Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Jan. 12, 2022, 5:05 p.m.	Jan. 12, 2022, 5:07 p.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`f0fff58ae1dbbeed6b8112b4fc39253b`
SHA256	`04bb50786dcd75cc530486e6e306d6d9f982d2f0519a7c62c7c544b6fb9967c0`
CRC32	`4795CC79`
ssdeep	`12288:JnbZ6JWkXGxhR5X6WyH9irAlouAAIwr8Jawn2yFDAAWJTtJcLQwl7XU2ou+38Eh0:1d6I665IH9i8tIY61bWJMkMrUMgLL`
PDB Path	FlowContr.pdb
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

purchase order_2022.exe "C:\Users\test22\AppData\Local\Temp\purchase order_2022.exe"
1792
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\dinmgsIn.exe"
  2688
- schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dinmgsIn" /XML "C:\Users\test22\AppData\Local\Temp\tmp7D1A.tmp"
  2528
- purchase order_2022.exe "C:\Users\test22\AppData\Local\Temp\purchase order_2022.exe"
  2876

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
91.193.75.224	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.102:49167 91.193.75.224:2142	None	None	None

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW Jan. 12, 2022, 5:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 12, 2022, 5:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 12, 2022, 5:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 12, 2022, 5:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Jan. 12, 2022, 5:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 12, 2022, 5:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 12, 2022, 5:06 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 12, 2022, 5:05 p.m.			0	0
IsDebuggerPresent Jan. 12, 2022, 5:05 p.m.			0	0
IsDebuggerPresent Jan. 12, 2022, 5:06 p.m.			0	0

Command line console output was observed (10 events)

Time & API	Arguments	Status	Return
WriteConsoleW Jan. 12, 2022, 5:06 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Jan. 12, 2022, 5:06 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Jan. 12, 2022, 5:06 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Jan. 12, 2022, 5:06 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Jan. 12, 2022, 5:06 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\dinmgsI console_handle: 0x00000053	1	1
WriteConsoleW Jan. 12, 2022, 5:06 p.m.	buffer: n.exe console_handle: 0x0000005f	1	1
WriteConsoleW Jan. 12, 2022, 5:06 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Jan. 12, 2022, 5:06 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Jan. 12, 2022, 5:06 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Jan. 12, 2022, 5:06 p.m.	buffer: SUCCESS: The scheduled task "Updates\dinmgsIn" has successfully been created. console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038aac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00389f00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00389f00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00389f00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038aa00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038aa00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038aa00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a5c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038aa00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038aa00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038aa00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038aa00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038aa00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038aa00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038aa00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 12, 2022, 5:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038a040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

FlowContr.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 12, 2022, 5:05 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sdata

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 169 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aa0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74152000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00460000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00460000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00425000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00427000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00417000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00416000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70d72000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b74000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:05 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b78000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b79000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b7a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b7b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05570000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 1792 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05571000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05577000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05578000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05579000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0557a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02930000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fe1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fe2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0267a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02672000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

purchase order_2022.exe tried to sleep 277 seconds, actually delayed analysis time by 277 seconds

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (4 events)

cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\dinmgsIn.exe"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dinmgsIn" /XML "C:\Users\test22\AppData\Local\Temp\tmp7D1A.tmp"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\dinmgsIn.exe"
cmdline	schtasks.exe /Create /TN "Updates\dinmgsIn" /XML "C:\Users\test22\AppData\Local\Temp\tmp7D1A.tmp"

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Jan. 12, 2022, 5:06 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\dinmgsIn.exe" filepath: powershell	1	1	0
ShellExecuteExW Jan. 12, 2022, 5:06 p.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\dinmgsIn" /XML "C:\Users\test22\AppData\Local\Temp\tmp7D1A.tmp" filepath: schtasks.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0010f800', u'virtual_address': u'0x00002000', u'entropy': 7.873511221605963, u'name': u'.text', u'virtual_size': u'0x0010f764'}

entropy

7.87351122161

description

A section with a high entropy has been found

entropy

0.94025974026

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Jan. 12, 2022, 5:06 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Jan. 12, 2022, 5:06 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (20 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	browser info stealer	rule	infoStealer_browser_Zero
description	Communications use DNS	rule	Network_DNS
description	Google Chrome User Data Check	rule	Chrome_User_Data_Check_Zero
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Record Audio	rule	Sniff_Audio
description	Run a KeyLogger	rule	KeyLogger
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dinmgsIn" /XML "C:\Users\test22\AppData\Local\Temp\tmp7D1A.tmp"
cmdline	schtasks.exe /Create /TN "Updates\dinmgsIn" /XML "C:\Users\test22\AppData\Local\Temp\tmp7D1A.tmp"

Communicates with host for which no DNS query was performed (1 event)

host

91.193.75.224

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2876 region_size: 503808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003bc	1	0	0

Potential code injection by writing to the memory of another process (5 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Jan. 12, 2022, 5:06 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ý}4VgVgVgââgDgâàgôgâágHg_ägWgÈ<ÔgTgmÂfLgmÂflgmÂftg_ägCgVggÁÂf gÄÂìgWgÁÂfWgRichVgPELsaà,r@@°Ü Kp49 }8´}X}@@.text+, `.rdataÔp@r0@@.dataì>À¢@À.tls °@À.gfids0²@@.rsrcK L¶@@.reloc49p:@B base_address: 0x00400000 process_identifier: 2876 process_handle: 0x000003bc	1	1
WriteProcessMemory Jan. 12, 2022, 5:06 p.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ ,E0E*E..pÁFLÖFLÖFLÖFLÖFLÖFLÖFLÖFLÖFLÖFtÁFPÖFPÖFPÖFPÖFPÖFPÖFPÖFxÁFÿÿÿÿ0EÂFÂFÂFÂFÂFxÁF°E0EEØÁFpÇFCPSTPDT ÂFàÂFÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZpÇFþÿÿÿþÿÿÿu0Ï!tåa¾e¸Â¢z»^ âÈ¨3 hFâA¬hFbA¸hF¤ATFE.?AVtype_info@@TFE.?AVbad_alloc@std@@TFE.?AVbad_array_new_length@std@@TFE.?AVlogic_error@std@@TFE.?AVlength_error@std@@TFE.?AVout_of_range@std@@TFE.?AV_Facet_base@std@@TFE.?AV_Locimp@locale@std@@TFE.?AVfacet@locale@std@@TFE.?AU_Crt_new_delete@std@@TFE.?AVcodecvt_base@std@@TFE.?AUctype_base@std@@TFE.?AV?$ctype@D@std@@TFE.?AV?$codecvt@DDU_Mbstatet@@@std@@TFE.?AVbad_exception@std@@TFE.HTFE.?AVfailure@ios_base@std@@TFE.?AVruntime_error@std@@TFE.?AVsystem_error@std@@TFE.?AVbad_cast@std@@TFE.?AV_System_error@std@@TFE.?AVexception@std@@ base_address: 0x0046c000 process_identifier: 2876 process_handle: 0x000003bc	1	1
WriteProcessMemory Jan. 12, 2022, 5:06 p.m.	buffer: base_address: 0x00470000 process_identifier: 2876 process_handle: 0x000003bc	1	1
WriteProcessMemory Jan. 12, 2022, 5:06 p.m.	buffer: »æ æv?ë/ëv?}ëv?)v?Ú NÊM0q0të.Ô\|v?v?£:ö97ëë®¤õÐÖÝÖÝS.1o¡{vñ\¬F¯µã·w³Ù:äÎyì, b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` ¢§µ¶³´±²¯°¸ Y base_address: 0x00471000 process_identifier: 2876 process_handle: 0x000003bc	1	1
WriteProcessMemory Jan. 12, 2022, 5:06 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2876 process_handle: 0x000003bc	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Jan. 12, 2022, 5:06 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ý}4VgVgVgââgDgâàgôgâágHg_ägWgÈ<ÔgTgmÂfLgmÂflgmÂftg_ägCgVggÁÂf gÄÂìgWgÁÂfWgRichVgPELsaà,r@@°Ü Kp49 }8´}X}@@.text+, `.rdataÔp@r0@@.dataì>À¢@À.tls °@À.gfids0²@@.rsrcK L¶@@.reloc49p:@B base_address: 0x00400000 process_identifier: 2876 process_handle: 0x000003bc	1	1	0

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExA Jan. 12, 2022, 5:06 p.m.	thread_identifier: 0 callback_function: 0x004088b1 hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00400000	1	14811543	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1792 called NtSetContextThread to modify thread in remote process 2876
NtSetContextThread Jan. 12, 2022, 5:06 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4392050 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003ac process_identifier: 2876	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1792 resumed a thread in remote process 2876
NtResumeThread Jan. 12, 2022, 5:06 p.m.	thread_handle: 0x000003ac suspend_count: 1 process_identifier: 2876	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Lionic	Trojan.MSIL.Taskun.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
McAfee	Artemis!F0FFF58AE1DB
Cylance	Unsafe
Cyren	W32/MSIL_Kryptik.GJI.gen!Eldorado
ESET-NOD32	a variant of MSIL/GenKryptik.FPRZ
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	UDS:Trojan.MSIL.Taskun.gen
FireEye	Generic.mg.f0fff58ae1dbbeed
Ikarus	Win32.Outbreak
GData	Win32.Backdoor.Remcos.P8M00L
Microsoft	Trojan:MSIL/RemLoader!MTB
Malwarebytes	MachineLearning/Anomalous.96%
TrendMicro-HouseCall	TROJ_GEN.F0D1C00AC22
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenKryptik.FOWD!tr
BitDefenderTheta	Gen:NN.ZemsilF.34114.ir0@aSfPFwj
AVG	Win32:PWSX-gen [Trj]
Paloalto	generic.ml

Executed a process and injected code into it, probably while unpacking (26 events)

Time & API	Arguments	Status	Return
NtResumeThread Jan. 12, 2022, 5:05 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1792	1	0
NtResumeThread Jan. 12, 2022, 5:05 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 1792	1	0
NtResumeThread Jan. 12, 2022, 5:05 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 1792	1	0
NtResumeThread Jan. 12, 2022, 5:06 p.m.	thread_handle: 0x00000298 suspend_count: 1 process_identifier: 1792	1	0
NtResumeThread Jan. 12, 2022, 5:06 p.m.	thread_handle: 0x000002b8 suspend_count: 1 process_identifier: 1792	1	0
CreateProcessInternalW Jan. 12, 2022, 5:06 p.m.	thread_identifier: 2684 thread_handle: 0x00000444 process_identifier: 2688 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\dinmgsIn.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000044c	1	1
CreateProcessInternalW Jan. 12, 2022, 5:06 p.m.	thread_identifier: 2820 thread_handle: 0x000003c0 process_identifier: 2528 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dinmgsIn" /XML "C:\Users\test22\AppData\Local\Temp\tmp7D1A.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000044c	1	1
CreateProcessInternalW Jan. 12, 2022, 5:06 p.m.	thread_identifier: 2944 thread_handle: 0x000003ac process_identifier: 2876 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\purchase order_2022.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\purchase order_2022.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003bc	1	1
NtGetContextThread Jan. 12, 2022, 5:06 p.m.	thread_handle: 0x000003ac	1	0
NtAllocateVirtualMemory Jan. 12, 2022, 5:06 p.m.	process_identifier: 2876 region_size: 503808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003bc	1	0
WriteProcessMemory Jan. 12, 2022, 5:06 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ý}4VgVgVgââgDgâàgôgâágHg_ägWgÈ<ÔgTgmÂfLgmÂflgmÂftg_ägCgVggÁÂf gÄÂìgWgÁÂfWgRichVgPELsaà,r@@°Ü Kp49 }8´}X}@@.text+, `.rdataÔp@r0@@.dataì>À¢@À.tls °@À.gfids0²@@.rsrcK L¶@@.reloc49p:@B base_address: 0x00400000 process_identifier: 2876 process_handle: 0x000003bc	1	1
WriteProcessMemory Jan. 12, 2022, 5:06 p.m.	buffer: base_address: 0x00401000 process_identifier: 2876 process_handle: 0x000003bc	1	1
WriteProcessMemory Jan. 12, 2022, 5:06 p.m.	buffer: base_address: 0x00454000 process_identifier: 2876 process_handle: 0x000003bc	1	1
WriteProcessMemory Jan. 12, 2022, 5:06 p.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ ,E0E*E..pÁFLÖFLÖFLÖFLÖFLÖFLÖFLÖFLÖFLÖFtÁFPÖFPÖFPÖFPÖFPÖFPÖFPÖFxÁFÿÿÿÿ0EÂFÂFÂFÂFÂFxÁF°E0EEØÁFpÇFCPSTPDT ÂFàÂFÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZpÇFþÿÿÿþÿÿÿu0Ï!tåa¾e¸Â¢z»^ âÈ¨3 hFâA¬hFbA¸hF¤ATFE.?AVtype_info@@TFE.?AVbad_alloc@std@@TFE.?AVbad_array_new_length@std@@TFE.?AVlogic_error@std@@TFE.?AVlength_error@std@@TFE.?AVout_of_range@std@@TFE.?AV_Facet_base@std@@TFE.?AV_Locimp@locale@std@@TFE.?AVfacet@locale@std@@TFE.?AU_Crt_new_delete@std@@TFE.?AVcodecvt_base@std@@TFE.?AUctype_base@std@@TFE.?AV?$ctype@D@std@@TFE.?AV?$codecvt@DDU_Mbstatet@@@std@@TFE.?AVbad_exception@std@@TFE.HTFE.?AVfailure@ios_base@std@@TFE.?AVruntime_error@std@@TFE.?AVsystem_error@std@@TFE.?AVbad_cast@std@@TFE.?AV_System_error@std@@TFE.?AVexception@std@@ base_address: 0x0046c000 process_identifier: 2876 process_handle: 0x000003bc	1	1
WriteProcessMemory Jan. 12, 2022, 5:06 p.m.	buffer: base_address: 0x00470000 process_identifier: 2876 process_handle: 0x000003bc	1	1
WriteProcessMemory Jan. 12, 2022, 5:06 p.m.	buffer: »æ æv?ë/ëv?}ëv?)v?Ú NÊM0q0të.Ô\|v?v?£:ö97ëë®¤õÐÖÝÖÝS.1o¡{vñ\¬F¯µã·w³Ù:äÎyì, b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` ¢§µ¶³´±²¯°¸ Y base_address: 0x00471000 process_identifier: 2876 process_handle: 0x000003bc	1	1
WriteProcessMemory Jan. 12, 2022, 5:06 p.m.	buffer: base_address: 0x00472000 process_identifier: 2876 process_handle: 0x000003bc	1	1
WriteProcessMemory Jan. 12, 2022, 5:06 p.m.	buffer: base_address: 0x00477000 process_identifier: 2876 process_handle: 0x000003bc	1	1
WriteProcessMemory Jan. 12, 2022, 5:06 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2876 process_handle: 0x000003bc	1	1
NtSetContextThread Jan. 12, 2022, 5:06 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4392050 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003ac process_identifier: 2876	1	0
NtResumeThread Jan. 12, 2022, 5:06 p.m.	thread_handle: 0x000003ac suspend_count: 1 process_identifier: 2876	1	0
NtResumeThread Jan. 12, 2022, 5:06 p.m.	thread_handle: 0x00000304 suspend_count: 1 process_identifier: 1792	1	0
NtResumeThread Jan. 12, 2022, 5:06 p.m.	thread_handle: 0x00000290 suspend_count: 1 process_identifier: 2688	1	0
NtResumeThread Jan. 12, 2022, 5:06 p.m.	thread_handle: 0x000002e4 suspend_count: 1 process_identifier: 2688	1	0
NtResumeThread Jan. 12, 2022, 5:06 p.m.	thread_handle: 0x00000430 suspend_count: 1 process_identifier: 2688	1	0
NtResumeThread Jan. 12, 2022, 5:06 p.m.	thread_handle: 0x00000490 suspend_count: 1 process_identifier: 2688	1	0

purchase order_2022.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All