Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 30, 2023, 5:11 p.m.	May 30, 2023, 5:18 p.m.

Size	1.7MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`022ffcaf0d05a9f02b4199f44c40d86a`
SHA256	`6aa12fc8b880af7f1ba4edc944be0cc79a0cc4b58adc5439c4263870531b61d2`
CRC32	`2C947278`
ssdeep	`24576:NLllLl72qOMO3J8VP9kSLOCcwpHf589p1YBHl:VllLXOMOJ8VP9vd/5WpAl`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

100.exe "C:\Users\test22\AppData\Local\Temp\100.exe"
2552
- Update.exe "C:\Users\test22\AppData\Local\Temp\Update.exe"
  2744
  - powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
    2932
  - powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Roaming'
    2984
- Start.exe "C:\Users\test22\AppData\Local\Temp\Start.exe"
  2704

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 30, 2023, 5:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 5:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 5:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:11 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 30, 2023, 5:10 p.m.			0	0
IsDebuggerPresent May 30, 2023, 5:10 p.m.			0	0
IsDebuggerPresent May 30, 2023, 5:11 p.m.			0	0
IsDebuggerPresent May 30, 2023, 5:11 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 92 events)

Time & API	Arguments	Status	Return
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000387490 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003ed850 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003ed850 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003ed850 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003ed540 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003ed540 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003ed850 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003ed850 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003ed850 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003ed850 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7310 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7310 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7310 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab75b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab75b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab75b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7620 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7620 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7620 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7620 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7620 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7620 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7380 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7380 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab75b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab75b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab75b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7770 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7770 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab77e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab77e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7850 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7850 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7850 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7a10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7a10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7a80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7a80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bad1de0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bad1de0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7a80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bab7a80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bad20f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bad20f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bad20f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bad20f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000369340 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b536d10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b536d10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 5:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b536d10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 30, 2023, 5:10 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 30, 2023, 5:12 p.m.	stacktrace: mscorlib+0xcf2c72 @ 0x7fef31a2c72 0x7fe94641f11 mscorlib+0x4ef8a5 @ 0x7fef299f8a5 mscorlib+0x4ef609 @ 0x7fef299f609 mscorlib+0x4ef5c7 @ 0x7fef299f5c7 mscorlib+0xd5159d @ 0x7fef320159d CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef3b5f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef3b5f242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef3b5f30b NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef3d26291 DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef3c06d80 DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef3c06d0e DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef3c06c85 DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef3c06dbb NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef3d26175 StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef3c966ae BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521 exception.instruction_r: 44 88 04 01 48 8d 65 18 5b 5d c3 cc cc cc cc cc exception.instruction: mov byte ptr [rcx + rax], r8b exception.exception_code: 0xc0000005 exception.symbol: mscorlib+0xcf2c72 exception.address: 0x7fef31a2c72 registers.r14: 0 registers.r15: 0 registers.rcx: 1992393360 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 470940752 registers.r11: 514 registers.r8: 470936137 registers.r9: 470936128 registers.rdx: 0 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

May 30, 2023, 5:12 p.m.

stacktrace:

mscorlib+0xcf2c72 @ 0x7fef31a2c72
0x7fe94641f11
mscorlib+0x4ef8a5 @ 0x7fef299f8a5
mscorlib+0x4ef609 @ 0x7fef299f609
mscorlib+0x4ef5c7 @ 0x7fef299f5c7
mscorlib+0xd5159d @ 0x7fef320159d
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef3b5f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef3b5f242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef3b5f30b
NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef3d26291
DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef3c06d80
DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef3c06d0e
DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef3c06c85
DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef3c06dbb
NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef3d26175
StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef3c966ae
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

exception.instruction_r: 44 88 04 01 48 8d 65 18 5b 5d c3 cc cc cc cc cc
exception.instruction: mov byte ptr [rcx + rax], r8b
exception.exception_code: 0xc0000005
exception.symbol: mscorlib+0xcf2c72
exception.address: 0x7fef31a2c72
registers.r14: 0
registers.r15: 0
registers.rcx: 1992393360
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 470940752
registers.r11: 514
registers.r8: 470936137
registers.r9: 470936128
registers.rdx: 0
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 524 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000990000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b11000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef41ab000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002540000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000026f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b14000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b14000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b14000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b14000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9436a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9437c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94500000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 region_size: 1024000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94501000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94640000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94641000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9441c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94420000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000e50000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000e50000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000e52000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ef1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ef1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ef1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ef1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ef1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ef1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ef1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ef1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ef1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ef1000 process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (3 events)

file	C:\ProgramData\ProgramFiles\AUIJOL.exe
file	C:\Users\test22\AppData\Local\Temp\Update.exe
file	C:\Users\test22\AppData\Local\Temp\Start.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
cmdline	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Roaming'

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\Start.exe
file	C:\Users\test22\AppData\Local\Temp\Update.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\Start.exe

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW May 30, 2023, 5:11 p.m.	thread_identifier: 2936 thread_handle: 0x0000000000000258 process_identifier: 2932 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000254	1	1	0
CreateProcessInternalW May 30, 2023, 5:11 p.m.	thread_identifier: 2988 thread_handle: 0x0000000000000258 process_identifier: 2984 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Roaming' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000260	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0000e200', u'virtual_address': u'0x0006b000', u'entropy': 6.802484891199976, u'name': u'.rsrc', u'virtual_size': u'0x0000e044'}

entropy

6.8024848912

description

A section with a high entropy has been found

entropy

0.207339449541

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW May 30, 2023, 5:11 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 30, 2023, 5:11 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 30, 2023, 5:11 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe

File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 events)

Bkav	W32.AIDetectMalware
Cynet	Malicious (score: 100)
FireEye	Generic.mg.022ffcaf0d05a9f0
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	Artemis!022FFCAF0D05
VIPRE	Gen:Variant.Fugrafa.267521
Sangfor	Trojan.Win32.Save.a
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	multiple detections
APEX	Malicious
ClamAV	Win.Dropper.njRAT-9986242-0
Kaspersky	HEUR:Trojan.MSIL.Inject.gen
BitDefender	Gen:Variant.Fugrafa.267521
MicroWorld-eScan	Gen:Variant.Fugrafa.267521
Avast	Win64:Evo-gen [Trj]
Tencent	Msil.Trojan.Inject.Bkjl
Emsisoft	Gen:Variant.Fugrafa.267521 (B)
Baidu	Archive.Bomb
F-Secure	Heuristic.HEUR/AGEN.1311185
DrWeb	Trojan.InjectNET.14
Zillya	Trojan.Agent.Win32.3168291
McAfee-GW-Edition	BehavesLike.Win32.Generic.tm
Sophos	Generic ML PUA (PUA)
Ikarus	Trojan.Win32.Crypt
GData	Gen:Variant.Fugrafa.267521
Arcabit	Trojan.Fugrafa.D41501
ZoneAlarm	HEUR:Trojan.MSIL.Inject.gen
Microsoft	Trojan:Win32/Redline.CAW!MTB
Google	Detected
Acronis	suspicious
VBA32	Trojan.Agent
ALYac	Gen:Variant.Fugrafa.267521
MAX	malware (ai score=86)
Malwarebytes	Trojan.BitCoinMiner
Rising	Malware.SwollenFile!1.E38A (CLASSIC)
SentinelOne	Static AI - Suspicious PE
Fortinet	MSIL/CoinMiner.BMT!tr
AVG	Win64:Evo-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (D)

100.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All