Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 4, 2021, 10:10 a.m.	Oct. 4, 2021, 10:12 a.m.

Size	901.4KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
MD5	`17fe15c3f5f28d07fa885bf7099163ef`
SHA256	`f71af69d5802a003452e0401c936c344911f215d6d8a9f34359b9d1cdc758542`
CRC32	`23A505A8`
ssdeep	`24576:t20gPgFK2MQxAVBbIcXQzkUWSQshQwxB7yCE:EKpxAjIEsrhxBQ`
PDB Path	d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

downloadmanager.exe "C:\Users\test22\AppData\Local\Temp\downloadmanager.exe"
1136
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\jdksfhoisg\397598.vbs" /f=CREATE_NO_WINDOW install.cmd
  2236
  - cmd.exe cmd /c ""C:\jdksfhoisg\vut1.bat" "
    1644
    - timeout.exe timeout 7
      1376
    - zcomue.com "zcomue.com" e -pjhbObbsd8dh dfshg.rar
      808
    - timeout.exe timeout 6
      2544
    - wscript.exe "C:\Windows\System32\WScript.exe" "C:\jdksfhoisg\88e.vbs"
      2292
      - cmd.exe cmd /c ""C:\jdksfhoisg\77tor.bat" "
        900
        
        attrib.exe attrib +s +h "C:\jdksfhoisg"
        2968
        
        timeout.exe timeout 2
        568
    - timeout.exe timeout 8
      1900

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (20 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: 'Generetik' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: The batch file cannot be found. console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: Waiting for 7 console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: RAR 5.50 beta 1 x86 Copyright (c) 1993-2017 Alexander Roshal 12 Apr 2017 console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: Trial version Type 'rar -?' for help console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: Extracting from dfshg.rar console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: Extracting 88e.vbs console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: OK console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: Extracting 77tor.bat console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: OK console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: Extracting SISZEKO.exe console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: OK console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: All OK console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: Waiting for 6 console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: Waiting for 8 console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: Waiting for 2 console_handle: 0x00000007	1	1
WriteConsoleW Oct. 4, 2021, 10:10 a.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1

This executable has a PDB path (1 event)

pdb_path

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 4, 2021, 10:10 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 62 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73621000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736d2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73791000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733b3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73281000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76cc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75461000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x771e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73621000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736d2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73791000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75491000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73121000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74be1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76ba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76cc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75461000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x771e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73281000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73721000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76cc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75461000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 1644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x771e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76cc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75461000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x771e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73681000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73511000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73461000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735a2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2021, 10:10 a.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73661000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (6 events)

file	C:\jdksfhoisg\397598.vbs
file	C:\jdksfhoisg\77tor.bat
file	C:\jdksfhoisg\88e.vbs
file	C:\jdksfhoisg\zcomue.com
file	C:\jdksfhoisg\SISZEKO.exe
file	C:\jdksfhoisg\vut1.bat

Drops a binary and executes it (5 events)

file	C:\jdksfhoisg\397598.vbs
file	C:\jdksfhoisg\zcomue.com
file	C:\jdksfhoisg\88e.vbs
file	C:\jdksfhoisg\77tor.bat
file	C:\jdksfhoisg\SISZEKO.exe

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Oct. 4, 2021, 10:10 a.m.	show_type: 0 filepath_r: vut1.bat parameters: filepath: vut1.bat	1	1	0
ShellExecuteExW Oct. 4, 2021, 10:10 a.m.	show_type: 0 filepath_r: C:\jdksfhoisg\77tor.bat parameters: filepath: C:\jdksfhoisg\77tor.bat	1	1	0

Yara rule detected in process memory (16 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

attrib +s +h "C:\jdksfhoisg"

File has been identified by 14 AntiVirus engines on VirusTotal as malicious (14 events)

Bkav	W32.AIDetect.malware2
FireEye	Generic.mg.17fe15c3f5f28d07
Cybereason	malicious.263a67
Symantec	Trojan.Gen.2
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Ikarus	Trojan.Inject
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
McAfee	Artemis!17FE15C3F5F2
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_70% (W)

One or more non-whitelisted processes were created (4 events)

parent_process	wscript.exe	martian_process	C:\jdksfhoisg\77tor.bat
parent_process	wscript.exe	martian_process	"C:\jdksfhoisg\77tor.bat"
parent_process	wscript.exe	martian_process	vut1.bat
parent_process	wscript.exe	martian_process	"C:\jdksfhoisg\vut1.bat"

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1136 resumed a thread in remote process 2236
Process injection	Process 1644 resumed a thread in remote process 2292
NtResumeThread Oct. 4, 2021, 10:10 a.m.	thread_handle: 0x000002e0 suspend_count: 1 process_identifier: 2236	1	0	0
NtResumeThread Oct. 4, 2021, 10:10 a.m.	thread_handle: 0x00000278 suspend_count: 1 process_identifier: 2292	1	0	0

The process wscript.exe wrote an executable file to disk (1 event)

file	C:\Windows\SysWOW64\wscript.exe

downloadmanager.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All