Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 14, 2024, 5:42 p.m.	July 14, 2024, 5:53 p.m.

Size	1.5MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`db361206702d61f0beff5f87508152e5`
SHA256	`333bb61be5eb4be9c261a3f99c144cf7be0cee3c00898c1ac6a6c886469e1ab1`
CRC32	`C6F2541E`
ssdeep	`24576:Bj8PZOWNKI9g7XEJ859lSYbd0OW5FwBy47rKDBhU6OC2nfLyf7MBTPanM:BEQWlm685KGd0Ogwj7WDk6zOba`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

Ndhqvdmn-1.exe "C:\Users\test22\AppData\Local\Temp\Ndhqvdmn-1.exe"
2588
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABOAGQAaABxAHYAZABtAG4ALQAxAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlAA==
  2800

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (9 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 14, 2024, 5:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2024, 5:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2024, 5:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2024, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2024, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2024, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2024, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 14, 2024, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2024, 5:43 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 14, 2024, 5:42 p.m.			0	0
IsDebuggerPresent July 14, 2024, 5:42 p.m.			0	0
IsDebuggerPresent July 14, 2024, 5:43 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey July 14, 2024, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0072b1e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0072b1e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0072b2e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0072b2e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b59e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b6168 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b6168 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b6168 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b6168 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b6168 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b6168 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b59a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b59a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b59a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b55a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b62e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b62e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b62e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b62e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b62e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b62e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b62e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b62e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b62e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b62e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b62e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b62e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b62e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b62e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b6228 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b6228 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b6228 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b6228 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 14, 2024, 5:42 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 270 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00430000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00450000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ee000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a62000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a63000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a64000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a65000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a66000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a67000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a68000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d0f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a69000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a1e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a1f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b03000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b04000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b05000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b07000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b08000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b09000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell -ENC UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABOAGQAaABxAHYAZABtAG4ALQAxAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlAA==
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABOAGQAaABxAHYAZABtAG4ALQAxAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlAA==

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\Ndhqvdmn-1.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 14, 2024, 5:42 p.m.	show_type: 0 filepath_r: powershell parameters: -ENC UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABOAGQAaABxAHYAZABtAG4ALQAxAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlAA== filepath: powershell	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00177800', u'virtual_address': u'0x00002000', u'entropy': 7.999753136401402, u'name': u'.text', u'virtual_size': u'0x00177758'}

entropy

7.9997531364

description

A section with a high entropy has been found

entropy

0.998338318378

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 14, 2024, 5:42 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 14, 2024, 5:43 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Noon.l!c
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.Generic.tc
McAfee	Artemis!DB361206702D
Cylance	Unsafe
VIPRE	Trojan.GenericKD.65311015
Sangfor	Downloader.Msil.Agent.V2rz
K7AntiVirus	Trojan-Downloader ( 0059e2d71 )
BitDefender	Trojan.GenericKD.65311015
K7GW	Trojan-Downloader ( 0059e2d71 )
Cybereason	malicious.6702d6
Arcabit	Trojan.Generic.D3E49127
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.OPG
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan-Spy.MSIL.Noon.gen
NANO-Antivirus	Trojan.Win32.Noon.jupmlu
MicroWorld-eScan	Trojan.GenericKD.65311015
Rising	Malware.Obfus/MSIL@AI.89 (RDM.MSIL2:sFGwILIsZOFXZ7RiJ3eHMA)
Emsisoft	Trojan.GenericKD.65311015 (B)
F-Secure	Heuristic.HEUR/AGEN.1311103
DrWeb	Trojan.Siggen19.32881
Zillya	Trojan.Noon.Win32.26297
TrendMicro	TROJ_GEN.R002C0DGD24
McAfeeD	Real Protect-LS!DB361206702D
FireEye	Generic.mg.db361206702d61f0
Sophos	Mal/Generic-S
Ikarus	Trojan-Downloader.MSIL.Agent
Webroot	W32.Trojan.Gen
Google	Detected
Avira	HEUR/AGEN.1311103
MAX	malware (ai score=88)
Antiy-AVL	Trojan[Spy]/MSIL.Noon
Kingsoft	malware.kb.c.1000
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Trojan:MSIL/AgentTesla.BAU!MTB
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Noon.gen
GData	Trojan.GenericKD.65311015
Varist	W32/MSIL_Kryptik.IUB.gen!Eldorado
AhnLab-V3	Trojan/Win.MSILZilla.C5367016
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZemsilF.36808.En0@a4ElL5n
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Trojan.Downloader.DDS
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002C0DGD24
Tencent	Malware.Win32.Gencirc.13b6598f

Ndhqvdmn-1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All