Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 31, 2023, 9:12 a.m.	May 31, 2023, 9:29 a.m.

Size	4.3MB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`3f005ce85f08a09e93679254e35df782`
SHA256	`c43f913e75a18bcddedf040beec903b94336734537ca6816d8174e8237822870`
CRC32	`7C3FBD76`
ssdeep	`49152:m6+OL0vnSGYGY+9C4OXk9PhRBPhILfF/QxamXYOCs5EbNfylJTEXKobB1:m7jHTXXREYJgXK`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsPE64 - (no description) PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer Antivirus - Contains references to security software

1.exe "C:\Users\test22\AppData\Local\Temp\1.exe"
156
- powershell.exe powershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN Soft /TR C:\Users\test22\AppData\Roaming\WindowsAutoUpdate.exe"
  2112
  - schtasks.exe "C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN Soft /TR C:\Users\test22\AppData\Roaming\WindowsAutoUpdate.exe
    2584

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 31, 2023, 9:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 31, 2023, 9:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:05 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (40 events)

Time & API	Arguments	Status	Return
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003b4840 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b307ca0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b307ca0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b307ca0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b308020 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b308020 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b307f40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b307f40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b307f40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b307f40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3084f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3084f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3084f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b308170 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b308170 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b308170 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3083a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3083a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3083a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3083a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3083a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3083a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3083a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3083a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b308170 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b308170 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b308170 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3089c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3089c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b308410 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b308410 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3084f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3084f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3084f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b308b80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b308b80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b308b80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b308b80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b335150 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b335150 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 31, 2023, 9:05 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.symtab

Allocates read-write-execute memory (usually to unpack itself) (50 out of 174 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002900000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000029d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3571000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ee000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ee000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ee000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00032000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00022000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000029d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000029d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00033000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00034000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00122000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00035000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00170000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00023000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00036000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00123000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0002a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00171000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 2112 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000029d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\WindowsAutoUpdate.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN Soft /TR C:\Users\test22\AppData\Roaming\WindowsAutoUpdate.exe
cmdline	powershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN Soft /TR C:\Users\test22\AppData\Roaming\WindowsAutoUpdate.exe"

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 31, 2023, 9:05 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN Soft /TR C:\Users\test22\AppData\Roaming\WindowsAutoUpdate.exe
cmdline	powershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN Soft /TR C:\Users\test22\AppData\Roaming\WindowsAutoUpdate.exe"

Installs itself for autorun at Windows startup (2 events)

cmdline	"C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN Soft /TR C:\Users\test22\AppData\Roaming\WindowsAutoUpdate.exe
cmdline	powershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN Soft /TR C:\Users\test22\AppData\Roaming\WindowsAutoUpdate.exe"

One or more non-whitelisted processes were created (1 event)

parent_process

powershell.exe

martian_process

"C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN Soft /TR C:\Users\test22\AppData\Roaming\WindowsAutoUpdate.exe

The process powershell.exe wrote an executable file to disk (1 event)

file	C:\Windows\System32\schtasks.exe

Detects the presence of Wine emulator (1 event)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress May 31, 2023, 9:05 a.m.	ordinal: 0 function_address: 0x000007fefe467a50 function_name: wine_get_version module: ntdll module_address: 0x00000000776c0000		-1073741511	0

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 events)

Lionic	Trojan.Win64.Coins.tsjc
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.67251242
McAfee	Artemis!3F005CE85F08
Malwarebytes	Trojan.MalPack.GO
VIPRE	Trojan.GenericKD.67251242
Sangfor	Downloader.Win32.Gomal.V4et
K7AntiVirus	Trojan ( 005a57551 )
Alibaba	TrojanDownloader:Win32/Gomal.02059288
K7GW	Trojan ( 005a57551 )
Arcabit	Trojan.Generic.D4022C2A
Cyren	W64/ABRisk.YVER-2643
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of WinGo/Agent.MJ
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	Trojan-Downloader.Win32.Gomal.ie
BitDefender	Trojan.GenericKD.67251242
Avast	Win64:Trojan-gen
Tencent	Win32.Trojan-Downloader.Gomal.Yylw
Emsisoft	Trojan.GenericKD.67251242 (B)
F-Secure	Trojan.TR/AD.Nekark.hcgrh
DrWeb	Trojan.MulDrop22.8049
TrendMicro	TROJ_GEN.R002C0XET23
McAfee-GW-Edition	BehavesLike.Win64.Generic.rh
FireEye	Trojan.GenericKD.67251242
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Jiangmin	TrojanDropper.Dapato.adom
Webroot	W32.Trojan.Gen
Avira	TR/AD.Nekark.hcgrh
MAX	malware (ai score=84)
Antiy-AVL	Trojan[Downloader]/Win32.Gomal
Gridinsoft	Trojan.Win64.Downloader.ca
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	Trojan-Downloader.Win32.Gomal.ie
GData	Trojan.GenericKD.67251242
Google	Detected
ALYac	Trojan.GenericKD.67251242
VBA32	TrojanDownloader.Gomal
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002C0XET23
Ikarus	Trojan.Win64.Meterpreter
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.MJ!tr
AVG	Win64:Trojan-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All