Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 23, 2023, 5:27 p.m.	May 23, 2023, 5:29 p.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`0957864375a690abcea81ce440d762f8`
SHA256	`9744884107f74b3db3c36ea52cb48cebe2f428b64e28e9da8084edfebdd80ca5`
CRC32	`7E1A9408`
ssdeep	`24576:QTbBv5rUvUaHOR/dnZ5Tm0mJrW7BomFGa6mFWqSRA4Q1KpgM:CBUwzkW7U7A4Q1WgM`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

003079999209.pdf.scr "C:\Users\test22\AppData\Local\Temp\003079999209.pdf.scr"
3036
- wscript.exe "C:\Windows\System32\wscript.exe" Update-tv.p.vbe
  2224
  - cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
    2312
    - ipconfig.exe ipconfig /release
      1196
  - cmd.exe "C:\Windows\System32\cmd.exe" /c sbkgsc.icm uaajqsbbqj.icm
    2396
    - sbkgsc.icm sbkgsc.icm uaajqsbbqj.icm
      1192
      - RegSvcs.exe "C:\Users\test22\AppData\Local\Temp\RegSvcs.exe"
        2444
        
        schtasks.exe "schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\test22\AppData\Local\Temp\tmp59C3.tmp"
        2828
        
        schtasks.exe "schtasks.exe" /create /f /tn "SMTP Host Task" /xml "C:\Users\test22\AppData\Local\Temp\tmp5AFD.tmp"
        2992
  - cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
    2472
    - ipconfig.exe ipconfig /renew
      1880
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
december2nd.ddns.net	A 212.193.30.230	212.193.30.230
december2n.duckdns.org	A 192.169.69.26	192.169.69.26

IP Address	Status	Action
164.124.101.2	Active	Moloch
192.169.69.26	Active	Moloch
212.193.30.230	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.102:63709 -> 164.124.101.2:53	2042936	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain	Potentially Bad Traffic
UDP 192.168.56.102:63709 -> 164.124.101.2:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
UDP 192.168.56.102:51405 -> 8.8.8.8:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic
UDP 192.168.56.102:56630 -> 164.124.101.2:53	2042936	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain	Potentially Bad Traffic
UDP 192.168.56.102:56630 -> 164.124.101.2:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
UDP 192.168.56.102:56630 -> 8.8.8.8:53	2042936	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain	Potentially Bad Traffic
UDP 192.168.56.102:56630 -> 8.8.8.8:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
UDP 192.168.56.102:56630 -> 164.124.101.2:53	2042936	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain	Potentially Bad Traffic
UDP 192.168.56.102:56630 -> 164.124.101.2:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
UDP 192.168.56.102:62846 -> 164.124.101.2:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 23, 2023, 5:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 23, 2023, 5:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 23, 2023, 5:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 23, 2023, 5:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 23, 2023, 5:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 23, 2023, 5:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 23, 2023, 5:29 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 23, 2023, 5:29 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 23, 2023, 5:29 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 23, 2023, 5:29 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 23, 2023, 5:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 23, 2023, 5:27 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 23, 2023, 5:27 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:27 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:27 p.m.			0	0

Command line console output was observed (6 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 23, 2023, 5:27 p.m.	buffer: Windows IP Configuration console_handle: 0x00000007	1	1
WriteConsoleW May 23, 2023, 5:27 p.m.	buffer: The operation failed as no adapter is in the state permissible for this operation. console_handle: 0x00000007	1	1
WriteConsoleW May 23, 2023, 5:27 p.m.	buffer: Windows IP Configuration console_handle: 0x00000007	1	1
WriteConsoleW May 23, 2023, 5:27 p.m.	buffer: The operation failed as no adapter is in the state permissible for this operation. console_handle: 0x00000007	1	1
WriteConsoleW May 23, 2023, 5:27 p.m.	buffer: SUCCESS: The scheduled task "SMTP Host" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleW May 23, 2023, 5:27 p.m.	buffer: SUCCESS: The scheduled task "SMTP Host Task" has successfully been created. console_handle: 0x00000007	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 23, 2023, 5:27 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (2 events)

domain	december2nd.ddns.net
domain	december2n.duckdns.org

Allocates read-write-execute memory (usually to unpack itself) (50 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e42000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b53000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e42000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 1192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e42000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:28 p.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000007250000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ae0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e42000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a33000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a34000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a35000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a36000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a37000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a38000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a39000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ce000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a3b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a3d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a3e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a3f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05de0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05de1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates (office) documents on the filesystem (6 events)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\uawqlglifq.docx
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\ghooc.ppt
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\rpfjsw.pdf
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\mkivd.docx
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\oqltd.xls
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\hvfcjfmt.docx

Creates executable files on the filesystem (5 events)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\Update-tv.p.vbe
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\aldrn.dll
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\Update.vbs
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\rvmbjhe.dll
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\ixbmsvfb.exe

Creates a suspicious process (8 events)

cmdline	cmd.exe /c sbkgsc.icm uaajqsbbqj.icm
cmdline	cmd.exe /c ipconfig /renew
cmdline	"C:\Windows\System32\cmd.exe" /c sbkgsc.icm uaajqsbbqj.icm
cmdline	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
cmdline	"C:\Windows\System32\cmd.exe" /c ipconfig /release
cmdline	cmd.exe /c ipconfig /release
cmdline	"schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\test22\AppData\Local\Temp\tmp59C3.tmp"
cmdline	"schtasks.exe" /create /f /tn "SMTP Host Task" /xml "C:\Users\test22\AppData\Local\Temp\tmp5AFD.tmp"

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\sbkgsc.icm

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\sbkgsc.icm

A process created a hidden window (5 events)

Time & API	Arguments	Status	Return
ShellExecuteExW May 23, 2023, 5:27 p.m.	show_type: 0 filepath_r: cmd.exe parameters: /c ipconfig /release filepath: cmd.exe	1	1
ShellExecuteExW May 23, 2023, 5:27 p.m.	show_type: 0 filepath_r: cmd.exe parameters: /c sbkgsc.icm uaajqsbbqj.icm filepath: cmd.exe	1	1
ShellExecuteExW May 23, 2023, 5:27 p.m.	show_type: 0 filepath_r: cmd.exe parameters: /c ipconfig /renew filepath: cmd.exe	1	1
CreateProcessInternalW May 23, 2023, 5:27 p.m.	thread_identifier: 2832 thread_handle: 0x000002c8 process_identifier: 2828 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\test22\AppData\Local\Temp\tmp59C3.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002cc	1	1
CreateProcessInternalW May 23, 2023, 5:27 p.m.	thread_identifier: 3004 thread_handle: 0x000002c8 process_identifier: 2992 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "SMTP Host Task" /xml "C:\Users\test22\AppData\Local\Temp\tmp5AFD.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002d4	1	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (32 events)

Time & API	Arguments	Status	Return
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: smss.exe process_identifier: 228	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: wininit.exe process_identifier: 344	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: csrss.exe process_identifier: 364	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: svchost.exe process_identifier: 584	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: svchost.exe process_identifier: 656	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: svchost.exe process_identifier: 740	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: svchost.exe process_identifier: 796	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: svchost.exe process_identifier: 824	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: audiodg.exe process_identifier: 916	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: svchost.exe process_identifier: 1000	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: spoolsv.exe process_identifier: 1036	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: svchost.exe process_identifier: 1080	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: dwm.exe process_identifier: 1208	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: explorer.exe process_identifier: 1236	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: taskhost.exe process_identifier: 1352	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: svchost.exe process_identifier: 1432	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: IMEDICTUPDATE.EXE process_identifier: 1492	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: svchost.exe process_identifier: 1908	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: pw.exe process_identifier: 1200	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: SearchIndexer.exe process_identifier: 736	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: SearchProtocolHost.exe process_identifier: 1364	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: SearchFilterHost.exe process_identifier: 2064	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: mobsync.exe process_identifier: 2480	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: tvnserver.exe process_identifier: 2580	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: tvnserver.exe process_identifier: 2660	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: pw.exe process_identifier: 2688	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: taskhost.exe process_identifier: 2848	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: 003079999209.pdf.scr process_identifier: 3036	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: wscript.exe process_identifier: 2224	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: cmd.exe process_identifier: 2396	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: conhost.exe process_identifier: 2428	1	1
Process32NextW May 23, 2023, 5:27 p.m.	snapshot_handle: 0x00000124 process_name: sbkgsc.icm process_identifier: 1192	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 23, 2023, 5:27 p.m.	flags: 15 family: 2		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0001a000', u'virtual_address': u'0x00064000', u'entropy': 7.3482447434990235, u'name': u'.rsrc', u'virtual_size': u'0x00019fe4'}

entropy

7.3482447435

description

A section with a high entropy has been found

entropy

0.288488210818

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW May 23, 2023, 5:27 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 23, 2023, 5:27 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 23, 2023, 5:27 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (9 events)

description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (8 events)

cmdline	cmd.exe /c ipconfig /renew
cmdline	ipconfig /release
cmdline	ipconfig /renew
cmdline	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
cmdline	"C:\Windows\System32\cmd.exe" /c ipconfig /release
cmdline	cmd.exe /c ipconfig /release
cmdline	"schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\test22\AppData\Local\Temp\tmp59C3.tmp"
cmdline	"schtasks.exe" /create /f /tn "SMTP Host Task" /xml "C:\Users\test22\AppData\Local\Temp\tmp5AFD.tmp"

One or more of the buffers contains an embedded PE file (4 events)

buffer	Buffer with sha1: c443b32577fadc62280cdbd08de5e038eb377c31
buffer	Buffer with sha1: 1229e6ba7a69db430db960696580555305bc595d
buffer	Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer	Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 5046272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000130	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 23, 2023, 5:27 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

RegSvcs.exe tried to sleep 4487828836 seconds, actually delayed analysis time by 4487828836 seconds

Installs itself for autorun at Windows startup (3 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome	reg_value	c:\ffgh\sbkgsc.icm c:\ffgh\uaajqsbbqj.icm
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate	reg_value	c:\ffgh\Update.vbs
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Host	reg_value	C:\Program Files (x86)\SMTP Host\smtphost.exe

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory May 23, 2023, 5:27 p.m.	buffer: ÿÿÿÿ>û~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 2444 process_handle: 0x00000130	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1192 called NtSetContextThread to modify thread in remote process 2444
NtSetContextThread May 23, 2023, 5:27 p.m.	registers.eip: 2001207748 registers.esp: 4061404 registers.edi: 0 registers.eax: 4188050 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000104 process_identifier: 2444	1	0	0

One or more non-whitelisted processes were created (6 events)

parent_process	wscript.exe	martian_process	cmd.exe /c sbkgsc.icm uaajqsbbqj.icm
parent_process	wscript.exe	martian_process	cmd.exe /c ipconfig /renew
parent_process	wscript.exe	martian_process	"C:\Windows\System32\cmd.exe" /c sbkgsc.icm uaajqsbbqj.icm
parent_process	wscript.exe	martian_process	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
parent_process	wscript.exe	martian_process	"C:\Windows\System32\cmd.exe" /c ipconfig /release
parent_process	wscript.exe	martian_process	cmd.exe /c ipconfig /release

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Local\Temp\RegSvcs.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1192 resumed a thread in remote process 2444
NtResumeThread May 23, 2023, 5:27 p.m.	thread_handle: 0x00000104 suspend_count: 1 process_identifier: 2444	1	0	0

Collects information on the system (ipconfig, netstat, systeminfo) (2 events)

cmdline	cmd.exe /c ipconfig /renew
cmdline	cmd.exe /c ipconfig /release

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (34 events)

Time & API	Arguments	Status	Return
NtResumeThread May 23, 2023, 5:27 p.m.	thread_handle: 0x0000017c suspend_count: 1 process_identifier: 3036	1	0
CreateProcessInternalW May 23, 2023, 5:27 p.m.	thread_identifier: 2228 thread_handle: 0x000002f8 process_identifier: 2224 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\wscript.exe track: 1 command_line: "C:\Windows\System32\wscript.exe" Update-tv.p.vbe filepath_r: C:\Windows\System32\wscript.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000300	1	1
CreateProcessInternalW May 23, 2023, 5:27 p.m.	thread_identifier: 2324 thread_handle: 0x0000032c process_identifier: 2312 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c ipconfig /release filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000334	1	1
CreateProcessInternalW May 23, 2023, 5:27 p.m.	thread_identifier: 2376 thread_handle: 0x00000298 process_identifier: 2396 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c sbkgsc.icm uaajqsbbqj.icm filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000334	1	1
CreateProcessInternalW May 23, 2023, 5:27 p.m.	thread_identifier: 664 thread_handle: 0x000002a8 process_identifier: 2472 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c ipconfig /renew filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000330	1	1
CreateProcessInternalW May 23, 2023, 5:27 p.m.	thread_identifier: 1164 thread_handle: 0x00000084 process_identifier: 1196 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\ipconfig.exe track: 1 command_line: ipconfig /release filepath_r: C:\Windows\system32\ipconfig.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
CreateProcessInternalW May 23, 2023, 5:27 p.m.	thread_identifier: 1140 thread_handle: 0x00000084 process_identifier: 1192 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Users\test22\AppData\Local\Temp\RarSFX0\sbkgsc.icm track: 1 command_line: sbkgsc.icm uaajqsbbqj.icm filepath_r: C:\Users\test22\AppData\Local\Temp\RarSFX0\sbkgsc.icm stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
CreateProcessInternalW May 23, 2023, 5:27 p.m.	thread_identifier: 2456 thread_handle: 0x00000104 process_identifier: 2444 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\RegSvcs.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000130	1	1
NtGetContextThread May 23, 2023, 5:27 p.m.	thread_handle: 0x00000104	1	0
NtAllocateVirtualMemory May 23, 2023, 5:27 p.m.	process_identifier: 2444 region_size: 5046272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000130	1	0
WriteProcessMemory May 23, 2023, 5:27 p.m.	buffer: base_address: 0x003e0000 process_identifier: 2444 process_handle: 0x00000130	1	1
WriteProcessMemory May 23, 2023, 5:27 p.m.	buffer: ÿÿÿÿ>û~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 2444 process_handle: 0x00000130	1	1
NtSetContextThread May 23, 2023, 5:27 p.m.	registers.eip: 2001207748 registers.esp: 4061404 registers.edi: 0 registers.eax: 4188050 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000104 process_identifier: 2444	1	0
NtResumeThread May 23, 2023, 5:27 p.m.	thread_handle: 0x00000104 suspend_count: 1 process_identifier: 2444	1	0
CreateProcessInternalW May 23, 2023, 5:27 p.m.	thread_identifier: 564 thread_handle: 0x00000084 process_identifier: 1880 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\ipconfig.exe track: 1 command_line: ipconfig /renew filepath_r: C:\Windows\system32\ipconfig.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
NtResumeThread May 23, 2023, 5:27 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread May 23, 2023, 5:27 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread May 23, 2023, 5:27 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2444	1	0
CreateProcessInternalW May 23, 2023, 5:27 p.m.	thread_identifier: 2832 thread_handle: 0x000002c8 process_identifier: 2828 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\test22\AppData\Local\Temp\tmp59C3.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002cc	1	1
CreateProcessInternalW May 23, 2023, 5:27 p.m.	thread_identifier: 3004 thread_handle: 0x000002c8 process_identifier: 2992 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "SMTP Host Task" /xml "C:\Users\test22\AppData\Local\Temp\tmp5AFD.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002d4	1	1
NtResumeThread May 23, 2023, 5:27 p.m.	thread_handle: 0x000002f0 suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread May 23, 2023, 5:27 p.m.	thread_handle: 0x00000308 suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread May 23, 2023, 5:27 p.m.	thread_handle: 0x0000033c suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread May 23, 2023, 5:27 p.m.	thread_handle: 0x000003bc suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread May 23, 2023, 5:27 p.m.	thread_handle: 0x000003d0 suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread May 23, 2023, 5:27 p.m.	thread_handle: 0x000003f4 suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread May 23, 2023, 5:27 p.m.	thread_handle: 0x00000424 suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread May 23, 2023, 5:27 p.m.	thread_handle: 0x00000450 suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread May 23, 2023, 5:28 p.m.	thread_handle: 0x00000464 suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread May 23, 2023, 5:28 p.m.	thread_handle: 0x00000338 suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread May 23, 2023, 5:28 p.m.	thread_handle: 0x0000047c suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread May 23, 2023, 5:28 p.m.	thread_handle: 0x000003e0 suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread May 23, 2023, 5:29 p.m.	thread_handle: 0x0000032c suspend_count: 1 process_identifier: 2444	1	0
NtResumeThread May 23, 2023, 5:29 p.m.	thread_handle: 0x000004b8 suspend_count: 1 process_identifier: 2444	1	0

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	AIT.Heur.Lisk.2.F311D234.Gen
FireEye	Generic.mg.0957864375a690ab
Malwarebytes	Malware.AI.1484629479
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0056e5201 )
K7GW	Trojan ( 0056e5201 )
CrowdStrike	win/malicious_confidence_70% (D)
ESET-NOD32	MSIL/NanoCore.E
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Mycop.gen
BitDefender	AIT.Heur.Lisk.2.F311D234.Gen
NANO-Antivirus	Trojan.Win32.Autoit.jtxofu
Sophos	Generic ML PUA (PUA)
VIPRE	AIT.Heur.Lisk.2.F311D234.Gen
McAfee-GW-Edition	BehavesLike.Win32.RealProtect.tc
Emsisoft	AIT.Heur.Lisk.2.F311D234.Gen (B)
MAX	malware (ai score=85)
Antiy-AVL	GrayWare/Win32.Wacapew
Microsoft	Trojan:Win32/Wacatac.B!ml
Gridinsoft	Ransom.Win32.Wacatac.oa!s1
Arcabit	AIT.Heur.Lisk.2.F311D234.Gen
ZoneAlarm	HEUR:Trojan.Win32.Mycop.gen
GData	Script.Trojan.Agent.4R4ZEU
Google	Detected
AhnLab-V3	Malware/Win.Generic.C5431750
Acronis	suspicious
ALYac	AIT.Heur.Lisk.2.F311D234.Gen
VBA32	Trojan.Agent
Panda	Trj/Genetic.gen
Rising	Trojan.Generic@AI.92 (RDML:MPoTFL/iFV7wSGtvunPSIA)
Ikarus	Trojan.MSIL.NanoCore
Fortinet	W32/PossibleThreat
Cybereason	malicious.8bff96
DeepInstinct	MALICIOUS

The process wscript.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\cmd.exe

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (10 events)

dead_host	192.168.56.102:49187
dead_host	192.168.56.102:49188
dead_host	192.168.56.102:49182
dead_host	192.168.56.102:49189
dead_host	192.168.56.102:49194
dead_host	192.168.56.102:49180
dead_host	192.168.56.102:49195
dead_host	192.168.56.102:49181
dead_host	212.193.30.230:61715
dead_host	192.168.56.102:49193

003079999209.pdf.scr

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All