Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 11, 2023, 9:09 a.m.	May 11, 2023, 9:15 a.m.

Size	1.8MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`c0578edb37d43cc63a01b287436f4e67`
SHA256	`ddd335b9a548f3c06b71c062e3ba5546db3f75a19a89419fa05f4d12099c277d`
CRC32	`7713F157`
ssdeep	`49152:vsRFRccZCW+FX0aqmjKV/bbm/WHimyX4bSwDZHBInf:vsR7ccZl4/OYX4bSOhBIf`
Yara	UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

koIWDRc.exe "C:\Users\test22\AppData\Local\Temp\koIWDRc.exe"
2552
- Engine.exe C:\Users\test22\AppData\Local\Temp\SETUP_28160\Engine.exe /TH_ID=_2556 /OriginExe="C:\Users\test22\AppData\Local\Temp\koIWDRc.exe"
  2660
  - cmd.exe C:\Windows\system32\cmd.exe /c cmd < Lat
    2720
    - cmd.exe cmd
      2780
      - powershell.exe powershell get-process avastui
        2824

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
77.91.124.20	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 58 events)

Time & API	Arguments	Status	Return
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 11, 2023, 9:09 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 11, 2023, 9:09 a.m.			0	0
IsDebuggerPresent May 11, 2023, 9:09 a.m.			0	0

Command line console output was observed (50 out of 356 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: Set xHgDKKnbdSkFMonAHOoqwxyUtFbpjgnYMkYHmGWzMYyYhDAxU=v console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: opxVqCxnyhglwzhTApQqqSPh=guGByrfbBf console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: 'opxVqCxnyhglwzhTApQqqSPh' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: afXtyiRybOtEqJZlrOMdxuTLc=XqpZNmtnBlkMVTqJQhlCFRyTk console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: 'afXtyiRybOtEqJZlrOMdxuTLc' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: PYckvkIslRWbwEACoOYsTSd=fFBToyUdNtKyefOZrDJpMajF console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: 'PYckvkIslRWbwEACoOYsTSd' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: rIdUUPWIKV=KPptWFKWUcmTqYgdpuXXzVRyvE console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: 'rIdUUPWIKV' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: TfNvazXfhzEjiIfLGD=dWFnNCMYbOXtHalQHiZimeIqWF console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: 'TfNvazXfhzEjiIfLGD' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: QgrlkBHhmhQqTFxABffXUWRIEHc=hhFCoIVJzDMCqtKD console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: 'QgrlkBHhmhQqTFxABffXUWRIEHc' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: iyCtCiKGHZTbcGDudqjIhRkJLu=DMWPjgRvCTkKyUVAJwjXXovJtnVCf console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: 'iyCtCiKGHZTbcGDudqjIhRkJLu' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: SzcpiUKpHpEpwhtfuNasCHmoqxd=LOzgiIqSgWNwPmx console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: 'SzcpiUKpHpEpwhtfuNasCHmoqxd' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: zNipEOsilXs=UhpMEbbTQdeajj console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: 'zNipEOsilXs' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: Set lqsCehcPjjiIXvkrpsPYwMqbswBhrL=l console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: aNiiTcgXnnWmbPAvEjSwbgYbZTlw=oLBnlfpgrlNeRmDQAqBAtIRS console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: 'aNiiTcgXnnWmbPAvEjSwbgYbZTlw' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: ntOJiZkjkfMcwjAsoAwtYFOcH=TJAIAUILMlxEWlCPGlQ console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: 'ntOJiZkjkfMcwjAsoAwtYFOcH' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: nOqpViPOOSdzeIyCMC=SMdmfWDERCoZDFkqyIdMayUWT console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: 'nOqpViPOOSdzeIyCMC' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: wChtqrtcYIogLjaDXkFTMOQHqTc=vNRzFcVqdMByVoGDRRWtzPiIsq console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: 'wChtqrtcYIogLjaDXkFTMOQHqTc' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: jLGtuIhZkQPI=dsjkJAYEihQpWsvG console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: 'jLGtuIhZkQPI' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc> console_handle: 0x00000007	1	1
WriteConsoleW May 11, 2023, 9:09 a.m.	buffer: peEhIfKIcbHocMeoHNwCVY=eDynPVpdRaFHNteHeCCgrdcMBN console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (47 events)

Time & API	Arguments	Status	Return
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f47b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4d30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4d30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4d30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4f30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4f30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4f30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4f30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4f30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4f30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4770 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4770 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4770 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4d30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4d30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4d30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4370 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4d30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4d30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4d30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4d30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4d30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4d30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4d30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f50b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f50b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f50b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f50b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f50b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f50b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f50b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f50b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f50b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f50b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f50b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f50b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f50b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f50b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4ff0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4ff0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4ff0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4ff0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4ff0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4ff0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4ff0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4ff0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 11, 2023, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f4ff0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 11, 2023, 9:09 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

Allocates read-write-execute memory (usually to unpack itself) (50 out of 137 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733c2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733c2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02890000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72331000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0276a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72332000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02762000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02772000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0279a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02773000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02774000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0276b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02792000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02775000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0279c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02776000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02793000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02794000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02795000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02796000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02797000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02798000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02799000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b83000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b84000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b85000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b86000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b87000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b88000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b89000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b8b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b8d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b8e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b8f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 9:09 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW May 11, 2023, 9:09 a.m.	number_of_free_clusters: 3252583 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1	0
GetDiskFreeSpaceExW May 11, 2023, 9:09 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13322579968 root_path: C:\Users total_number_of_bytes: 34252779520	1	1	0

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\SETUP_28160\Engine.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\ekibzctf.2tc\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell get-process avastui
cmdline	C:\Windows\system32\cmd.exe /c cmd < Lat

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\SETUP_28160\Engine.exe

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00004600', u'virtual_address': u'0x00031000', u'entropy': 7.053799150225814, u'name': u'.rsrc', u'virtual_size': u'0x000045a8'}

entropy

7.05379915023

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 11, 2023, 9:09 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

77.91.124.20

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (moderate confidence)
Sangfor	Trojan.Win32.Agent.V642
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	Win32:Malware-gen
TrendMicro	Trojan.Win32.SMOKELOADER.YXDEKZ
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
McAfee	Artemis!C0578EDB37D4
Rising	Trojan.Generic@AI.86 (RDML:wr6C7v79RWhIWqMZ438uMg)
AVG	Win32:Malware-gen

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

koIWDRc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All