORDER.exe "C:\Users\test22\AppData\Local\Temp\REVISED PURCHASE ORDER.exe"
1092
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\REVISED PURCHASE ORDER.exe"
  2176
- schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CJLYTTDt" /XML "C:\Users\test22\AppData\Local\Temp\tmpFCD7.tmp"
  2544
- REVISED PURCHASE ORDER.exe "C:\Users\test22\AppData\Local\Temp\REVISED PURCHASE ORDER.exe"
  2264

Name	Response	Post-Analysis Lookup
blackb.duckdns.org	A 185.244.30.252	185.244.30.252

IP Address	Status	Action
185.244.30.252	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.102:52336 -> 8.8.8.8:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
UDP 192.168.56.102:52062 -> 8.8.8.8:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
UDP 192.168.56.102:54322 -> 8.8.8.8:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
UDP 192.168.56.102:64995 -> 8.8.8.8:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
UDP 192.168.56.102:64034 -> 8.8.8.8:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
UDP 192.168.56.102:58838 -> 8.8.8.8:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
UDP 192.168.56.102:64472 -> 8.8.8.8:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
UDP 192.168.56.102:61115 -> 8.8.8.8:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
UDP 192.168.56.102:59731 -> 8.8.8.8:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 8, 2021, 5:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 8, 2021, 5:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 8, 2021, 5:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 8, 2021, 5:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 8, 2021, 5:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 8, 2021, 5:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 8, 2021, 5:26 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 8, 2021, 5:25 p.m.			0	0
IsDebuggerPresent Oct. 8, 2021, 5:25 p.m.			0	0
IsDebuggerPresent Oct. 8, 2021, 5:26 p.m.			0	0
IsDebuggerPresent Oct. 8, 2021, 5:26 p.m.			0	0
IsDebuggerPresent Oct. 8, 2021, 5:26 p.m.			0	0

Command line console output was observed (11 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 8, 2021, 5:26 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Oct. 8, 2021, 5:26 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 8, 2021, 5:26 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 8, 2021, 5:26 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Oct. 8, 2021, 5:26 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\REVI console_handle: 0x00000053	1	1
WriteConsoleW Oct. 8, 2021, 5:26 p.m.	buffer: SED PURCHASE ORDER.exe console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 8, 2021, 5:26 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 8, 2021, 5:26 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Oct. 8, 2021, 5:26 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Oct. 8, 2021, 5:26 p.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 8, 2021, 5:26 p.m.	buffer: The system cannot find the file specified. console_handle: 0x0000000b	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ada90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad7d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad7d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad7d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad3d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad3d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad3d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad3d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad3d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad3d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004aced0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004aced0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004aced0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad590 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ad890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004acf90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004acf90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004acf90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004acf90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004acf90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004acf90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004acf90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 5:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004acf90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 8, 2021, 5:25 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 8, 2021, 5:26 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72cb1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72b82ba1 mscorlib+0x2f136b @ 0x71e3136b mscorlib+0x355fec @ 0x71e95fec mscorlib+0x32d99a @ 0x71e6d99a mscorlib+0x32d54b @ 0x71e6d54b 0x56b2ed 0x56890e 0x5687ff DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b02652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b1264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72b81838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72b81737 mscorlib+0x305edf @ 0x71e45edf mscorlib+0x2e9e1b @ 0x71e29e1b mscorlib+0x2e99c1 @ 0x71e299c1 mscorlib+0x2de184 @ 0x71e1e184 0x56830a 0x567c1d 0x5607f3 0x560614 system+0xaac56b @ 0x7078c56b system+0x1fe5cb @ 0x6fede5cb system+0x1fe55e @ 0x6fede55e system+0x1fe4a3 @ 0x6fede4a3 mscorlib+0x302367 @ 0x71e42367 mscorlib+0x3022a6 @ 0x71e422a6 mscorlib+0x302261 @ 0x71e42261 system+0x1fe431 @ 0x6fede431 system+0x1fe237 @ 0x6fede237 system+0x1ee37d @ 0x6fece37d system+0x1f70ea @ 0x6fed70ea system+0x1e56c0 @ 0x6fec56c0 system+0x1f6e10 @ 0x6fed6e10 system+0x1ee251 @ 0x6fece251 system+0x1ee229 @ 0x6fece229 system+0x1ee170 @ 0x6fece170 0x44a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x7557788a system+0x2093cc @ 0x6fee93cc system+0x1fdca1 @ 0x6feddca1 system+0x1fd921 @ 0x6fedd921 system+0x1fd792 @ 0x6fedd792 system+0x1a14bd @ 0x6fe814bd 0x5601ba DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b02652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b1264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b12e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bc74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bc7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c51dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c51e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c51f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c5416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73eff5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74d37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74d34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 3597148 registers.edi: 0 registers.eax: 3597148 registers.ebp: 3597228 registers.edx: 0 registers.ebx: 9841152 registers.esi: 9248296 registers.ecx: 1265673858	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Oct. 8, 2021, 5:26 p.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72cb1194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72b82ba1
mscorlib+0x2f136b @ 0x71e3136b
mscorlib+0x355fec @ 0x71e95fec
mscorlib+0x32d99a @ 0x71e6d99a
mscorlib+0x32d54b @ 0x71e6d54b
0x56b2ed
0x56890e
0x5687ff
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b02652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b1264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72b81838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72b81737
mscorlib+0x305edf @ 0x71e45edf
mscorlib+0x2e9e1b @ 0x71e29e1b
mscorlib+0x2e99c1 @ 0x71e299c1
mscorlib+0x2de184 @ 0x71e1e184
0x56830a
0x567c1d
0x5607f3
0x560614
system+0xaac56b @ 0x7078c56b
system+0x1fe5cb @ 0x6fede5cb
system+0x1fe55e @ 0x6fede55e
system+0x1fe4a3 @ 0x6fede4a3
mscorlib+0x302367 @ 0x71e42367
mscorlib+0x3022a6 @ 0x71e422a6
mscorlib+0x302261 @ 0x71e42261
system+0x1fe431 @ 0x6fede431
system+0x1fe237 @ 0x6fede237
system+0x1ee37d @ 0x6fece37d
system+0x1f70ea @ 0x6fed70ea
system+0x1e56c0 @ 0x6fec56c0
system+0x1f6e10 @ 0x6fed6e10
system+0x1ee251 @ 0x6fece251
system+0x1ee229 @ 0x6fece229
system+0x1ee170 @ 0x6fece170
0x44a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x7557788a
system+0x2093cc @ 0x6fee93cc
system+0x1fdca1 @ 0x6feddca1
system+0x1fd921 @ 0x6fedd921
system+0x1fd792 @ 0x6fedd792
system+0x1a14bd @ 0x6fe814bd
0x5601ba
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b02652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b1264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b12e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bc74ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bc7610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c51dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c51e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c51f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c5416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73eff5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74d37f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74d34de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x7566b727
registers.esp: 3597148
registers.edi: 0
registers.eax: 3597148
registers.ebp: 3597228
registers.edx: 0
registers.ebx: 9841152
registers.esi: 9248296
registers.ecx: 1265673858

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (1 event)

domain

blackb.duckdns.org

Allocates read-write-execute memory (usually to unpack itself) (50 out of 211 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00420000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b70000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00432000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00467000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00580000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00581000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00456000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:25 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00583000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00584000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 1092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f312000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00585000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 1092 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00586000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06050000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06051000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02970000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f411000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0261a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f412000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02612000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02622000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0264a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02623000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02624000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0265b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02657000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0261b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02642000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02655000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02625000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0264c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (4 events)

cmdline	schtasks.exe /Create /TN "Updates\CJLYTTDt" /XML "C:\Users\test22\AppData\Local\Temp\tmpFCD7.tmp"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\REVISED PURCHASE ORDER.exe"
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\REVISED PURCHASE ORDER.exe"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CJLYTTDt" /XML "C:\Users\test22\AppData\Local\Temp\tmpFCD7.tmp"

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Oct. 8, 2021, 5:26 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\REVISED PURCHASE ORDER.exe" filepath: powershell	1	1	0
ShellExecuteExW Oct. 8, 2021, 5:26 p.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\CJLYTTDt" /XML "C:\Users\test22\AppData\Local\Temp\tmpFCD7.tmp" filepath: schtasks.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00070000', u'virtual_address': u'0x00002000', u'entropy': 7.7144555794459375, u'name': u'.text', u'virtual_size': u'0x0006fec4'}

entropy

7.71445557945

description

A section with a high entropy has been found

entropy

0.995555555556

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Oct. 8, 2021, 5:26 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 8, 2021, 5:26 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 8, 2021, 5:26 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (9 events)

description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	schtasks.exe /Create /TN "Updates\CJLYTTDt" /XML "C:\Users\test22\AppData\Local\Temp\tmpFCD7.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CJLYTTDt" /XML "C:\Users\test22\AppData\Local\Temp\tmpFCD7.tmp"

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer	Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2264 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000424	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Oct. 8, 2021, 5:26 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

REVISED PURCHASE ORDER.exe tried to sleep 3653010875 seconds, actually delayed analysis time by 3653010875 seconds

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Host

reg_value

C:\Program Files (x86)\SMTP Host\smtphost.exe

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\tmpFCD7.tmp

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Oct. 8, 2021, 5:26 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ base_address: 0x00400000 process_identifier: 2264 process_handle: 0x00000424	1	1
WriteProcessMemory Oct. 8, 2021, 5:26 p.m.	buffer: à7 base_address: 0x00420000 process_identifier: 2264 process_handle: 0x00000424	1	1
WriteProcessMemory Oct. 8, 2021, 5:26 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2264 process_handle: 0x00000424	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Oct. 8, 2021, 5:26 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ base_address: 0x00400000 process_identifier: 2264 process_handle: 0x00000424	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1092 called NtSetContextThread to modify thread in remote process 2264
NtSetContextThread Oct. 8, 2021, 5:26 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000042c process_identifier: 2264	1	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Local\Temp\REVISED PURCHASE ORDER.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1092 resumed a thread in remote process 2264
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x0000042c suspend_count: 1 process_identifier: 2264	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Executed a process and injected code into it, probably while unpacking (41 events)

Time & API	Arguments	Status	Return
NtResumeThread Oct. 8, 2021, 5:25 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1092	1	0
NtResumeThread Oct. 8, 2021, 5:25 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1092	1	0
NtResumeThread Oct. 8, 2021, 5:25 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 1092	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x000003c0 suspend_count: 1 process_identifier: 1092	1	0
CreateProcessInternalW Oct. 8, 2021, 5:26 p.m.	thread_identifier: 808 thread_handle: 0x0000042c process_identifier: 2176 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\REVISED PURCHASE ORDER.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000430	1	1
CreateProcessInternalW Oct. 8, 2021, 5:26 p.m.	thread_identifier: 2332 thread_handle: 0x00000414 process_identifier: 2544 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CJLYTTDt" /XML "C:\Users\test22\AppData\Local\Temp\tmpFCD7.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000438	1	1
CreateProcessInternalW Oct. 8, 2021, 5:26 p.m.	thread_identifier: 2408 thread_handle: 0x0000042c process_identifier: 2264 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\REVISED PURCHASE ORDER.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\REVISED PURCHASE ORDER.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000424	1	1
NtGetContextThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x0000042c	1	0
NtAllocateVirtualMemory Oct. 8, 2021, 5:26 p.m.	process_identifier: 2264 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000424	1	0
WriteProcessMemory Oct. 8, 2021, 5:26 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ base_address: 0x00400000 process_identifier: 2264 process_handle: 0x00000424	1	1
WriteProcessMemory Oct. 8, 2021, 5:26 p.m.	buffer: base_address: 0x00402000 process_identifier: 2264 process_handle: 0x00000424	1	1
WriteProcessMemory Oct. 8, 2021, 5:26 p.m.	buffer: à7 base_address: 0x00420000 process_identifier: 2264 process_handle: 0x00000424	1	1
WriteProcessMemory Oct. 8, 2021, 5:26 p.m.	buffer: base_address: 0x00422000 process_identifier: 2264 process_handle: 0x00000424	1	1
WriteProcessMemory Oct. 8, 2021, 5:26 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2264 process_handle: 0x00000424	1	1
NtSetContextThread Oct. 8, 2021, 5:26 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000042c process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x0000042c suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x00000418 suspend_count: 1 process_identifier: 1092	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x00000298 suspend_count: 1 process_identifier: 2176	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x000002ec suspend_count: 1 process_identifier: 2176	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x00000438 suspend_count: 1 process_identifier: 2176	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x00000498 suspend_count: 1 process_identifier: 2176	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x000001c4 suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x000002ec suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x00000304 suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x00000340 suspend_count: 1 process_identifier: 2264	1	0
NtGetContextThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x000000e0	1	0
NtSetContextThread Oct. 8, 2021, 5:26 p.m.	registers.eip: 1924672388 registers.esp: 3597356 registers.edi: 0 registers.eax: 66453492 registers.ebp: 3597400 registers.edx: 13 registers.ebx: 41216279 registers.esi: 46 registers.ecx: 168652654 thread_handle: 0x000000e0 process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x000003b8 suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x000003cc suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x000003e4 suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x000003fc suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x00000428 suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x00000430 suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:26 p.m.	thread_handle: 0x00000450 suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:27 p.m.	thread_handle: 0x0000046c suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread Oct. 8, 2021, 5:27 p.m.	thread_handle: 0x00000470 suspend_count: 1 process_identifier: 2264	1	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (10 events)

dead_host	192.168.56.102:49184
dead_host	192.168.56.102:49185
dead_host	192.168.56.102:49176
dead_host	192.168.56.102:49170
dead_host	192.168.56.102:49177
dead_host	192.168.56.102:49171
dead_host	192.168.56.102:49182
dead_host	192.168.56.102:49169
dead_host	185.244.30.252:2000
dead_host	192.168.56.102:49175

REVISED PURCHASE ORDER.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All