Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 17, 2024, 9:04 a.m.	July 17, 2024, 9:11 a.m.

Size	61.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`e2e17ea8d5d471e58cbef7258dfec0e3`
SHA256	`1ef86b1cfa7e45f6602e24a18e76d5e556f781abb0acf18f92eaca95bb53e25d`
CRC32	`236DEC3F`
ssdeep	`768:2l/9Ypu3qBk1q2quJAEtHgRc0LMT1iPcY9nLsmgmuYotCtGB2:29YA3OuJAEH30wTk/9nLsBjyGB2`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

winmod.exe "C:\Users\test22\AppData\Local\Temp\winmod.exe"
2552
- WindowsModificator.exe "C:\Users\test22\AppData\Local\Temp\WindowsModificator.exe"
  2748
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\fakecmd.bat" "
  2820
  - powershell.exe powershell
    2900
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\tmp4551.tmp.bat""
  2984
  - timeout.exe timeout 3
    3060
netsh.exe netsh firewall add allowedprogram "C:\Windows\WindowsHealthChecker.exe" "WindowsHealthChecker.exe" ENABLE
2200

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
88.168.211.65	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 17, 2024, 8:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 17, 2024, 8:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 17, 2024, 8:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 17, 2024, 8:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 17, 2024, 8:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 17, 2024, 8:58 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 17, 2024, 8:57 a.m.			0	0
IsDebuggerPresent July 17, 2024, 8:57 a.m.			0	0
IsDebuggerPresent July 17, 2024, 9:05 a.m.			0	0
IsDebuggerPresent July 17, 2024, 8:58 a.m.			0	0

Command line console output was observed (5 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 17, 2024, 8:58 a.m.	buffer: Windows PowerShell Copyright (C) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x0000000000000017	1	1
WriteConsoleW July 17, 2024, 8:58 a.m.	buffer: PS C:\Users\test22\AppData\Local\Temp> console_handle: 0x000000000000000f	1	1
WriteConsoleW July 17, 2024, 9:05 a.m.	buffer: The batch file cannot be found. console_handle: 0x000000000000000b	1	1
WriteConsoleA July 17, 2024, 9:05 a.m.	buffer: IMPORTANT: Command executed successfully. However, "netsh firewall" is deprecated; use "netsh advfirewall firewall" instead. For more information on using "netsh advfirewall firewall" commands instead of "netsh firewall", see KB article 947709 at http://go.microsoft.com/fwlink/?linkid=121488 . console_handle: 0x00000007	1	1
WriteConsoleA July 17, 2024, 9:05 a.m.	buffer: Ok. console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (43 events)

Time & API	Arguments	Status	Return
CryptExportKey July 17, 2024, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000000fc8f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000000fc810 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000000fc810 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003ccb50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94c630 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94c630 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94c630 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94c630 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94c630 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94c6a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94c6a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94c6a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94c6a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94cbe0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94cbe0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94cbe0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94c940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94c940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94c940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94d0b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94d0b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94d0b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94d0b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94d0b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94d0b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94d0b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94d0b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94d120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94d120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b94d120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000450540 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000450540 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000450700 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000450700 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000450770 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000450770 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000450770 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b96f2a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b96f2a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b96f2a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b96f2a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b96fcb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 17, 2024, 8:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b96fcb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 17, 2024, 8:57 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 240 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 2555904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000700000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000008f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40bb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f00000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a22000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a24000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a24000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a24000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a24000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9427a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9432c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94356000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94330000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9428c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9427b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9429b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9429d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9427c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9428a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:57 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94272000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9428b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 8:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 17, 2024, 9:05 a.m.	process_identifier: 2748 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2024, 9:05 a.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 17, 2024, 9:05 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2024, 9:05 a.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 17, 2024, 9:05 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2024, 9:05 a.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00542000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (4 events)

file	C:\Windows\WindowsHealthChecker.exe
file	C:\Users\test22\AppData\Local\Temp\WindowsModificator.exe
file	C:\Users\test22\AppData\Local\Temp\fakecmd.bat
file	C:\Users\test22\AppData\Local\Temp\tmp4551.tmp.bat

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

powershell

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\fakecmd.bat
file	C:\Windows\WindowsHealthChecker.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\winmod.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW July 17, 2024, 8:58 a.m.	thread_identifier: 2988 thread_handle: 0x0000000000000328 process_identifier: 2984 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\tmp4551.tmp.bat" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000000000003a4	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00007000', u'virtual_address': u'0x00002000', u'entropy': 7.197795747480427, u'name': u'.text', u'virtual_size': u'0x00006e24'}

entropy

7.19779574748

description

A section with a high entropy has been found

entropy

0.459016393443

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 17, 2024, 9:05 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 17, 2024, 8:58 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

88.168.211.65

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation July 17, 2024, 9:05 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

WindowsModificator.exe tried to sleep 2728177 seconds, actually delayed analysis time by 2728177 seconds

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

88.168.211.65:6522

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

Bkav	W32.AIDetectMalware.CS
Elastic	malicious (high confidence)
ALYac	IL:Trojan.MSILZilla.19217
Cylance	Unsafe
VIPRE	IL:Trojan.MSILZilla.19217
BitDefender	IL:Trojan.MSILZilla.19217
Cybereason	malicious.8d5d47
Arcabit	IL:Trojan.MSILZilla.D4B11
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDropper.Agent.FOV
APEX	Malicious
Avast	Win32:InjectorX-gen [Trj]
ClamAV	Win.Packed.Msilmamut-10007182-0
Kaspersky	HEUR:Trojan.Win32.Generic
MicroWorld-eScan	IL:Trojan.MSILZilla.19217
Emsisoft	IL:Trojan.MSILZilla.19217 (B)
F-Secure	Trojan.TR/ATRAPS.Gen
DrWeb	Trojan.MulDropNET.65
McAfeeD	Real Protect-LS!E2E17EA8D5D4
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.e2e17ea8d5d471e5
Sophos	Troj/Mdrop-JVT
Ikarus	Trojan.MSIL.Injector
Google	Detected
Avira	TR/ATRAPS.Gen
Kingsoft	malware.kb.c.1000
Microsoft	Trojan:MSIL/XWormRAT.A!MTB
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	IL:Trojan.MSILZilla.19217
Varist	W32/MSIL_Agent.BUD.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.C5052738
BitDefenderTheta	Gen:NN.ZemsilF.36808.dm0@am1OZDi
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Dropper.MSIL.Generic
Tencent	Win32.Trojan.Generic.Zmhl
MAX	malware (ai score=84)
Fortinet	MSIL/Agent.FOV!tr
AVG	Win32:InjectorX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

winmod.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All