Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 4, 2023, 4:11 p.m.	July 4, 2023, 4:14 p.m.

Size	804.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`c35f4ebfa52e9f721f843eac4e01e981`
SHA256	`41a043754970c26089f019e1a5697f5c313b04a50edd76ade835d7e78c4c1658`
CRC32	`4817595F`
ssdeep	`12288:nqmfOzGV2umg0UnNNeXIy3zCSkwhLwzMFt4IR4fNF74eSEXGe/XQbLtzHbMU4F+y:nFfO0BmgNivxzLwIFt4pNFY6`
Yara	Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Win_Trojan_AgentTesla_IN_Zero - Win Trojan AgentTesla IsPE32 - (no description)

c35f4ebfa52e9f721f843eac4e01e981.exe "C:\Users\test22\AppData\Local\Temp\c35f4ebfa52e9f721f843eac4e01e981.exe"
2560
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\tjEyktRB.exe"
  2956
- schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tjEyktRB" /XML "C:\Users\test22\AppData\Local\Temp\tmp9A47.tmp"
  3004
- c35f4ebfa52e9f721f843eac4e01e981.exe "C:\Users\test22\AppData\Local\Temp\c35f4ebfa52e9f721f843eac4e01e981.exe"
  604
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
microsoft.com	A 20.236.44.162 A 20.76.201.171 A 20.70.246.20 A 20.231.239.246 A 20.112.250.133	20.112.250.133

IP Address	Status	Action
164.124.101.2	Active	Moloch
194.147.140.197	Active	Moloch
20.236.44.162	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49172 -> 20.236.44.162:80	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 194.147.140.197:3601 -> 192.168.56.101:49171	2038897	ET MALWARE Warzone RAT Response (Inbound)	A Network Trojan was detected
TCP 194.147.140.197:3601 -> 192.168.56.101:49171	2038897	ET MALWARE Warzone RAT Response (Inbound)	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (10 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 4, 2023, 4:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2023, 4:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2023, 4:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2023, 4:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2023, 4:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 4, 2023, 4:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2023, 4:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2023, 4:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2023, 4:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2023, 4:12 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 4, 2023, 4:11 p.m.			0	0
IsDebuggerPresent July 4, 2023, 4:11 p.m.			0	0
IsDebuggerPresent July 4, 2023, 4:12 p.m.			0	0

Command line console output was observed (10 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 4, 2023, 4:12 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW July 4, 2023, 4:12 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW July 4, 2023, 4:12 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW July 4, 2023, 4:12 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW July 4, 2023, 4:12 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\tjEyktR console_handle: 0x00000053	1	1
WriteConsoleW July 4, 2023, 4:12 p.m.	buffer: B.exe console_handle: 0x0000005f	1	1
WriteConsoleW July 4, 2023, 4:12 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW July 4, 2023, 4:12 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW July 4, 2023, 4:12 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW July 4, 2023, 4:12 p.m.	buffer: SUCCESS: The scheduled task "Updates\tjEyktRB" has successfully been created. console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d05a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0b20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0b20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0b20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d06a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d06a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d06a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d06a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d06a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d06a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0160 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0160 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0160 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0b20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0b20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0b20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0a20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0b20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0b20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0b20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0b20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0b20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0b20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0b20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d02a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d02a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d02a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d02a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d02a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d02a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d02a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d02a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d02a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d02a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d02a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d02a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d02a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d02a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003d0f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 4, 2023, 4:11 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 214 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aa0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02390000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00590000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00591000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00592000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00593000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00594000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00595000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00596000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2023, 4:11 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6b000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW July 4, 2023, 4:12 p.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1	0

Steals private information from local Internet browsers (23 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 3\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 20\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 5\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 10\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 8\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 4\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 15\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 18\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 9\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 2\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 7\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 16\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 13\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 6\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 17\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 12\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 14\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 19\Login Data
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data

Creates executable files on the filesystem (6 events)

file	C:\Users\test22\AppData\Local\Temp\softokn3.dll
file	C:\Users\test22\AppData\Local\Temp\vcruntime140.dll
file	C:\Users\test22\AppData\Local\Temp\mozglue.dll
file	C:\Users\test22\AppData\Local\Temp\nss3.dll
file	C:\Users\test22\AppData\Local\Temp\msvcp140.dll
file	C:\Users\test22\AppData\Local\Temp\freebl3.dll

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (4 events)

cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\tjEyktRB.exe"
cmdline	schtasks.exe /Create /TN "Updates\tjEyktRB" /XML "C:\Users\test22\AppData\Local\Temp\tmp9A47.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tjEyktRB" /XML "C:\Users\test22\AppData\Local\Temp\tmp9A47.tmp"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\tjEyktRB.exe"

Executes one or more WMI queries (1 event)

wmi

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 4, 2023, 4:12 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\tjEyktRB.exe" filepath: powershell	1	1	0
ShellExecuteExW July 4, 2023, 4:12 p.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\tjEyktRB" /XML "C:\Users\test22\AppData\Local\Temp\tmp9A47.tmp" filepath: schtasks.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x000bce00', u'virtual_address': u'0x00002000', u'entropy': 7.485755695982604, u'name': u'.text', u'virtual_size': u'0x000bcce4'}

entropy

7.48575569598

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0000c000', u'virtual_address': u'0x000c0000', u'entropy': 7.961721139250695, u'name': u'.rsrc', u'virtual_size': u'0x0000bf98'}

entropy

7.96172113925

description

A section with a high entropy has been found

entropy

0.999378109453

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 4, 2023, 4:12 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 4, 2023, 4:12 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://microsoft.com/

Yara rule detected in process memory (19 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	File Downloader	rule	Network_Downloader
description	Escalate priviledges	rule	Escalate_priviledges
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications use DNS	rule	Network_DNS
description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Install itself for autorun at Windows startup	rule	Persistence
description	email clients info stealer	rule	infoStealer_emailClients_Zero
description	Run a KeyLogger	rule	KeyLogger

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	schtasks.exe /Create /TN "Updates\tjEyktRB" /XML "C:\Users\test22\AppData\Local\Temp\tmp9A47.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tjEyktRB" /XML "C:\Users\test22\AppData\Local\Temp\tmp9A47.tmp"

Communicates with host for which no DNS query was performed (1 event)

host

194.147.140.197

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 4, 2023, 4:12 p.m.	process_identifier: 604 region_size: 1425408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003fc	1	0	0

A process attempted to delay the analysis task. (1 event)

description

c35f4ebfa52e9f721f843eac4e01e981.exe tried to sleep 2728503 seconds, actually delayed analysis time by 2728503 seconds

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory July 4, 2023, 4:12 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÉWdE¨97E¨97E¨97§f7D¨97QÃ>6D¨97§d7G¨97QÃ=6F¨97bnT7D¨97bnW7@¨97@¤67A¨97QÃ?6D¨97QÃ86f¨97E¨87F©97ÄÑ06Â¨97ÄÑÆ7D¨97ÄÑ;6D¨97RichE¨97PEL±dàêg @À@Ýh`p,T@Û .textÛ `.rdataS T@@.data¸Qè@À.rsrcp,`.î@@.relocT@B.bss°2@@ base_address: 0x00400000 process_identifier: 604 process_handle: 0x000003fc	1	1
WriteProcessMemory July 4, 2023, 4:12 p.m.	buffer: @$@8@G@V@e@t@@¸@Ú@ü@/@E@g@TÍ<¨K¢`Ý;UBÄôK A³ÝJpMÛ(`B`BUìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃÈÒAd base_address: 0x00420000 process_identifier: 604 process_handle: 0x000003fc	1	1
WriteProcessMemory July 4, 2023, 4:12 p.m.	buffer: 2½²ÔK-Øì¤ÄÍ±5UüÐíVåcZeí·G¿ÊjÄ¥24C# hÃÌÃòíÜO7J6T~ÀI¨f8¬R+W;\iXäAÅ~I~Æcw×¸õ'þß>:SWäþ^smîIÈ°Hp¾éNEf?TFÎ¨ëÈR¢¥7S§l£ base_address: 0x0055b000 process_identifier: 604 process_handle: 0x000003fc	1	1
WriteProcessMemory July 4, 2023, 4:12 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 604 process_handle: 0x000003fc	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 4, 2023, 4:12 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÉWdE¨97E¨97E¨97§f7D¨97QÃ>6D¨97§d7G¨97QÃ=6F¨97bnT7D¨97bnW7@¨97@¤67A¨97QÃ?6D¨97QÃ86f¨97E¨87F©97ÄÑ06Â¨97ÄÑÆ7D¨97ÄÑ;6D¨97RichE¨97PEL±dàêg @À@Ýh`p,T@Û .textÛ `.rdataS T@@.data¸Qè@À.rsrcp,`.î@@.relocT@B.bss°2@@ base_address: 0x00400000 process_identifier: 604 process_handle: 0x000003fc	1	1	0

Harvests credentials from local email clients (3 events)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2560 called NtSetContextThread to modify thread in remote process 604
NtSetContextThread July 4, 2023, 4:12 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4220830 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003f4 process_identifier: 604	1	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Local\Temp\c35f4ebfa52e9f721f843eac4e01e981.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2560 resumed a thread in remote process 604
NtResumeThread July 4, 2023, 4:12 p.m.	thread_handle: 0x000003f4 suspend_count: 1 process_identifier: 604	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Executed a process and injected code into it, probably while unpacking (28 events)

Time & API	Arguments	Status	Return
NtResumeThread July 4, 2023, 4:11 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2560	1	0
NtResumeThread July 4, 2023, 4:11 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2560	1	0
NtResumeThread July 4, 2023, 4:11 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2560	1	0
NtResumeThread July 4, 2023, 4:11 p.m.	thread_handle: 0x00000200 suspend_count: 1 process_identifier: 2560	1	0
NtGetContextThread July 4, 2023, 4:11 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread July 4, 2023, 4:11 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread July 4, 2023, 4:11 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2560	1	0
NtResumeThread July 4, 2023, 4:12 p.m.	thread_handle: 0x00000310 suspend_count: 1 process_identifier: 2560	1	0
CreateProcessInternalW July 4, 2023, 4:12 p.m.	thread_identifier: 2960 thread_handle: 0x00000444 process_identifier: 2956 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\tjEyktRB.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000044c	1	1
CreateProcessInternalW July 4, 2023, 4:12 p.m.	thread_identifier: 3008 thread_handle: 0x00000404 process_identifier: 3004 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tjEyktRB" /XML "C:\Users\test22\AppData\Local\Temp\tmp9A47.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000044c	1	1
CreateProcessInternalW July 4, 2023, 4:12 p.m.	thread_identifier: 812 thread_handle: 0x000003f4 process_identifier: 604 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\c35f4ebfa52e9f721f843eac4e01e981.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\c35f4ebfa52e9f721f843eac4e01e981.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003fc	1	1
NtGetContextThread July 4, 2023, 4:12 p.m.	thread_handle: 0x000003f4	1	0
NtAllocateVirtualMemory July 4, 2023, 4:12 p.m.	process_identifier: 604 region_size: 1425408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003fc	1	0
WriteProcessMemory July 4, 2023, 4:12 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÉWdE¨97E¨97E¨97§f7D¨97QÃ>6D¨97§d7G¨97QÃ=6F¨97bnT7D¨97bnW7@¨97@¤67A¨97QÃ?6D¨97QÃ86f¨97E¨87F©97ÄÑ06Â¨97ÄÑÆ7D¨97ÄÑ;6D¨97RichE¨97PEL±dàêg @À@Ýh`p,T@Û .textÛ `.rdataS T@@.data¸Qè@À.rsrcp,`.î@@.relocT@B.bss°2@@ base_address: 0x00400000 process_identifier: 604 process_handle: 0x000003fc	1	1
WriteProcessMemory July 4, 2023, 4:12 p.m.	buffer: base_address: 0x00401000 process_identifier: 604 process_handle: 0x000003fc	1	1
WriteProcessMemory July 4, 2023, 4:12 p.m.	buffer: base_address: 0x0041a000 process_identifier: 604 process_handle: 0x000003fc	1	1
WriteProcessMemory July 4, 2023, 4:12 p.m.	buffer: @$@8@G@V@e@t@@¸@Ú@ü@/@E@g@TÍ<¨K¢`Ý;UBÄôK A³ÝJpMÛ(`B`BUìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃÈÒAd base_address: 0x00420000 process_identifier: 604 process_handle: 0x000003fc	1	1
WriteProcessMemory July 4, 2023, 4:12 p.m.	buffer: base_address: 0x00556000 process_identifier: 604 process_handle: 0x000003fc	1	1
WriteProcessMemory July 4, 2023, 4:12 p.m.	buffer: base_address: 0x00559000 process_identifier: 604 process_handle: 0x000003fc	1	1
WriteProcessMemory July 4, 2023, 4:12 p.m.	buffer: 2½²ÔK-Øì¤ÄÍ±5UüÐíVåcZeí·G¿ÊjÄ¥24C# hÃÌÃòíÜO7J6T~ÀI¨f8¬R+W;\iXäAÅ~I~Æcw×¸õ'þß>:SWäþ^smîIÈ°Hp¾éNEf?TFÎ¨ëÈR¢¥7S§l£ base_address: 0x0055b000 process_identifier: 604 process_handle: 0x000003fc	1	1
WriteProcessMemory July 4, 2023, 4:12 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 604 process_handle: 0x000003fc	1	1
NtSetContextThread July 4, 2023, 4:12 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4220830 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003f4 process_identifier: 604	1	0
NtResumeThread July 4, 2023, 4:12 p.m.	thread_handle: 0x000003f4 suspend_count: 1 process_identifier: 604	1	0
NtResumeThread July 4, 2023, 4:12 p.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2560	1	0
NtResumeThread July 4, 2023, 4:12 p.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2956	1	0
NtResumeThread July 4, 2023, 4:12 p.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2956	1	0
NtResumeThread July 4, 2023, 4:12 p.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2956	1	0
NtResumeThread July 4, 2023, 4:12 p.m.	thread_handle: 0x000004a4 suspend_count: 1 process_identifier: 2956	1	0

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Lionic	Trojan.Win32.Taskun.4!c
tehtris	Generic.Malware
ALYac	Gen:Variant.MSILHeracles.85961
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005a7f2e1 )
Alibaba	Trojan:MSIL/AgentTesla.30d27f80
K7GW	Trojan ( 005a7f2e1 )
Cybereason	malicious.91c1ea
VirIT	Trojan.Win32.MSIL_Heur.A
Cyren	W32/MSIL_Agent.FPI.gen!Eldorado
Symantec	Scr.Malcode!gdn34
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik_AGen.AZJ
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.MSIL.Taskun.gen
BitDefender	Gen:Variant.MSILHeracles.85961
MicroWorld-eScan	Gen:Variant.MSILHeracles.85961
Avast	Win32:RATX-gen [Trj]
Tencent	Malware.Win32.Gencirc.13e223a0
Emsisoft	Gen:Variant.MSILHeracles.85961 (B)
F-Secure	Heuristic.HEUR/AGEN.1310827
DrWeb	Trojan.Siggen21.2650
VIPRE	Gen:Variant.MSILHeracles.85961
TrendMicro	Backdoor.Win32.WARZONE.YXDF4Z
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
FireEye	Generic.mg.c35f4ebfa52e9f72
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Inject
GData	Gen:Variant.MSILHeracles.85961
Avira	HEUR/AGEN.1310827
Antiy-AVL	Trojan/MSIL.Kryptik
Arcabit	Trojan.MSILHeracles.D14FC9
ZoneAlarm	HEUR:Trojan.MSIL.Taskun.gen
Microsoft	Trojan:MSIL/AgentTesla.RCK!MTB
Google	Detected
McAfee	Artemis!C35F4EBFA52E
MAX	malware (ai score=85)
VBA32	CIL.HeapOverride.Heur
Malwarebytes	Trojan.MalPack.PNG
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Backdoor.Win32.WARZONE.YXDF4Z
Rising	Malware.Obfus/MSIL@AI.98 (RDM.MSIL2:Okucsq0zxg9lprBreNMFYg)
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.PWSX!tr
BitDefenderTheta	Gen:NN.ZemsilF.36270.Ym0@a4zGrWf
AVG	Win32:RATX-gen [Trj]
DeepInstinct	MALICIOUS

c35f4ebfa52e9f721f843eac4e01e981.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All