Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 30, 2023, 5:40 p.m.	June 30, 2023, 5:52 p.m.

Size	892.0KB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`d65f5542509366672c1224cc31adfbf0`
SHA256	`85c5a9b53be051fef06d1082abb950a731ffb452e68cc9aafa907251e2d6bd72`
CRC32	`AEE15C14`
ssdeep	`12288:TDX6EUtFA+RLxx6aLm05opfN+0gr3FMWrMZXAzz77xQaoS:TbDUtm+hxx6aLo5snaR`
Yara	IsPE64 - (no description) PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer

TJeAjWEEeH.exe "C:\Users\test22\AppData\Local\Temp\TJeAjWEEeH.exe"
2644
- powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2840

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 30, 2023, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 30, 2023, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 30, 2023, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 30, 2023, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 30, 2023, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 30, 2023, 5:43 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 30, 2023, 5:33 p.m.			0	0
IsDebuggerPresent June 30, 2023, 5:33 p.m.			0	0
IsDebuggerPresent June 30, 2023, 5:43 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000033fe80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000348440 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000348440 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000348440 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000348440 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000348440 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000347e90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000347e90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000347e90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000347e90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b854c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b854c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b854c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003480c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003480c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003480c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003484b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003484b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003484b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003484b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003484b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003484b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003484b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003484b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b854f40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b854f40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b854f40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b855170 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b855170 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b854a70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b854a70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8551e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8551e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8551e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b855330 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b855330 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b855330 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b855330 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b872c00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b872c00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b872ea0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b872ea0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8730d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8730d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8730d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 30, 2023, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8730d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 30, 2023, 5:33 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 454 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000009d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef406b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000f20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001010000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9425a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9426c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 937984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe944c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9430c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94336000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94310000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000013b0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000013b0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000013b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001443000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001443000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001443000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001443000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001443000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001443000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001443000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001443000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001443000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001443000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001443000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 30, 2023, 5:33 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001443000 process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

TJeAjWEEeH.exe tried to sleep 202 seconds, actually delayed analysis time by 202 seconds

Creates executable files on the filesystem (1 event)

file	C:\ProgramData\Chrome\CNSWA.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 30, 2023, 5:33 p.m.	thread_identifier: 2844 thread_handle: 0x0000000000000254 process_identifier: 2840 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000000000000024c	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 30, 2023, 5:33 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW June 30, 2023, 5:43 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 events)

Lionic	Trojan.Win32.Generic.4!c
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.MSILPerseus.238349
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
ALYac	Gen:Variant.MSILPerseus.238349
Cylance	Unsafe
VIPRE	Gen:Variant.MSILPerseus.238349
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005813451 )
BitDefender	Gen:Variant.MSILPerseus.238349
K7GW	Trojan ( 005813451 )
Cybereason	malicious.01a5ce
Cyren	W64/MSIL_Coinminer.H.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/CoinMiner.BMT
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Trojan:MSIL/CoinMiner.3704f801
Avast	Win64:Evo-gen [Trj]
Tencent	Msil.Trojan.Inject.Jajl
Sophos	Mal/Miner-AX
DrWeb	Trojan.InjectNET.14
TrendMicro	TROJ_GEN.R002C0RAM23
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.d65f554250936667
Emsisoft	Gen:Variant.MSILPerseus.238349 (B)
SentinelOne	Static AI - Malicious PE
Google	Detected
Avira	HEUR/AGEN.1231966
MAX	malware (ai score=84)
Microsoft	Trojan:Script/Phonzy.A!ml
Arcabit	Trojan.MSILPerseus.D3A30D
GData	Gen:Variant.MSILPerseus.238349
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C5199103
Acronis	suspicious
McAfee	Artemis!D65F55425093
Malwarebytes	Trojan.BitCoinMiner
TrendMicro-HouseCall	TROJ_GEN.R002C0RAM23
Rising	Malware.Obfus/MSIL@AI.86 (RDM.MSIL2:sxdnypr8vNlN4RLMwN2rvw)
Ikarus	Trojan.MSIL.CoinMiner
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/CoinMiner.BMT!tr
AVG	Win64:Evo-gen [Trj]
Panda	Trj/CI.A

TJeAjWEEeH.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All