Summary

Category	Machine	Started	Completed
ARCHIVE	s1_win7_x6401	April 3, 2023, 5:56 p.m.	April 3, 2023, 5:57 p.m.

Archive Order_list.exe @ Order_list.tbz2

Size	1.0MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`c9b73b9cb9d53c2fd94a163ed584e553`
SHA1	`7ac251ab83d2909fcc96149945dc09346ebd3cf9`
SHA256	`0dda587b564a15ff8c1ee8eea3c4c592850231124a321ba417383c44b07c7fb7`
SHA512	`7b660b18d37b53b29bfc1fffb65d9ed891958e68b77939f863600243d26a2edf9d1662fe6fa5d78d8356253d7df7b460175c8fbc5a951e42f4a2b9f2370183f0`
CRC32	`CCDD2CF6`
ssdeep	`24576:lTbBv5rUqDOm6k1xCsIyTxxmm/FpXwF+XgOPo+zEU:PBXOmlCxkV/FpW+XgOAQ`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) PE_Header_Zero - PE File Signature

Order_list.exe "C:\Users\test22\AppData\Local\Temp\Order_list.exe"
2572
- wscript.exe "C:\Windows\System32\wscript.exe" Update-sw.d.vbe
  2708
  - bdhxootuiw.pif "C:\Users\test22\AppData\Local\Temp\hqtt\bdhxootuiw.pif" nuadwuxip.dll
    2840
    - RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2948

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 3, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 3, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 3, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 3, 2023, 5:57 p.m.			0	0
IsDebuggerPresent April 3, 2023, 5:57 p.m.			0	0
IsDebuggerPresent April 3, 2023, 5:57 p.m.			0	0
IsDebuggerPresent April 3, 2023, 5:57 p.m.			0	0
IsDebuggerPresent April 3, 2023, 5:57 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey April 3, 2023, 5:57 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c8b808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 3, 2023, 5:57 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c8b848 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 3, 2023, 5:57 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c8b848 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 3, 2023, 5:57 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (30 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 3, 2023, 5:56 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b50000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72311000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72312000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02670000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02760000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c43000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW April 3, 2023, 5:57 p.m.	total_number_of_free_bytes: 13199319040 free_bytes_available: 13199319040 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Creates (office) documents on the filesystem (16 events)

file	C:\Users\test22\AppData\Local\Temp\hqtt\rxjtpf.docx
file	C:\Users\test22\AppData\Local\Temp\hqtt\anti.pdf
file	C:\Users\test22\temp\mkmnleo.docx
file	C:\Users\test22\AppData\Local\Temp\hqtt\lech.ppt
file	C:\Users\test22\AppData\Local\Temp\hqtt\tfimtv.docx
file	C:\Users\test22\AppData\Local\Temp\hqtt\xpdrgeckk.xls
file	C:\Users\test22\AppData\Local\Temp\hqtt\xppfrspasi.pdf
file	C:\Users\test22\AppData\Local\Temp\hqtt\mkmnleo.docx
file	C:\Users\test22\AppData\Local\Temp\hqtt\ewkisxoe.docx
file	C:\Users\test22\AppData\Local\Temp\hqtt\dokfwbssxw.docx
file	C:\Users\test22\AppData\Local\Temp\hqtt\stkhndf.docx
file	C:\Users\test22\AppData\Local\Temp\hqtt\wislomv.ppt
file	C:\Users\test22\AppData\Local\Temp\hqtt\cjlicqmr.ppt
file	C:\Users\test22\AppData\Local\Temp\hqtt\lvgql.ppt
file	C:\Users\test22\AppData\Local\Temp\hqtt\gwqcmr.docx
file	C:\Users\test22\AppData\Local\Temp\hqtt\ldaue.ppt

Creates executable files on the filesystem (8 events)

file	C:\Users\test22\AppData\Local\Temp\hqtt\Update-sw.d.vbe
file	C:\Users\test22\AppData\Local\Temp\hqtt\ebilbwno.exe
file	C:\Users\test22\AppData\Local\Temp\hqtt\bjcnuqqaeu.exe
file	C:\Users\test22\AppData\Local\Temp\hqtt\wgtapgibjw.dll
file	C:\Users\test22\AppData\Local\Temp\hqtt\nuadwuxip.dll
file	C:\Users\test22\AppData\Local\Temp\hqtt\ctujj.dll
file	C:\Users\test22\AppData\Local\Temp\hqtt\bdhxootuiw.pif
file	C:\Users\test22\AppData\Local\Temp\hqtt\jpgvjofvw.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\hqtt\bdhxootuiw.pif

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 3, 2023, 5:57 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (50 out of 501 events)

url	http://www.expedia.com/favicon.ico
url	http://uk.ask.com/favicon.ico
url	http://www.priceminister.com/
url	http://ru.wikipedia.org/
url	http://www.merlin.com.pl/favicon.ico
url	http://www.cnet.com/favicon.ico
url	http://search.nifty.com/
url	http://ns.adobe.com/exif/1.0/
url	http://www.etmall.com.tw/
url	http://search.goo.ne.jp/
url	http://fr.wikipedia.org/favicon.ico
url	http://busca.estadao.com.br/favicon.ico
url	http://search.hanafos.com/favicon.ico
url	http://search.chol.com/favicon.ico
url	http://purl.org/rss/1.0/
url	http://amazon.fr/
url	http://www.amazon.co.jp/
url	http://www.mtv.com/favicon.ico
url	http://busqueda.aol.com.mx/
url	http://search.live.com/results.aspx?FORM=SOLTDF
url	http://msdn.microsoft.com/
url	http://msdn.microsoft.com/workshop/security/privacy/overview/privacyimportxml.asp)
url	http://www.sify.com/favicon.ico
url	http://yellowpages.superpages.com/
url	http://suche.freenet.de/
url	http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson
url	http://search.aol.com/
url	http://browse.guardian.co.uk/
url	http://www.mercadolibre.com.mx/
url	http://www.asharqalawsat.com/
url	http://www.facebook.com/
url	http://si.wikipedia.org/favicon.ico
url	http://www.rtl.de/favicon.ico
url	http://search.msn.com/results.aspx?q=
url	http://www.microsoft.com/pki/certs/MicrosoftWinPCA.crt0
url	http://search.naver.com/favicon.ico
url	http://en.wikipedia.org/favicon.ico
url	http://si.wikipedia.org/w/api.php?action=opensearch
url	http://udn.com/favicon.ico
url	http://rover.ebay.com
url	http://search.ebay.fr/
url	http://www.univision.com/
url	http://pt.wikipedia.org/w/api.php?action=opensearch
url	http://it.wikipedia.org/favicon.ico
url	http://uk.ask.com/
url	http://www.google.co.uk/
url	http://cnweb.search.live.com/results.aspx?q=
url	http://www.google.cz/
url	http://www.google.co.jp/
url	http://search.ebay.co.uk/

Yara rule detected in process memory (50 out of 123 events)

description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications use DNS	rule	Network_DNS
description	task schedule	rule	schtasks_Zero
description	Hijack network configuration	rule	Hijack_Network
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Steal credential	rule	local_credential_Steal
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Communications over P2P network	rule	Network_P2P_Win
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications use DNS	rule	Network_DNS
description	task schedule	rule	schtasks_Zero
description	Hijack network configuration	rule	Hijack_Network
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: c09b560ef92c670df2a4475ed6bdaf31970b0e09

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 5869568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00410000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000130	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome

reg_value

C:\Users\test22\AppData\Local\Temp\hqtt\BDHXOO~1.PIF C:\Users\test22\AppData\Local\Temp\hqtt\NUADWU~1.DLL

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\hqtt\bdhxootuiw.pif

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory April 3, 2023, 5:57 p.m.	buffer: ÿÿÿÿAû~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 2948 process_handle: 0x00000130	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2840 called NtSetContextThread to modify thread in remote process 2948
NtSetContextThread April 3, 2023, 5:57 p.m.	registers.eip: 1995571652 registers.esp: 4258256 registers.edi: 0 registers.eax: 4308478 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000128 process_identifier: 2948	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	bdhxootuiw.pif nuadwuxip.dll
parent_process	wscript.exe				martian_process	"C:\Users\test22\AppData\Local\Temp\hqtt\bdhxootuiw.pif" nuadwuxip.dll

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (1 event)

Time & API	Arguments	Status	Return	Repeated
CryptHashData April 3, 2023, 5:57 p.m.	buffer: 2test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x00c8b488 flags: 0	1	1	0

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2572 resumed a thread in remote process 2708
Process injection	Process 2840 resumed a thread in remote process 2948
NtResumeThread April 3, 2023, 5:57 p.m.	thread_handle: 0x000002c0 suspend_count: 1 process_identifier: 2708	1	0	0
NtResumeThread April 3, 2023, 5:57 p.m.	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 2948	1	0	0

The process wscript.exe wrote an executable file to disk (1 event)

file	C:\Windows\SysWOW64\wscript.exe

Executed a process and injected code into it, probably while unpacking (16 events)

Time & API	Arguments	Status	Return
NtResumeThread April 3, 2023, 5:56 p.m.	thread_handle: 0x0000017c suspend_count: 1 process_identifier: 2572	1	0
CreateProcessInternalW April 3, 2023, 5:57 p.m.	thread_identifier: 2712 thread_handle: 0x000002c0 process_identifier: 2708 current_directory: C:\Users\test22\AppData\Local\temp\hqtt filepath: C:\Windows\System32\wscript.exe track: 1 command_line: "C:\Windows\System32\wscript.exe" Update-sw.d.vbe filepath_r: C:\Windows\System32\wscript.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002c8	1	1
NtResumeThread April 3, 2023, 5:57 p.m.	thread_handle: 0x000002c0 suspend_count: 1 process_identifier: 2708	1	0
CreateProcessInternalW April 3, 2023, 5:57 p.m.	thread_identifier: 2844 thread_handle: 0x000003d4 process_identifier: 2840 current_directory: C:\Users\test22\AppData\Local\temp\hqtt filepath: C:\Users\test22\AppData\Local\Temp\hqtt\bdhxootuiw.pif track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\hqtt\bdhxootuiw.pif" nuadwuxip.dll filepath_r: C:\Users\test22\AppData\Local\Temp\hqtt\bdhxootuiw.pif stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003c8	1	1
CreateProcessInternalW April 3, 2023, 5:57 p.m.	thread_identifier: 2952 thread_handle: 0x00000128 process_identifier: 2948 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000130	1	1
NtGetContextThread April 3, 2023, 5:57 p.m.	thread_handle: 0x00000128	1	0
NtAllocateVirtualMemory April 3, 2023, 5:57 p.m.	process_identifier: 2948 region_size: 5869568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00410000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000130	1	0
WriteProcessMemory April 3, 2023, 5:57 p.m.	buffer: base_address: 0x00410000 process_identifier: 2948 process_handle: 0x00000130	1	1
WriteProcessMemory April 3, 2023, 5:57 p.m.	buffer: ÿÿÿÿAû~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 2948 process_handle: 0x00000130	1	1
NtSetContextThread April 3, 2023, 5:57 p.m.	registers.eip: 1995571652 registers.esp: 4258256 registers.edi: 0 registers.eax: 4308478 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000128 process_identifier: 2948	1	0
NtResumeThread April 3, 2023, 5:57 p.m.	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 2948	1	0
NtResumeThread April 3, 2023, 5:57 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2948	1	0
NtResumeThread April 3, 2023, 5:57 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2948	1	0
NtResumeThread April 3, 2023, 5:57 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2948	1	0
NtResumeThread April 3, 2023, 5:57 p.m.	thread_handle: 0x00000248 suspend_count: 1 process_identifier: 2948	1	0
NtResumeThread April 3, 2023, 5:57 p.m.	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 2948	1	0

Archive Order_list.exe @ Order_list.tbz2

Summary

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All