Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 21, 2022, 5:14 p.m.	July 21, 2022, 5:38 p.m.

Size	682.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`7feb667ac9fdac797ad2e148c84f086e`
SHA256	`a3dab5e89517feaba18c29575d32c353518c326dc3acb4bebc7e43081cfeccc0`
CRC32	`D7E732EC`
ssdeep	`12288:Kbkisdv1MmLw3iAFniPO5LjFk4r3o3Dih:S8vsnUuLxb7e`
Yara	IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature

Wjgqesf-OLD-1.exe "C:\Users\test22\AppData\Local\Temp\Wjgqesf-OLD-1.exe"
2788
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABXAGoAZwBxAGUAcwBmAC0ATwBMAEQALQAxAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlAA==
  2944

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (9 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 21, 2022, 5:14 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 21, 2022, 5:14 p.m.			0	0
IsDebuggerPresent July 21, 2022, 5:14 p.m.			0	0
IsDebuggerPresent July 21, 2022, 5:14 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (45 events)

Time & API	Arguments	Status	Return
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d5158 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d5158 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d5218 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004efc40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f00c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f00c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f00c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004efd00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f0200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ef8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ef8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ef8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ef8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ef8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ef8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ef8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ef8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ef8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ef8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ef8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ef8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ef8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ef8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004efdc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004efdc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004efdc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2022, 5:14 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004efdc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 21, 2022, 5:14 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 189 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00790000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00990000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00552000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00585000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00577000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a13000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a14000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a18000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a19000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a1a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b9f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a1d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a1e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a1f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b43000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b45000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b46000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b47000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b48000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b49000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2022, 5:14 p.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABXAGoAZwBxAGUAcwBmAC0ATwBMAEQALQAxAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlAA==
cmdline	Powershell -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABXAGoAZwBxAGUAcwBmAC0ATwBMAEQALQAxAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlAA==

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\Wjgqesf-OLD-1.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 21, 2022, 5:14 p.m.	show_type: 0 filepath_r: Powershell parameters: -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABXAGoAZwBxAGUAcwBmAC0ATwBMAEQALQAxAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlAA== filepath: Powershell	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00051c00', u'virtual_address': u'0x00002000', u'entropy': 7.994053239852254, u'name': u'.text', u'virtual_size': u'0x00051a80'}

entropy

7.99405323985

description

A section with a high entropy has been found

entropy

0.479823917828

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 21, 2022, 5:14 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 21, 2022, 5:14 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILZilla.22091
FireEye	Generic.mg.7feb667ac9fdac79
McAfee	RDN/Generic BackDoor
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.33ba09
BitDefenderTheta	Gen:NN.ZemsilF.34806.Qm0@aCSZ3tj
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.MQO
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Backdoor.MSIL.Crysan.gen
BitDefender	IL:Trojan.MSILZilla.22091
Avast	Win32:DropperX-gen [Drp]
Ad-Aware	IL:Trojan.MSILZilla.22091
Sophos	ML/PE-A
F-Secure	Trojan.TR/Dropper.MSIL.Gen
VIPRE	IL:Trojan.MSILZilla.22091
McAfee-GW-Edition	BehavesLike.Win32.Generic.jh
Trapmine	malicious.high.ml.score
Emsisoft	IL:Trojan.MSILZilla.22091 (B)
Ikarus	Trojan-Downloader.MSIL.Agent
Avira	TR/Dropper.MSIL.Gen
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Arcabit	IL:Trojan.MSILZilla.D564B
ZoneAlarm	HEUR:Backdoor.MSIL.Crysan.gen
GData	IL:Trojan.MSILZilla.22091
Acronis	suspicious
ALYac	IL:Trojan.MSILZilla.22091
MAX	malware (ai score=87)
Malwarebytes	Malware.AI.4193431807
APEX	Malicious
SentinelOne	Static AI - Malicious PE
AVG	Win32:DropperX-gen [Drp]
CrowdStrike	win/malicious_confidence_100% (D)

Wjgqesf-OLD-1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All