Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 29, 2021, 9:03 a.m.	Oct. 29, 2021, 9:05 a.m.

Size	553.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`f6741a7f14669cbb4dffc16029381a91`
SHA256	`63ff4d686692c112bd815c4b1d6c61c397909ad53f160981af6f3fb0e97bebc2`
CRC32	`D8516A5B`
ssdeep	`12288:c2VsPya6qJFTPKVGAp4ZZWJZ6qh/eUTm/1+OGrD:c2da6qfApeWJZfh/Y+d`
PDB Path	C:\Users\Administrator\Desktop\Client\Temp\PjkxPdBeoE\src\obj\Debug\jLfge5j.pdb
Yara	Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

.lsass.exe "C:\Users\test22\AppData\Local\Temp\.lsass.exe"
1016
- schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oQZXiOIDrQPPf" /XML "C:\Users\test22\AppData\Local\Temp\tmpCF30.tmp"
  1632
- .lsass.exe "{path}"
  1276
  - wscript.exe "C:\Windows\SysWOW64\wscript.exe"
    2948
    - cmd.exe /c del "C:\Users\test22\AppData\Local\Temp\.lsass.exe"
      2212

Name	Response	Post-Analysis Lookup
www.bookanyclick.com	A 94.136.40.51	94.136.40.51
www.kagawa-rentacar.com	A 133.130.64.128	133.130.64.128
www.torgetmc.xyz

IP Address	Status	Action
133.130.64.128	Active	Moloch
164.124.101.2	Active	Moloch
94.136.40.51	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49209 -> 133.130.64.128:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 133.130.64.128:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 133.130.64.128:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 94.136.40.51:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 94.136.40.51:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 94.136.40.51:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Oct. 29, 2021, 9:03 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Oct. 29, 2021, 9:04 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 29, 2021, 9:03 a.m.			0	0
IsDebuggerPresent Oct. 29, 2021, 9:03 a.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Oct. 29, 2021, 9:04 a.m.	buffer: SUCCESS: The scheduled task "Updates\oQZXiOIDrQPPf" has successfully been created. console_handle: 0x00000007	1	1	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 29, 2021, 9:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0067aab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 29, 2021, 9:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0067a970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 29, 2021, 9:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0067a970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

C:\Users\Administrator\Desktop\Client\Temp\PjkxPdBeoE\src\obj\Debug\jLfge5j.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 29, 2021, 9:03 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 29, 2021, 9:03 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x728f1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x727c2ba1 0x5aec47 0x5ae565 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x72769df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x72769e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x72769efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x72769fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x727c564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x7279be63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x7279b998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x7279b726 CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x7279bf68 CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x7279bce4 DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x7275cca4 DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x7275cd37 DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x72848841 LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x727c14e9 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d36ad @ 0x6ff136ad mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 microsoft+0x1069af @ 0x6f1e69af microsoft+0x103438 @ 0x6f1e3438 microsoft+0x14b2e5 @ 0x6f22b2e5 0x5ae529 0x5a4939 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d36ad @ 0x6ff136ad mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d36ad @ 0x6ff136ad mscorlib+0x308f2d @ 0x6ff48f2d microsoft+0x50c17 @ 0x6f130c17 microsoft+0x3f05f @ 0x6f11f05f microsoft+0x3e4d4 @ 0x6f11e4d4 microsoft+0x3cda4 @ 0x6f11cda4 0x5a476b 0x5a4629 0x5a454b 0x5a348f 0x5a0ede 0x5a0995 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 CoUninitializeEE+0x789b CreateAssemblyNameObject-0x63ba clr+0x270df @ 0x727670df LogHelp_TerminateOnAssert+0x55ee GetPrivateContextsPerfCounters-0x13e54 clr+0x7412e @ 0x727b412e mscorlib+0x2f1c22 @ 0x6ff31c22 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 3393816 registers.edi: 0 registers.eax: 3393816 registers.ebp: 3393896 registers.edx: 0 registers.ebx: 7279320 registers.esi: 6718904 registers.ecx: 770480787	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Oct. 29, 2021, 9:03 a.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x728f1194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x727c2ba1
0x5aec47
0x5ae565
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x72769df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x72769e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x72769efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x72769fa2
LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x727c564b
CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x7279be63
CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x7279b998
CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x7279b726
CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x7279bf68
CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x7279bce4
DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x7275cca4
DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x7275cd37
DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x72848841
LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x727c14e9
mscorlib+0x2d3711 @ 0x6ff13711
mscorlib+0x308f2d @ 0x6ff48f2d
mscorlib+0x2cb060 @ 0x6ff0b060
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737
mscorlib+0x2d36ad @ 0x6ff136ad
mscorlib+0x308f2d @ 0x6ff48f2d
mscorlib+0x2cb060 @ 0x6ff0b060
microsoft+0x1069af @ 0x6f1e69af
microsoft+0x103438 @ 0x6f1e3438
microsoft+0x14b2e5 @ 0x6f22b2e5
0x5ae529
0x5a4939
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737
mscorlib+0x2d36ad @ 0x6ff136ad
mscorlib+0x308f2d @ 0x6ff48f2d
mscorlib+0x2cb060 @ 0x6ff0b060
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737
mscorlib+0x2d36ad @ 0x6ff136ad
mscorlib+0x308f2d @ 0x6ff48f2d
microsoft+0x50c17 @ 0x6f130c17
microsoft+0x3f05f @ 0x6f11f05f
microsoft+0x3e4d4 @ 0x6f11e4d4
microsoft+0x3cda4 @ 0x6f11cda4
0x5a476b
0x5a4629
0x5a454b
0x5a348f
0x5a0ede
0x5a0995
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
CoUninitializeEE+0x789b CreateAssemblyNameObject-0x63ba clr+0x270df @ 0x727670df
LogHelp_TerminateOnAssert+0x55ee GetPrivateContextsPerfCounters-0x13e54 clr+0x7412e @ 0x727b412e
mscorlib+0x2f1c22 @ 0x6ff31c22

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3393816
registers.edi: 0
registers.eax: 3393816
registers.ebp: 3393896
registers.edx: 0
registers.ebx: 7279320
registers.esi: 6718904
registers.ecx: 770480787

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET http://www.bookanyclick.com/hs3h/?JjUdE2=N2wrYjy29kSOT4NGIPQyaCDlzJzAe5M9Os8Vy9dsMfLAOBFmOT1VxF5pVFIYJ9imXQ6clAqp&lzul=z8oHnHbh3L
suspicious_features	GET method with no useragent header				suspicious_request	GET http://www.kagawa-rentacar.com/hs3h/?JjUdE2=MUcuOaoaWzdiqsc041tkxtCPxCWBE2NvTm+WO+dxYC+JZdi3iYXCypXvjqYhOL988ujoI2pK&lzul=z8oHnHbh3L

Performs some HTTP requests (2 events)

request	GET http://www.bookanyclick.com/hs3h/?JjUdE2=N2wrYjy29kSOT4NGIPQyaCDlzJzAe5M9Os8Vy9dsMfLAOBFmOT1VxF5pVFIYJ9imXQ6clAqp&lzul=z8oHnHbh3L
request	GET http://www.kagawa-rentacar.com/hs3h/?JjUdE2=MUcuOaoaWzdiqsc041tkxtCPxCWBE2NvTm+WO+dxYC+JZdi3iYXCypXvjqYhOL988ujoI2pK&lzul=z8oHnHbh3L

Allocates read-write-execute memory (usually to unpack itself) (50 out of 99 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00350000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00500000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00540000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dee2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a5f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ae000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005af000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02380000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02381000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02382000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02383000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02384000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02385000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05290178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x052901a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x052901c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0530ef4e process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0530ef42 process_handle: 0xffffffff		3221225550

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\oQZXiOIDrQPPf.exe

Creates a suspicious process (2 events)

cmdline	schtasks.exe /Create /TN "Updates\oQZXiOIDrQPPf" /XML "C:\Users\test22\AppData\Local\Temp\tmpCF30.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oQZXiOIDrQPPf" /XML "C:\Users\test22\AppData\Local\Temp\tmpCF30.tmp"

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\.lsass.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\.lsass.exe

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Oct. 29, 2021, 9:03 a.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\oQZXiOIDrQPPf" /XML "C:\Users\test22\AppData\Local\Temp\tmpCF30.tmp" filepath: schtasks.exe	1	1	0
CreateProcessInternalW Oct. 29, 2021, 9:04 a.m.	thread_identifier: 2088 thread_handle: 0x00000090 process_identifier: 2212 current_directory: filepath: C:\Windows\SysWOW64\cmd.exe track: 1 command_line: /c del "C:\Users\test22\AppData\Local\Temp\.lsass.exe" filepath_r: C:\Windows\SysWOW64\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000000ec	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00089c00', u'virtual_address': u'0x00002000', u'entropy': 7.654626508293225, u'name': u'.text', u'virtual_size': u'0x00089a68'}

entropy

7.65462650829

description

A section with a high entropy has been found

entropy

0.996383363472

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Oct. 29, 2021, 9:03 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 29, 2021, 9:04 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 29, 2021, 9:04 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (7 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	/c del "C:\Users\test22\AppData\Local\Temp\.lsass.exe"
cmdline	schtasks.exe /Create /TN "Updates\oQZXiOIDrQPPf" /XML "C:\Users\test22\AppData\Local\Temp\tmpCF30.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oQZXiOIDrQPPf" /XML "C:\Users\test22\AppData\Local\Temp\tmpCF30.tmp"

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1276 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000464	1	0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects virtualization software with SCSI Disk Identifier trick(s) (1 event)

registry

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\tmpCF30.tmp

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Oct. 29, 2021, 9:03 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ôÍ¹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PEL,eÄJà Ô ñð@ð@.textÒÔ ` base_address: 0x00400000 process_identifier: 1276 process_handle: 0x00000464	1	1	0
WriteProcessMemory Oct. 29, 2021, 9:03 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1276 process_handle: 0x00000464	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Oct. 29, 2021, 9:03 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ôÍ¹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PEL,eÄJà Ô ñð@ð@.textÒÔ ` base_address: 0x00400000 process_identifier: 1276 process_handle: 0x00000464	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1016 called NtSetContextThread to modify thread in remote process 1276
NtSetContextThread Oct. 29, 2021, 9:03 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4321696 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000468 process_identifier: 1276	1	0	0

One or more non-whitelisted processes were created (1 event)

parent_process

wscript.exe

martian_process

/c del "C:\Users\test22\AppData\Local\Temp\.lsass.exe"

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1016 resumed a thread in remote process 1276
NtResumeThread Oct. 29, 2021, 9:03 a.m.	thread_handle: 0x00000468 suspend_count: 1 process_identifier: 1276	1	0	0

Created a process named as a common system process (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Oct. 29, 2021, 9:03 a.m.	thread_identifier: 2832 thread_handle: 0x00000468 process_identifier: 1276 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\.lsass.exe track: 1 command_line: "{path}" filepath_r: C:\Users\test22\AppData\Local\Temp\.lsass.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000464	1	1	0

Detects VirtualBox through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions

Detects VMWare through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools

Detects the presence of Wine emulator (1 event)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress Oct. 29, 2021, 9:03 a.m.	ordinal: 0 function_address: 0x0033cfa4 function_name: wine_get_unix_file_name module: KERNEL32 module_address: 0x75720000		3221225785	0

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILZilla.2915
FireEye	Generic.mg.f6741a7f14669cbb
McAfee	PWS-FCZF!F6741A7F1466
Malwarebytes	Trojan.MalPack.ADC
Sangfor	Trojan.Win32.Save.a
Cyren	W32/MSIL_Kryptik.FYT.gen!Eldorado
Symantec	Trojan.Formbook
ESET-NOD32	a variant of MSIL/Kryptik.ADHT
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	IL:Trojan.MSILZilla.2915
Avast	Win32:MalwareX-gen [Trj]
Ad-Aware	IL:Trojan.MSILZilla.2915
Emsisoft	Trojan.Crypt (A)
McAfee-GW-Edition	PWS-FCZF!F6741A7F1466
SentinelOne	Static AI - Malicious PE
MAX	malware (ai score=83)
GData	IL:Trojan.MSILZilla.2915
Cynet	Malicious (score: 100)
Ikarus	Trojan.MSIL.Inject
Fortinet	MSIL/Kryptik.DZG!tr
AVG	Win32:MalwareX-gen [Trj]

Executed a process and injected code into it, probably while unpacking (24 events)

Time & API	Arguments	Status	Return
NtResumeThread Oct. 29, 2021, 9:03 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1016	1	0
NtResumeThread Oct. 29, 2021, 9:03 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1016	1	0
NtResumeThread Oct. 29, 2021, 9:03 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 1016	1	0
NtResumeThread Oct. 29, 2021, 9:03 a.m.	thread_handle: 0x00000250 suspend_count: 1 process_identifier: 1016	1	0
NtResumeThread Oct. 29, 2021, 9:03 a.m.	thread_handle: 0x00000278 suspend_count: 1 process_identifier: 1016	1	0
NtGetContextThread Oct. 29, 2021, 9:03 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Oct. 29, 2021, 9:03 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Oct. 29, 2021, 9:03 a.m.	thread_handle: 0x000000e0	1	0
NtSetContextThread Oct. 29, 2021, 9:03 a.m.	registers.eip: 1920740228 registers.esp: 3394024 registers.edi: 3394200 registers.eax: 2 registers.ebp: 3394244 registers.edx: 44130352 registers.ebx: 0 registers.esi: 0 registers.ecx: -395726780 thread_handle: 0x000000e0 process_identifier: 1016	1	0
NtResumeThread Oct. 29, 2021, 9:03 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 1016	1	0
NtResumeThread Oct. 29, 2021, 9:03 a.m.	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 1016	1	0
NtResumeThread Oct. 29, 2021, 9:03 a.m.	thread_handle: 0x0000032c suspend_count: 1 process_identifier: 1016	1	0
CreateProcessInternalW Oct. 29, 2021, 9:03 a.m.	thread_identifier: 2932 thread_handle: 0x000004a0 process_identifier: 1632 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oQZXiOIDrQPPf" /XML "C:\Users\test22\AppData\Local\Temp\tmpCF30.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004a8	1	1
CreateProcessInternalW Oct. 29, 2021, 9:03 a.m.	thread_identifier: 2832 thread_handle: 0x00000468 process_identifier: 1276 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\.lsass.exe track: 1 command_line: "{path}" filepath_r: C:\Users\test22\AppData\Local\Temp\.lsass.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000464	1	1
NtGetContextThread Oct. 29, 2021, 9:03 a.m.	thread_handle: 0x00000468	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 9:03 a.m.	process_identifier: 1276 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000464	1	0
WriteProcessMemory Oct. 29, 2021, 9:03 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ôÍ¹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PEL,eÄJà Ô ñð@ð@.textÒÔ ` base_address: 0x00400000 process_identifier: 1276 process_handle: 0x00000464	1	1
WriteProcessMemory Oct. 29, 2021, 9:03 a.m.	buffer: base_address: 0x00401000 process_identifier: 1276 process_handle: 0x00000464	1	1
WriteProcessMemory Oct. 29, 2021, 9:03 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1276 process_handle: 0x00000464	1	1
NtSetContextThread Oct. 29, 2021, 9:03 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4321696 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000468 process_identifier: 1276	1	0
NtResumeThread Oct. 29, 2021, 9:03 a.m.	thread_handle: 0x00000468 suspend_count: 1 process_identifier: 1276	1	0
NtResumeThread Oct. 29, 2021, 9:03 a.m.	thread_handle: 0x00000494 suspend_count: 1 process_identifier: 1016	1	0
CreateProcessInternalW Oct. 29, 2021, 9:04 a.m.	thread_identifier: 2288 thread_handle: 0x000000a0 process_identifier: 2948 current_directory: filepath: C:\Windows\SysWOW64\wscript.exe track: 1 command_line: filepath_r: C:\Windows\SysWOW64\wscript.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x000000bc	1	1
CreateProcessInternalW Oct. 29, 2021, 9:04 a.m.	thread_identifier: 2088 thread_handle: 0x00000090 process_identifier: 2212 current_directory: filepath: C:\Windows\SysWOW64\cmd.exe track: 1 command_line: /c del "C:\Users\test22\AppData\Local\Temp\.lsass.exe" filepath_r: C:\Windows\SysWOW64\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000000ec	1	1

.lsass.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All