Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 14, 2024, 5:42 p.m.	July 14, 2024, 5:49 p.m.

Size	1.2MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`6cdd7805c45cd8fe70d7ed669060d53c`
SHA256	`030a4af9a4b4d893d16f71a3fa43c40d9ca96692a022a1b9913d05e5c1f38394`
CRC32	`6004F610`
ssdeep	`24576:Sd+lICmcMAYl6S02mDnNYtIfJvdj6Mk1QA11j4RUIUl85:iCUwF1N9OJ7Ur`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

TG-Source-2.exe "C:\Users\test22\AppData\Local\Temp\TG-Source-2.exe"
1476
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABUAEcALQBTAG8AdQByAGMAZQAtADIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUA
  2184

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (9 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 14, 2024, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2024, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2024, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2024, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2024, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2024, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2024, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 14, 2024, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2024, 5:43 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 14, 2024, 5:42 p.m.			0	0
IsDebuggerPresent July 14, 2024, 5:42 p.m.			0	0
IsDebuggerPresent July 14, 2024, 5:43 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (45 events)

Time & API	Arguments	Status	Return
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051f7c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051f7c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051f8c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005197f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519930 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519930 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519930 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519930 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519930 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519930 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519eb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519eb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519eb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519bb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519eb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519eb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519eb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519eb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519eb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519eb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519eb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519cf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519cf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519cf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 14, 2024, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00519cf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 14, 2024, 5:42 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 193 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00480000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00680000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00432000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00467000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00670000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00456000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:42 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00671000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00672000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00673000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00674000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00675000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00676000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00677000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00678000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00679000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0067a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0067b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0067c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0067d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0067e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0067f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bdf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 14, 2024, 5:43 p.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell -ENC UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABUAEcALQBTAG8AdQByAGMAZQAtADIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUA
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABUAEcALQBTAG8AdQByAGMAZQAtADIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUA

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\TG-Source-2.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 14, 2024, 5:43 p.m.	show_type: 0 filepath_r: powershell parameters: -ENC UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABUAEcALQBTAG8AdQByAGMAZQAtADIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUA filepath: powershell	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 14, 2024, 5:43 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 14, 2024, 5:43 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Injuke.16!c
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.Generic.tm
Cylance	Unsafe
VIPRE	Gen:Heur.MSIL.Krypt.11
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 005a49cb1 )
BitDefender	Gen:Heur.MSIL.Krypt.11
K7GW	Trojan-Downloader ( 005a49cb1 )
Cybereason	malicious.5c45cd
Arcabit	Trojan.MSIL.Krypt.11
VirIT	Trojan.Win32.GenusT.DVJZ
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GenKryptik.GJRU
APEX	Malicious
McAfee	Artemis!6CDD7805C45C
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Packer.DotNetRev-10003973-0
Kaspersky	HEUR:Trojan.MSIL.Injuke.gen
Alibaba	Trojan:MSIL/Injuke.964d21ba
NANO-Antivirus	Trojan.Win32.Injuke.jwnvsq
MicroWorld-eScan	Gen:Heur.MSIL.Krypt.11
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:A29s+RxKVbt7JPbFJGSMNA)
Emsisoft	Gen:Heur.MSIL.Krypt.11 (B)
F-Secure	Trojan.TR/Dropper.Gen2
DrWeb	Trojan.Inject4.30942
Zillya	Trojan.Injuke.Win32.29347
TrendMicro	TROJ_GEN.R002C0DGD24
McAfeeD	Real Protect-LS!6CDD7805C45C
FireEye	Generic.mg.6cdd7805c45cd8fe
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.Keylogger.Snake
Webroot	W32.Rogue.Gen
Google	Detected
Avira	TR/Dropper.Gen2
MAX	malware (ai score=86)
Antiy-AVL	Trojan/MSIL.Injuke
Kingsoft	malware.kb.c.1000
Microsoft	Trojan:MSIL/LokiBot.SPC!MTB
ZoneAlarm	HEUR:Trojan.MSIL.Injuke.gen
GData	Gen:Heur.MSIL.Krypt.11
Varist	W32/ABTrojan.MCQS-8923
AhnLab-V3	Malware/Win.Generic.C5419901
BitDefenderTheta	Gen:NN.ZemsilF.36808.mn0@a0qetii
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Crypt.Trojan.DDS
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R002C0DGD24
Tencent	Malware.Win32.Gencirc.13b7ab95

TG-Source-2.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All