Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 13, 2023, 9:40 a.m.	March 13, 2023, 9:42 a.m.

Size	1.5MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`43c3f3e2e28157583e7eda204b2b103f`
SHA256	`280474eb2d29702b7026467d357d2a34d58c08c82a264c174bce9e4bf694c19b`
CRC32	`BBF1260D`
ssdeep	`12288:qP5IhyeomsP5LxH94zj9jljH0bStIswondr1fDzqJVxLsE8LX:1QYrpDzq1uL`
Yara	anti_vm_detect - Possibly employs anti-virtualization techniques Is_DotNET_EXE - (no description) hide_executable_file - Hide executable file IsPE32 - (no description) PE_Header_Zero - PE File Signature

CHEAT-MENU-LINK-1.exe "C:\Users\test22\AppData\Local\Temp\CHEAT-MENU-LINK-1.exe"
932
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABDAEgARQBBAFQALQBNAEUATgBVAC0ATABJAE4ASwAtADEALgBlAHgAZQAiACAALQBGAG8AcgBjAGUA
  2168

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (9 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 13, 2023, 9:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 13, 2023, 9:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 13, 2023, 9:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 13, 2023, 9:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 13, 2023, 9:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 13, 2023, 9:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 13, 2023, 9:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 13, 2023, 9:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 13, 2023, 9:40 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 13, 2023, 9:40 a.m.			0	0
IsDebuggerPresent March 13, 2023, 9:40 a.m.			0	0
IsDebuggerPresent March 13, 2023, 9:40 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (42 events)

Time & API	Arguments	Status	Return
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005defc8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ded08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ded08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ded08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ded08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ded08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ded08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df588 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df188 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005dfa08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005dfa08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005dfa08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005dfa08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005dfa08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005dfa08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005dfa08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005dfa08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005dfa08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005dfa08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005dfa08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005dfa08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005dfa08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005dfa08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 13, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005df488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 13, 2023, 9:40 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 195 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02070000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02230000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003be000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02320000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02330000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021cd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021ce000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021cf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04721000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02331000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04722000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04723000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0473f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04730000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04724000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04725000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04726000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2023, 9:40 a.m.	process_identifier: 932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04727000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABDAEgARQBBAFQALQBNAEUATgBVAC0ATABJAE4ASwAtADEALgBlAHgAZQAiACAALQBGAG8AcgBjAGUA
cmdline	powershell -ENC UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABDAEgARQBBAFQALQBNAEUATgBVAC0ATABJAE4ASwAtADEALgBlAHgAZQAiACAALQBGAG8AcgBjAGUA

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\CHEAT-MENU-LINK-1.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW March 13, 2023, 9:40 a.m.	show_type: 0 filepath_r: powershell parameters: -ENC UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABDAEgARQBBAFQALQBNAEUATgBVAC0ATABJAE4ASwAtADEALgBlAHgAZQAiACAALQBGAG8AcgBjAGUA filepath: powershell	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 13, 2023, 9:40 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW March 13, 2023, 9:40 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Scarsi.4!c
MicroWorld-eScan	Trojan.GenericKD.65751463
ALYac	Trojan.GenericKD.65751463
Malwarebytes	Trojan.Crypt.MSIL
VIPRE	Trojan.GenericKD.65751463
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0059ed4e1 )
Alibaba	Trojan:MSIL/Remcos.9ed305ae
K7GW	Trojan ( 0059ed4e1 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D3EB49A7
VirIT	Trojan.Win32.MSIL_Heur.A
Cyren	W32/ABRisk.KZPQ-1469
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.AIAN
Cynet	Malicious (score: 100)
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Scarsi.gen
BitDefender	Trojan.GenericKD.65751463
NANO-Antivirus	Trojan.Win32.Remcos.jvaxfz
Avast	Win32:RATX-gen [Trj]
Tencent	Msil.Trojan.Scarsi.Ktgl
Sophos	ML/PE-A
DrWeb	Trojan.Remcos.6
Zillya	Trojan.Kryptik.Win32.4052398
TrendMicro	TROJ_GEN.R002C0DC123
McAfee-GW-Edition	BehavesLike.Win32.Generic.tz
FireEye	Generic.mg.43c3f3e2e2815758
Emsisoft	Trojan.GenericKD.65751463 (B)
Ikarus	Trojan.Agent
Avira	HEUR/AGEN.1253934
Antiy-AVL	Trojan/MSIL.Kryptik
Gridinsoft	Trojan.Win32.Kryptik.cl
Microsoft	Trojan:MSIL/Remcos.AR!MTB
GData	Trojan.GenericKD.65751463
Google	Detected
AhnLab-V3	Trojan/Win.Remcos.C5389982
Acronis	suspicious
McAfee	Artemis!43C3F3E2E281
MAX	malware (ai score=85)
VBA32	TScope.Trojan.MSIL
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002C0DC123
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:fJc9XHh8bOi37seBcEA0Sg)
Yandex	Trojan.Kryptik!MHXcfm1xuwQ
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.73692792.susgen

CHEAT-MENU-LINK-1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All