Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 9, 2023, 7:54 a.m.	June 9, 2023, 7:56 a.m.

Size	1.5MB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`19197b3174a5f441696e23f7e8b8c33a`
SHA256	`7c11ba68d9d7b0136e240ce53a14fdec989e270c95274516e0b7e2f60e66d484`
CRC32	`306E8F99`
ssdeep	`24576:7bcADanwaoDgLRMlM1YKdS0zBfOnjDmNlqO/HUzbPpH:xanwXBdK40zBfOnjDmNlqO/UzbPZ`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult IsPE64 - (no description) Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Generic_Malware_Zero - Generic Malware

netTime.exe "C:\Users\test22\AppData\Local\Temp\netTime.exe"
288
- powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2552
- powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Roaming'
  2596

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 9, 2023, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2023, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2023, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2023, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 9, 2023, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2023, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2023, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2023, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2023, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2023, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 9, 2023, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2023, 7:55 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 9, 2023, 7:54 a.m.			0	0
IsDebuggerPresent June 9, 2023, 7:54 a.m.			0	0
IsDebuggerPresent June 9, 2023, 7:55 a.m.			0	0
IsDebuggerPresent June 9, 2023, 7:55 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 92 events)

Time & API	Arguments	Status	Return
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000022f7d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8630 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8630 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8630 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b86a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b86a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8be0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8be0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8be0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b8b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b90b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b90b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b90b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b9190 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b9190 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b9200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b9200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b9190 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b9190 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b9190 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002bddf0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002bddf0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002bddf0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002bddf0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e2cb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e2cb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e2f50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e2f50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b9190 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b9190 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b9190 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b9190 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002b88c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b6734e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b6734e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2023, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b6734e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 9, 2023, 7:54 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sdata

The file contains an unknown PE resource name possibly indicative of a packer (2 events)

resource name	DISKIO
resource name	MUI

Allocates read-write-execute memory (usually to unpack itself) (50 out of 580 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000750000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000008c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3621000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cbb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000750000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000007e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3622000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3622000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3622000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3622000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3622000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3622000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3622000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3622000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3622000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3622000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3622000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3624000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3624000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3624000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3624000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94020000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 1224704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94021000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94190000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f66000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 45056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94191000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e8b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9419c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e9a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93eab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93edc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ead000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e9d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000870000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1f26000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9419d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9419e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b40000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2023, 7:54 a.m.	process_identifier: 288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b40000 process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

netTime.exe tried to sleep 135 seconds, actually delayed analysis time by 135 seconds

Creates executable files on the filesystem (1 event)

file	C:\ProgramData\Timeupper\HVPIO.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Roaming'
cmdline	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 9, 2023, 7:54 a.m.	thread_identifier: 2556 thread_handle: 0x0000000000000264 process_identifier: 2552 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000000000000025c	1	1	0
CreateProcessInternalW June 9, 2023, 7:54 a.m.	thread_identifier: 2600 thread_handle: 0x0000000000000264 process_identifier: 2596 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Roaming' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000000000000026c	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00000800', u'virtual_address': u'0x0012c000', u'entropy': 7.775335210576269, u'name': u'.sdata', u'virtual_size': u'0x000007f2'}

entropy

7.77533521058

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW June 9, 2023, 7:54 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 9, 2023, 7:55 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 9, 2023, 7:55 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

netTime.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All