Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x3201	March 17, 2021, 11:10 p.m.	March 17, 2021, 11:12 p.m.

Size	847.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`cca69674ecdc1dcd5ea4446577680d4b`
SHA256	`ab23b0997b7220865636cbe0870dd66eba7dbf4f9a018ba97bbf8c29f5aa8fc5`
CRC32	`0081E99B`
ssdeep	`24576:6AHnh+eWsN3skA4RV1Hom2KXMmHa9Oj+5:Nh+ZkldoPK8Ya9Ow`
Yara	Process_Snapshot_Kill_Zero - Process Kill Zero PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero CryptGenKey_Zero - CryptGenKey Zero FindFirstVolume_Zero - FindFirstVolume Zero inject_thread - Code injection with CreateRemoteThread in a remote process network_http - Communications over HTTP escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger win_registry - Affect system registries win_token - Affect system token win_files_operation - Affect private profile Str_Win32_Winsock2_Library - Match Winsock 2 API library declaration Str_Win32_Wininet_Library - Match Windows Inet API library declaration Str_Win32_Internet_API - Match Windows Inet API call Str_Win32_Http_API - Match Windows Http API call Device_Check_Zero - Device Check Zero IsPE32 - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check AutoIt - www.autoitscript.com/site/autoit/

buildcr.txt "C:\Users\Administrator\AppData\Local\Temp\buildcr.txt"
5600
- powershell.exe powershell -executionpolicy bypass C:\Users\ADMINI~1\AppData\Local\Temp\hZElzAhGU.ps1
  7500

Name	Response	Post-Analysis Lookup
paste.ee	A 104.21.45.223 A 172.67.219.133	172.67.219.133

IP Address	Status	Action
104.21.45.223	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49594 -> 104.21.45.223:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49594 104.21.45.223:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	e8:17:95:f3:a8:85:c4:14:59:ce:21:47:7d:34:50:64:8f:1c:2b:7f

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 17, 2021, 11:09 p.m.	computer_name: WIN7-PC	1	1
GetComputerNameW March 17, 2021, 11:09 p.m.	computer_name: WIN7-PC	1	1
GetComputerNameW March 17, 2021, 11:09 p.m.	computer_name: WIN7-PC	1	1
GetComputerNameW March 17, 2021, 11:09 p.m.	computer_name: WIN7-PC	1	1
GetComputerNameA March 17, 2021, 11:09 p.m.	computer_name: WIN7-PC	1	1
GetComputerNameW March 17, 2021, 11:09 p.m.	computer_name: WIN7-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 17, 2021, 11:09 p.m.			0	0
IsDebuggerPresent March 17, 2021, 11:09 p.m.			0	0

Command line console output was observed (8 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 17, 2021, 11:09 p.m.	buffer: 'C:\Users\ADMINI~1\AppData\Local\Temp\hZElzAhGU.ps1' 용어가 cmdlet, 함수, 스크 console_handle: 0x00000023	1	1
WriteConsoleW March 17, 2021, 11:09 p.m.	buffer: 립트 파일 또는 실행할 수 있는 프로그램 이름으로 인식되지 않습니다. 이름이 정확 console_handle: 0x0000002f	1	1
WriteConsoleW March 17, 2021, 11:09 p.m.	buffer: 한지 확인하고 경로가 포함된 경우 경로가 올바른지 확인한 다음 다시 시도하십시오. console_handle: 0x0000003b	1	1
WriteConsoleW March 17, 2021, 11:09 p.m.	buffer: 위치 줄:1 문자:51 console_handle: 0x00000047	1	1
WriteConsoleW March 17, 2021, 11:09 p.m.	buffer: + C:\Users\ADMINI~1\AppData\Local\Temp\hZElzAhGU.ps1 <<<< console_handle: 0x00000053	1	1
WriteConsoleW March 17, 2021, 11:09 p.m.	buffer: + CategoryInfo : ObjectNotFound: (C:\Users\ADMINI...p\hZElzAhGU.p console_handle: 0x0000005f	1	1
WriteConsoleW March 17, 2021, 11:09 p.m.	buffer: s1:String) [], CommandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW March 17, 2021, 11:09 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 66 events)

Time & API	Arguments	Status	Return
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386978 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386f78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386f78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386f78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386f78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386f38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386f38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386f38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386f38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386f38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386f38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386f38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386ef8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00386eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003870b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003870b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003870b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003870b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003870b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003870b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003870b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003870f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003870f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003870f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003870f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003870f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003870f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003870f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003870f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003870f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 17, 2021, 11:09 p.m.		1	1	0

Performs some HTTP requests (1 event)

request

GET https://paste.ee/r/E1YUZ

Allocates read-write-execute memory (usually to unpack itself) (50 out of 141 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 5600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72322000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02860000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a981000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0179a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a982000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01792000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02921000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02922000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0179b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017d8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x017d9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fc2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fc3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fc4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fc5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fc6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fc7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fc8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fc9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fcb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fcc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fcd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fce000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fcf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fd1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fd2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fd3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

powershell -executionpolicy bypass C:\Users\ADMINI~1\AppData\Local\Temp\hZElzAhGU.ps1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 17, 2021, 11:09 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Creates a suspicious Powershell process (1 event)

option

-executionpolicy bypass

value

Attempts to bypass execution policy

The process powershell.exe wrote an executable file to disk (18 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Program Files\DVD Maker\DVDMaker.exe
file	C:\Windows\System32\unregmp2.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	AIT:Trojan.Nymeria.4409
FireEye	Generic.mg.cca69674ecdc1dcd
CAT-QuickHeal	TrojanDownloader.AutoIt.Andro
McAfee	Artemis!CCA69674ECDC
Malwarebytes	Trojan.MalPack.AutoIt.Generic
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.4ecdc1
Cyren	W32/AutoIt.UF.gen!Eldorado
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	AutoIt:Dropper-DO [Trj]
Kaspersky	Trojan.Win32.Chapak.eyuf
BitDefender	AIT:Trojan.Nymeria.4409
Ad-Aware	AIT:Trojan.Nymeria.4409
Sophos	ML/PE-A
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.TrojanAitInject.ch
Emsisoft	Trojan-Downloader.Autoit (A)
eGambit	Unsafe.AI_Score_77%
Avira	TR/Dldr.Autoit.nmpox
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	AIT:Trojan.Nymeria.4409 (2x)
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C4327034
ALYac	AIT:Trojan.Nymeria.4409
ESET-NOD32	Win32/TrojanDownloader.Autoit.PCB
Rising	Trojan.PSRunner/Autoit!1.CD9C (CLASSIC)
MAX	malware (ai score=80)
AVG	AutoIt:Dropper-DO [Trj]
CrowdStrike	win/malicious_confidence_80% (W)

buildcr.txt

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All