Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 21, 2022, 5:14 p.m.	July 21, 2022, 5:19 p.m.

Size	597.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`adf266d3870069d9c6ec30091d347f68`
SHA256	`dd44612801b32da18885221e9211c565eecceeef71217b5b9858b839d6f8dc0d`
CRC32	`91D717B1`
ssdeep	`6144:xSyBmqk0G78MNNhrXN8d9sx40RZGI8i6e6jherVXLw1Ig:xSycICXhrMWx/4Iae6VkXUWg`
Yara	IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature

Ivnut-Z2K-2.exe "C:\Users\test22\AppData\Local\Temp\Ivnut-Z2K-2.exe"
2348
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAHYAbgB1AHQALQBaADIASwAtADIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUA
  2544

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (9 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 21, 2022, 5:14 p.m.			0	0
IsDebuggerPresent July 21, 2022, 5:14 p.m.			0	0
IsDebuggerPresent July 21, 2022, 5:14 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (45 events)

Time & API	Arguments	Status	Return
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0055f028 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0055f028 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0055eea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a1c78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a24b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a24b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a24b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a24b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a24b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a24b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a1fb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a27f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a27f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a27f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a27f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a27f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a27f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a27f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a27f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a27f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a27f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a27f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a27f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a27f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a27f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a2738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 21, 2022, 5:14 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 190 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73972000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00610000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00660000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00452000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00485000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00487000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00477000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00476000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00711000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00712000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00713000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00714000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00715000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00716000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00717000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00718000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00719000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0071a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0071b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0071c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0071d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0071e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0071f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b03000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b04000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b05000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b07000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b08000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b09000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b0b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	Powershell -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAHYAbgB1AHQALQBaADIASwAtADIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUA
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAHYAbgB1AHQALQBaADIASwAtADIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUA

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\Ivnut-Z2K-2.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 21, 2022, 5:14 p.m.	show_type: 0 filepath_r: Powershell parameters: -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAHYAbgB1AHQALQBaADIASwAtADIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUA filepath: Powershell	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0003c800', u'virtual_address': u'0x00002000', u'entropy': 7.990490555504445, u'name': u'.text', u'virtual_size': u'0x0003c67c'}

entropy

7.9904905555

description

A section with a high entropy has been found

entropy

0.405360134003

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 21, 2022, 5:14 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 21, 2022, 5:14 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 events)

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen18.25834
MicroWorld-eScan	IL:Trojan.MSILZilla.22102
FireEye	Generic.mg.adf266d3870069d9
ALYac	IL:Trojan.MSILZilla.22102
Malwarebytes	Malware.AI.4193431807
Cybereason	malicious.702ccd
BitDefenderTheta	Gen:NN.ZemsilF.34806.Lm0@aa1TEwm
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.MPA
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender	IL:Trojan.MSILZilla.22102
Ad-Aware	IL:Trojan.MSILZilla.22102
Emsisoft	IL:Trojan.MSILZilla.22102 (B)
VIPRE	IL:Trojan.MSILZilla.22102
SentinelOne	Static AI - Malicious PE
Trapmine	suspicious.low.ml.score
Sophos	ML/PE-A
Ikarus	Trojan-Downloader.MSIL.Agent
Avira	TR/Dropper.MSIL.Gen
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	IL:Trojan.MSILZilla.22102
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C5211352
Acronis	suspicious
APEX	Malicious
MAX	malware (ai score=86)
Fortinet	MSIL/Agent.MQQ!tr
CrowdStrike	win/malicious_confidence_100% (W)

Ivnut-Z2K-2.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All