Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 14, 2024, 11:17 a.m.	Oct. 14, 2024, 11:21 a.m.

Size	1.7MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`0d43698dffc5ee744f805a699df25c00`
SHA256	`de14c3b860519dc781aaee813d4fa3adc67d7653c544327f8d26d5b386564712`
CRC32	`F0B37226`
ssdeep	`24576:s7FUDowAyrTVE3U5F/ZGqKUA4Kic6QL3E2vVsjECUAQT45deRV9RY:sBuZrEUMz4KIy029s4C1eH9y`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format OS_Processor_Check_Zero - OS Processor Check

utility-inst.exe "C:\Users\test22\AppData\Local\Temp\utility-inst.exe"
2568
- utility-inst.tmp "C:\Users\test22\AppData\Local\Temp\is-PE1DL.tmp\utility-inst.tmp" /SL5="$6012C,922170,832512,C:\Users\test22\AppData\Local\Temp\utility-inst.exe"
  2620
  - cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\test22\AppData\Local\Temp\is-76EOH.tmp\do.bat""
    2776
    - powershell.exe Powershell.exe -WindowStyle hidden -executionpolicy remotesigned -File onesave.ps1
      2840
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
auntberry.xyz	A 104.21.67.155 A 172.67.177.240	104.21.67.155

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.177.240	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49164 -> 172.67.177.240:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49164 172.67.177.240:443	C=US, O=Google Trust Services, CN=WE1	CN=auntberry.xyz	57:d6:90:3c:ab:9e:4e:4b:bc:5f:e9:08:a7:22:28:d6:59:f3:aa:f8

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 14, 2024, 11:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 14, 2024, 11:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 14, 2024, 11:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 14, 2024, 11:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 14, 2024, 11:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 14, 2024, 11:17 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 14, 2024, 11:17 a.m.			0	0
IsDebuggerPresent Oct. 14, 2024, 11:17 a.m.			0	0

Command line console output was observed (6 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 14, 2024, 11:17 a.m.	buffer: The "=" operator is missing after a named argument. console_handle: 0x00000023	1	1
WriteConsoleW Oct. 14, 2024, 11:17 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\is-76EOH.tmp\onesave.ps1:4 char:42 console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 14, 2024, 11:17 a.m.	buffer: + [CmdletBinding(SupportsShouldProcess) <<<< ] console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 14, 2024, 11:17 a.m.	buffer: + CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordEx console_handle: 0x00000047	1	1
WriteConsoleW Oct. 14, 2024, 11:17 a.m.	buffer: ception console_handle: 0x00000053	1	1
WriteConsoleW Oct. 14, 2024, 11:17 a.m.	buffer: + FullyQualifiedErrorId : MissingEqualsInNamedArgument console_handle: 0x0000005f	1	1

Uses Windows APIs to generate a cryptographic key (44 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd4f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fdab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fdab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fdab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fddf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fddf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fddf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fddf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fddf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fddf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fdab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fdab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fdab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fdab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fdab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fdab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd5b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fdab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fdab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fdab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fdab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fdab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fdab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fdab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00685538 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00685538 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 14, 2024, 11:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005fd9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 14, 2024, 11:17 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.itext
section	.didata

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 14, 2024, 11:17 a.m.	stacktrace: TMethodImplementationIntercept+0x1fcbea dbkFCallWrapperAddr-0x21bde utility-inst+0x2b2a62 @ 0x6b2a62 TMethodImplementationIntercept+0x1fcbea dbkFCallWrapperAddr-0x21bde utility-inst+0x2b2a62 @ 0x6b2a62 TMethodImplementationIntercept+0x2108fc dbkFCallWrapperAddr-0xdecc utility-inst+0x2c6774 @ 0x6c6774 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1637804 registers.edi: 0 registers.eax: 1637804 registers.ebp: 1637884 registers.edx: 0 registers.ebx: 2 registers.esi: 2 registers.ecx: 7	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Oct. 14, 2024, 11:17 a.m.

stacktrace:

TMethodImplementationIntercept+0x1fcbea dbkFCallWrapperAddr-0x21bde utility-inst+0x2b2a62 @ 0x6b2a62
TMethodImplementationIntercept+0x1fcbea dbkFCallWrapperAddr-0x21bde utility-inst+0x2b2a62 @ 0x6b2a62
TMethodImplementationIntercept+0x2108fc dbkFCallWrapperAddr-0xdecc utility-inst+0x2c6774 @ 0x6c6774
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1637804
registers.edi: 0
registers.eax: 1637804
registers.ebp: 1637884
registers.edx: 0
registers.ebx: 2
registers.esi: 2
registers.ecx: 7

Performs some HTTP requests (2 events)

request	HEAD https://auntberry.xyz/pe/start/index.php?a=2910&p=4134&t=50784292
request	GET https://auntberry.xyz/pe/start/index.php?a=2910&p=4134&t=50784292

Allocates read-write-execute memory (usually to unpack itself) (50 out of 152 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 745472 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 73728 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733b2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733b2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:18 a.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000046c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02990000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72031000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0205a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72032000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02052000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02062000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0208a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02063000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02064000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0209b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02097000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0205b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02082000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02095000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02065000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0208c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02940000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02066000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0209c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02083000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02084000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02085000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02086000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02087000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02088000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02089000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bcb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2024, 11:17 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bcc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\is-76EOH.tmp\idp.dll
file	C:\Users\test22\AppData\Local\Temp\is-76EOH.tmp\do.bat
file	C:\Users\test22\AppData\Local\Temp\is-76EOH.tmp\onesave.ps1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-76EOH.tmp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	Powershell.exe -WindowStyle hidden -executionpolicy remotesigned -File onesave.ps1
cmdline	"C:\Windows\system32\cmd.exe" /C ""C:\Users\test22\AppData\Local\Temp\is-76EOH.tmp\do.bat""

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\is-PE1DL.tmp\utility-inst.tmp
file	C:\Users\test22\AppData\Local\Temp\is-76EOH.tmp\idp.dll

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Oct. 14, 2024, 11:17 a.m.	thread_identifier: 2844 thread_handle: 0x00000088 process_identifier: 2840 current_directory: C:\Users\test22\AppData\Local\Temp\is-76EOH.tmp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: Powershell.exe -WindowStyle hidden -executionpolicy remotesigned -File onesave.ps1 filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000084	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 14, 2024, 11:17 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-PE1DL.tmp\utility-inst.tmp

Creates a suspicious Powershell process (1 event)

option

-windowstyle hidden

value

Attempts to execute command with a hidden window

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.OffLoader.4!c
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Trojan.tc
ALYac	Trojan.GenericKD.74299143
Cylance	Unsafe
VIPRE	Trojan.GenericKD.74299143
Sangfor	Downloader.Win32.Agent.Vmeu
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	Trojan.GenericKD.74299143
Arcabit	Trojan.Generic.D46DB707
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	Win32/TrojanDownloader.Agent.HVC
APEX	Malicious
Avast	FileRepMalware [Misc]
Kaspersky	UDS:DangerousObject.Multi.Generic
Alibaba	TrojanDownloader:Win32/OffLoader.c9de47de
MicroWorld-eScan	Trojan.GenericKD.74299143
Emsisoft	Trojan.GenericKD.74299143 (B)
F-Secure	Trojan.TR/Redcap.zoisf
TrendMicro	Trojan.Win32.AMADEY.YXEJKZ
McAfeeD	ti!DE14C3B86051
CTX	exe.trojan.offloader
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
FireEye	Trojan.GenericKD.74299143
Google	Detected
Avira	TR/Redcap.zoisf
Kingsoft	Win32.Troj.Unknown.a
Microsoft	Trojan:Win32/Phonzy.C!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.GenericKD.74299143
Varist	W32/OffLoader.A.gen!Eldorado
AhnLab-V3	Malware/Win.Generic.C5681656
McAfee	Artemis!0D43698DFFC5
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware/Suspicious
Ikarus	Win32.Outbreak
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXEJKZ
Tencent	Win32.Trojan-Downloader.Offloader.Jmnw
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Riskware/Agent
AVG	FileRepMalware [Misc]
Paloalto	generic.ml

utility-inst.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All