Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 10, 2024, 7:56 a.m.	Jan. 10, 2024, 8:07 a.m.

Size	15.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`d4aa07253504503adbe12331ee6149b6`
SHA256	`cea50bb5162cb062f9c1bb03ce6a5d59b2247d0fbeec76e47948b1f90fe5f7cc`
CRC32	`FAA77398`
ssdeep	`384:nopx1TLpuWfBB7x+zbtBc1XyaWTQFPDsyhLWtPpxtfUKTW:418WJ8b4myhitPH9`
PDB Path	C:\Users\Boss\Desktop\Gang - Kopie\Gang\obj\Release\Gang.pdb
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature Antivirus - Contains references to security software Is_DotNET_EXE - (no description) Generic_Malware_Zero - Generic Malware

Gang.exe "C:\Users\test22\AppData\Local\Temp\Gang.exe"
2664
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp\Gang.exe'; Add-MpPreference -ExclusionProcess 'Gang'; Add-MpPreference -ExclusionPath 'C:\Users\test22'"
  2788

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Jan. 10, 2024, 7:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 10, 2024, 7:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 10, 2024, 7:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 10, 2024, 7:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Jan. 10, 2024, 7:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 10, 2024, 7:56 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 10, 2024, 7:56 a.m.			0	0
IsDebuggerPresent Jan. 10, 2024, 7:56 a.m.			0	0
IsDebuggerPresent Jan. 10, 2024, 7:56 a.m.			0	0

Command line console output was observed (30 events)

Time & API	Arguments	Status	Return
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath 'C:\Users\test22\AppData\Local\Temp\Gan console_handle: 0x00000053	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: g.exe'; Add-MpPreference -ExclusionProcess 'Gang'; Add-MpPreference -ExclusionP console_handle: 0x0000005f	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: ath 'C:\Users\test22' console_handle: 0x0000006b	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x00000077	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: mmandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x0000008f	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x000000af	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x000000bb	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x000000c7	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: At line:1 char:96 console_handle: 0x000000d3	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: + Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp\Gang.exe' console_handle: 0x000000df	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: ; Add-MpPreference <<<< -ExclusionProcess 'Gang'; Add-MpPreference -ExclusionP console_handle: 0x000000eb	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: ath 'C:\Users\test22' console_handle: 0x000000f7	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x00000103	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: mmandNotFoundException console_handle: 0x0000010f	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x0000011b	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x0000013b	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x00000147	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x00000153	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: At line:1 char:139 console_handle: 0x0000015f	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: + Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp\Gang.exe' console_handle: 0x0000016b	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: ; Add-MpPreference -ExclusionProcess 'Gang'; Add-MpPreference <<<< -ExclusionP console_handle: 0x00000177	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: ath 'C:\Users\test22' console_handle: 0x00000183	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000018f	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: mmandNotFoundException console_handle: 0x0000019b	1	1
WriteConsoleW Jan. 10, 2024, 7:56 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x000001a7	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bac70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb4b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb4b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb4b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006baab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006baab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006baab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb4b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb4b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb4b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb370 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb4b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb4b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb4b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb4b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb4b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb4b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb4b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 10, 2024, 7:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bb730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

C:\Users\Boss\Desktop\Gang - Kopie\Gang\obj\Release\Gang.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 10, 2024, 7:56 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 160 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2664 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00730000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2664 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01de0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00542000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01d15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01d1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01d17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ec0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01d0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01d07000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:57 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:57 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01d06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 10, 2024, 7:57 a.m.	process_identifier: 2664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fe32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:57 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:57 a.m.	process_identifier: 2664 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00731000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:57 a.m.	process_identifier: 2664 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00735000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:57 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ec1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:57 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00746000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02be0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fa21000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fa22000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02be1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02be2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0226b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02267000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02252000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02265000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0226c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02253000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02254000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02255000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02256000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 10, 2024, 7:56 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02257000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp\Gang.exe'; Add-MpPreference -ExclusionProcess 'Gang'; Add-MpPreference -ExclusionPath 'C:\Users\test22'"
cmdline	powershell.exe -command "Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp\Gang.exe'; Add-MpPreference -ExclusionProcess 'Gang'; Add-MpPreference -ExclusionPath 'C:\Users\test22'"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Jan. 10, 2024, 7:56 a.m.	show_type: 0 filepath_r: powershell.exe parameters: -command "Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp\Gang.exe'; Add-MpPreference -ExclusionProcess 'Gang'; Add-MpPreference -ExclusionPath 'C:\Users\test22'" filepath: powershell.exe	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Jan. 10, 2024, 7:56 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Jan. 10, 2024, 7:56 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Jan. 10, 2024, 7:57 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

Gang.exe tried to sleep 5456407 seconds, actually delayed analysis time by 5456407 seconds

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Disables Windows Security features (1 event)

description

attempts to disable user access control

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA

Gang.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All