Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 18, 2021, 6:05 p.m.	March 18, 2021, 6:08 p.m.

Size	847.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`8c8dc5f35bdf12d4051c5a506e7fb072`
SHA256	`92d2144b7decac2b353200c7cd0a31377aad9da6a1d9cc444eb2e69eb47630b9`
CRC32	`16410200`
ssdeep	`24576:0AHnh+eWsN3skA4RV1Hom2KXMmHajAM5:Dh+ZkldoPK8YajD`
Yara	Process_Snapshot_Kill_Zero - Process Kill Zero PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero CryptGenKey_Zero - CryptGenKey Zero FindFirstVolume_Zero - FindFirstVolume Zero inject_thread - Code injection with CreateRemoteThread in a remote process network_http - Communications over HTTP escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger win_registry - Affect system registries win_token - Affect system token win_files_operation - Affect private profile Str_Win32_Winsock2_Library - Match Winsock 2 API library declaration Str_Win32_Wininet_Library - Match Windows Inet API library declaration Str_Win32_Internet_API - Match Windows Inet API call Str_Win32_Http_API - Match Windows Http API call Device_Check_Zero - Device Check Zero IsPE32 - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check AutoIt - www.autoitscript.com/site/autoit/

SJlhd.jpg "C:\Users\test22\AppData\Local\Temp\SJlhd.jpg"
3332
- powershell.exe powershell -executionpolicy bypass C:\Users\test22\AppData\Roaming\xRfvWGeKz.ps1
  8992

Name	Response	Post-Analysis Lookup
paste.ee	A 104.21.45.223 A 172.67.219.133	104.21.45.223

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
172.67.219.133	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49810 -> 172.67.219.133:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49810 172.67.219.133:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	e8:17:95:f3:a8:85:c4:14:59:ce:21:47:7d:34:50:64:8f:1c:2b:7f

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 18, 2021, 6:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 18, 2021, 6:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 18, 2021, 6:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 18, 2021, 6:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 18, 2021, 6:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 18, 2021, 6:05 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 18, 2021, 6:05 p.m.			0	0
IsDebuggerPresent March 18, 2021, 6:05 p.m.			0	0

Command line console output was observed (6 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 18, 2021, 6:05 p.m.	buffer: The '<' operator is reserved for future use. console_handle: 0x00000023	1	1
WriteConsoleW March 18, 2021, 6:05 p.m.	buffer: At C:\Users\test22\AppData\Roaming\xRfvWGeKz.ps1:2 char:20 console_handle: 0x0000002f	1	1
WriteConsoleW March 18, 2021, 6:05 p.m.	buffer: + <!--[if lt IE 7]> < <<<< html class="no-js ie6 oldie" lang="en-US"> <![endif] console_handle: 0x0000003b	1	1
WriteConsoleW March 18, 2021, 6:05 p.m.	buffer: + CategoryInfo : ParserError: (<:OperatorToken) [], ParseExceptio console_handle: 0x00000053	1	1
WriteConsoleW March 18, 2021, 6:05 p.m.	buffer: n console_handle: 0x0000005f	1	1
WriteConsoleW March 18, 2021, 6:05 p.m.	buffer: + FullyQualifiedErrorId : RedirectionNotSupported console_handle: 0x0000006b	1	1

Uses Windows APIs to generate a cryptographic key (44 events)

Time & API	Arguments	Status	Return
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c4d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c4d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c4d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c110 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c610 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043bcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043bcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043bcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043bcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043bcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043bcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043bcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043bcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043bcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043bcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043bcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043bcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043bcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043bcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c1d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c1d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c1d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c1d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c1d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 18, 2021, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043c1d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 18, 2021, 6:05 p.m.		1	1	0

Performs some HTTP requests (1 event)

request

GET https://paste.ee/r/J0zBu

Allocates read-write-execute memory (usually to unpack itself) (50 out of 146 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a50000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fc91000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e7a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fc92000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ec2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b92000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0223a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ec3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ec4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0224b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02247000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e7b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02232000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02245000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ec5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0223c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ec6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0224c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02233000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02234000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02235000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02236000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02237000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02238000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02239000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c25000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c26000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c27000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c28000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c29000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c2a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c2b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c2c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c2d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c2e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c2f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05020000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05021000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05022000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 18, 2021, 6:05 p.m.	process_identifier: 8992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05023000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\xRfvWGeKz.ps1

Creates a shortcut to an executable file (1 event)

file	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

powershell -executionpolicy bypass C:\Users\test22\AppData\Roaming\xRfvWGeKz.ps1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 18, 2021, 6:05 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Roaming\xRfvWGeKz.ps1

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.8c8dc5f35bdf12d4
CAT-QuickHeal	TrojanDownloader.AutoIt.Andro
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.1062c3
Cyren	W32/AutoIt.UF.gen!Eldorado
APEX	Malicious
Avast	Script:SNH-gen [Trj]
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.TrojanAitInject.ch
eGambit	Unsafe.AI_Score_93%
Cynet	Malicious (score: 100)
ESET-NOD32	a variant of Win32/TrojanDownloader.Autoit.PAP
Rising	Downloader.PSRunner/Autoit!1.D363 (CLASSIC)
AVG	Script:SNH-gen [Trj]
Qihoo-360	HEUR/QVM10.1.F7FF.Malware.Gen

Creates a suspicious Powershell process (1 event)

option

-executionpolicy bypass

value

Attempts to bypass execution policy

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

SJlhd.jpg

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All