Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 19, 2024, 2:37 p.m.	June 19, 2024, 2:39 p.m.

Size	527.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`8af55ab72dc0c45e52c7af0752cbbc4a`
SHA256	`243e063270a045632b688cf570c2e9a8b4c3d2705726ad6b2ebf312e9f278e0e`
CRC32	`06D9D9D9`
ssdeep	`6144:BgORa7dr1OtWKwT0Udc5naEL6UR+cBKzeIyA5rPbFoBxD0orjcwg07CaV+54Tba5:BgRYJD3naELvvBWDbCjworjd/7C0+63M`
Yara	Malicious_Library_Zero - Malicious_Library NSIS_Installer - Null Soft Installer PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

gui.exe "C:\Users\test22\AppData\Local\Temp\gui.exe"
2560
- powershell.exe "powershell.exe" -windowstyle hidden "$Uhyggestemninger=Get-Content 'C:\Users\test22\AppData\Local\Kbmandslivenes110\jesuitical\colourama\Blaze.Udk';$Unyieldingly=$Uhyggestemninger.SubString(54584,3);.$Unyieldingly($Uhyggestemninger)"
  2676
  - cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
    2776

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (8 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 19, 2024, 2:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 2:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 2:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 2:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 19, 2024, 2:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 2:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 2:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 2:37 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 19, 2024, 2:37 p.m.			0	0

Command line console output was observed (6 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 19, 2024, 2:37 p.m.	buffer: Cannot convert argument "0", with value: "", for "Invoke" to type "System.IntPt console_handle: 0x00000023	1	1
WriteConsoleW June 19, 2024, 2:37 p.m.	buffer: r": "Cannot convert null to type "System.IntPtr"." console_handle: 0x0000002f	1	1
WriteConsoleW June 19, 2024, 2:37 p.m.	buffer: At line:1 char:23 console_handle: 0x0000003b	1	1
WriteConsoleW June 19, 2024, 2:37 p.m.	buffer: + $Blegselleriers.Invoke <<<< ($Witteboom, 0) console_handle: 0x00000047	1	1
WriteConsoleW June 19, 2024, 2:37 p.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodException console_handle: 0x00000053	1	1
WriteConsoleW June 19, 2024, 2:37 p.m.	buffer: + FullyQualifiedErrorId : MethodArgumentConversionInvalidCastArgument console_handle: 0x0000005f	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 51 events)

Time & API	Arguments	Status	Return
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536c88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536c88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536c88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536c88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536c88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536c88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005364c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005364c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005364c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005360c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536d48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536d48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c1610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c1610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c1610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c1610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c1610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7b90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7b90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7b90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7b90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 2:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7b90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 19, 2024, 2:37 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (50 out of 182 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724a1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0271a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0276b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02767000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02712000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02765000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0271c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0276c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02713000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02714000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02715000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02716000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02717000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02718000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02719000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05030000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05031000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05032000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05033000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05034000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05035000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05036000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05037000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05038000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05039000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05040000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05041000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 2:37 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Kbmandslivenes110\jesuitical\colourama\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
cmdline	"powershell.exe" -windowstyle hidden "$Uhyggestemninger=Get-Content 'C:\Users\test22\AppData\Local\Kbmandslivenes110\jesuitical\colourama\Blaze.Udk';$Unyieldingly=$Uhyggestemninger.SubString(54584,3);.$Unyieldingly($Uhyggestemninger)"

Executes one or more WMI queries (1 event)

wmi	select * from Win32_Process

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 19, 2024, 2:37 p.m.	thread_identifier: 2680 thread_handle: 0x00000250 process_identifier: 2676 current_directory: filepath: track: 1 command_line: "powershell.exe" -windowstyle hidden "$Uhyggestemninger=Get-Content 'C:\Users\test22\AppData\Local\Kbmandslivenes110\jesuitical\colourama\Blaze.Udk';$Unyieldingly=$Uhyggestemninger.SubString(54584,3);.$Unyieldingly($Uhyggestemninger)" filepath_r: stack_pivoted: 0 creation_flags: 67108864 (CREATE_DEFAULT_ERROR_MODE) inherit_handles: 0 process_handle: 0x0000001c	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 19, 2024, 2:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess June 19, 2024, 2:37 p.m.	status_code: 0xffffffff process_identifier: 2560 process_handle: 0x0000045c		0	0
NtTerminateProcess June 19, 2024, 2:37 p.m.	status_code: 0xffffffff process_identifier: 2560 process_handle: 0x0000045c	1	0	0

One or more non-whitelisted processes were created (1 event)

parent_process

powershell.exe

martian_process

"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"

Creates a suspicious Powershell process (1 event)

option

-windowstyle hidden

value

Attempts to execute command with a hidden window

The process powershell.exe wrote an executable file to disk (21 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Windows\System32\cmd.exe

File has been identified by 26 AntiVirus engines on VirusTotal as malicious (26 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.ins
VirIT	Trojan.Win32.GenusT.DXOF
Elastic	malicious (high confidence)
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 99)
MicroWorld-eScan	Trojan.Generic.36441375
Emsisoft	Trojan.Generic.36441375 (B)
F-Secure	Trojan.TR/Injector.mrxqi
DrWeb	PowerShell.Siggen.2046
McAfeeD	ti!243E063270A0
Sophos	Mal/Generic-S
Ikarus	Trojan.PS.Agent
Avira	TR/Injector.mrxqi
Antiy-AVL	Trojan/Win32.Wacatac.b
Kingsoft	Win32.Troj.Unknown.a
ZoneAlarm	UDS:DangerousObject.Multi.Generic
AhnLab-V3	Downloader/Win.GuLoader.C5642131
MAX	malware (ai score=80)
Fortinet	NSIS/Injector.CSC!tr
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)
alibabacloud	Trojan:Win/Injector.CBI

gui.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All