Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 4, 2023, 5:35 p.m.	June 4, 2023, 5:42 p.m.

Size	1.6MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`c4b9d83a65b7a0b05d7d24d4abcb29ae`
SHA256	`6333176aeff8e8bcf4afa893729e2264bd29ed4db5d0b8211eb92a4844b4002e`
CRC32	`85B72C05`
ssdeep	`24576:UTbBv5rUe0cjGq9uFHK6c71E0GHSjLXFso0heHhv1ekNr2r0hspaAcKEYMI9IulL:mBJLSfo6i1IHSjrFs+vRngaAcwMItf`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

7e8e3c8b54a3dd86e1b6afb3300169b0f41449d860921fef25d1038c26215f3f6f88efa1616203fc5b51.exe "C:\Users\test22\AppData\Local\Temp\7e8e3c8b54a3dd86e1b6afb3300169b0f41449d860921fef25d1038c26215f3f6f88efa1616203fc5b51.exe"
2540
- wscript.exe "C:\Windows\System32\wscript.exe" ork.vbe
  2664
  - cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
    2756
    - ipconfig.exe ipconfig /release
      2880
  - cmd.exe "C:\Windows\System32\cmd.exe" /c fjxcrdcio.xl oadvacttxm.msc
    2812
    - fjxcrdcio.xl fjxcrdcio.xl oadvacttxm.msc
      2904
      - mshta.exe "C:\Windows\SysWOW64\mshta.exe"
        2108
      - mshta.exe "C:\Windows\SysWOW64\mshta.exe"
        2240
      - mshta.exe "C:\Windows\SysWOW64\mshta.exe"
        2508
      - mshta.exe "C:\Windows\SysWOW64\mshta.exe"
        2644
      - mshta.exe "C:\Windows\SysWOW64\mshta.exe"
        2836
      - mshta.exe "C:\Windows\SysWOW64\mshta.exe"
        2980
      - mshta.exe "C:\Windows\SysWOW64\mshta.exe"
        2600
      - RegSvcs.exe "C:\Users\test22\AppData\Local\Temp\RegSvcs.exe"
        1512
  - cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
    3004
    - ipconfig.exe ipconfig /renew
      3064
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
explore.ddns.net	A 37.46.117.90	37.46.117.90

IP Address	Status	Action
164.124.101.2	Active	Moloch
37.46.117.90	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (9 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 4, 2023, 5:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 4, 2023, 5:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 4, 2023, 5:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 4, 2023, 5:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 4, 2023, 5:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 4, 2023, 5:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 4, 2023, 5:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 4, 2023, 5:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 4, 2023, 5:36 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 4, 2023, 5:35 p.m.			0	0
IsDebuggerPresent June 4, 2023, 5:36 p.m.			0	0
IsDebuggerPresent June 4, 2023, 5:36 p.m.			0	0

Command line console output was observed (4 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 4, 2023, 5:35 p.m.	buffer: Windows IP Configuration console_handle: 0x00000007	1	1
WriteConsoleW June 4, 2023, 5:35 p.m.	buffer: The operation failed as no adapter is in the state permissible for this operation. console_handle: 0x00000007	1	1
WriteConsoleW June 4, 2023, 5:35 p.m.	buffer: Windows IP Configuration console_handle: 0x00000007	1	1
WriteConsoleW June 4, 2023, 5:35 p.m.	buffer: The operation failed as no adapter is in the state permissible for this operation. console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey June 4, 2023, 5:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00cfba08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 4, 2023, 5:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00cfba08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 4, 2023, 5:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00cfb948 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 4, 2023, 5:35 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 4, 2023, 5:36 p.m.	stacktrace: 0x54d29ed 0x494f3e2 0x494f24b 0x494efa9 0x494ef0b 0x115a011 0x1159f8b 0x1159e64 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x71f92652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x71fa264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72011838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72011737 mscorlib+0x2d3711 @ 0x712a3711 mscorlib+0x308f2d @ 0x712d8f2d mscorlib+0x3133fd @ 0x712e33fd 0xfc00dc 0xfc0062 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x71fa264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x71fa2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x720574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72057610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x720e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x720e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x720e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x720e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73bbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73fb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73fb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 01 8b 40 28 8b 00 6a 00 6a 00 6a 01 50 e8 51 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x10c520b registers.esp: 3992588 registers.edi: 43620352 registers.eax: 41300856 registers.ebp: 3992600 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

June 4, 2023, 5:36 p.m.

stacktrace:

0x54d29ed
0x494f3e2
0x494f24b
0x494efa9
0x494ef0b
0x115a011
0x1159f8b
0x1159e64
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x71f92652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x71fa264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72011838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72011737
mscorlib+0x2d3711 @ 0x712a3711
mscorlib+0x308f2d @ 0x712d8f2d
mscorlib+0x3133fd @ 0x712e33fd
0xfc00dc
0xfc0062
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x71fa264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x71fa2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x720574ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72057610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x720e1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x720e1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x720e1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x720e416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73bbf5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73fb7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73fb4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: 8b 01 8b 40 28 8b 00 6a 00 6a 00 6a 01 50 e8 51
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x10c520b
registers.esp: 3992588
registers.edi: 43620352
registers.eax: 41300856
registers.ebp: 3992600
registers.edx: 0
registers.ebx: 0
registers.esi: 0
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (1 event)

domain

explore.ddns.net

Allocates read-write-execute memory (usually to unpack itself) (50 out of 110 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 4, 2023, 5:35 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 4, 2023, 5:35 p.m.	process_identifier: 2664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 4, 2023, 5:35 p.m.	process_identifier: 2904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:29 p.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004930000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2023, 5:35 p.m.	process_identifier: 2108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 4, 2023, 5:35 p.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 4, 2023, 5:35 p.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 4, 2023, 5:35 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 2980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ff0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01160000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f92000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b50000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b25000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b2b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b27000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00fc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b1a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00fc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00fc8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00fc9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b0d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00fca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x010cf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x010c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00fcc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00fcd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b0e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05620000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05621000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05631000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05633000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05634000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x010c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05635000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05636000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b0f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05637000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05638000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05639000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x010c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW June 4, 2023, 5:35 p.m.	total_number_of_free_bytes: 6422528 free_bytes_available: 25320962519593936 root_path: d:\ total_number_of_bytes: 65649537197929288		0	0
GetDiskFreeSpaceExW June 4, 2023, 5:35 p.m.	total_number_of_free_bytes: 6422528 free_bytes_available: 25320962519593936 root_path: d:\ total_number_of_bytes: 65649537197929288		0	0

Creates (office) documents on the filesystem (21 events)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\siqmidh.pdf
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\ofkqqed.docx
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\npcpi.docx
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\dcdkat.xls
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\aghnfxknt.xls
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\ovfmc.pdf
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\wimmw.pdf
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\womdofde.ppt
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\swpxqhhgg.pdf
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\cwvmk.docx
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\hsgrnx.pdf
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\revxnhi.docx
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\ewfxvgvk.ppt
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\gqmqphh.ppt
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\ermi.ppt
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\pmfshooave.ppt
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\kkimidjc.pdf
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\gnbq.ppt
file	C:\Users\test22\temp\npcpi.docx
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\fnvwalxtwt.pdf
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\kmueh.ppt

Creates executable files on the filesystem (5 events)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\tplpr.exe
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\vadqnnquq.exe
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\etsq.dll
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\ork.vbe
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\nwjomvl.exe

Creates a suspicious process (8 events)

cmdline	"C:\Windows\SysWOW64\mshta.exe"
cmdline	"C:\Windows\System32\cmd.exe" /c fjxcrdcio.xl oadvacttxm.msc
cmdline	C:\Windows\SysWOW64\mshta.exe
cmdline	cmd.exe /c ipconfig /renew
cmdline	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
cmdline	"C:\Windows\System32\cmd.exe" /c ipconfig /release
cmdline	cmd.exe /c ipconfig /release
cmdline	cmd.exe /c fjxcrdcio.xl oadvacttxm.msc

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\fjxcrdcio.xl

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\fjxcrdcio.xl

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return
ShellExecuteExW June 4, 2023, 5:35 p.m.	show_type: 0 filepath_r: cmd.exe parameters: /c ipconfig /release filepath: cmd.exe	1	1
ShellExecuteExW June 4, 2023, 5:35 p.m.	show_type: 0 filepath_r: cmd.exe parameters: /c fjxcrdcio.xl oadvacttxm.msc filepath: cmd.exe	1	1
ShellExecuteExW June 4, 2023, 5:35 p.m.	show_type: 0 filepath_r: cmd.exe parameters: /c ipconfig /renew filepath: cmd.exe	1	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (35 events)

Time & API	Arguments	Status	Return
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: smss.exe process_identifier: 224	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: csrss.exe process_identifier: 304	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: wininit.exe process_identifier: 352	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: csrss.exe process_identifier: 360	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: winlogon.exe process_identifier: 400	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: services.exe process_identifier: 444	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: lsm.exe process_identifier: 468	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: svchost.exe process_identifier: 572	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: svchost.exe process_identifier: 724	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: svchost.exe process_identifier: 784	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: svchost.exe process_identifier: 832	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: audiodg.exe process_identifier: 900	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: svchost.exe process_identifier: 992	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: svchost.exe process_identifier: 292	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: spoolsv.exe process_identifier: 324	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: svchost.exe process_identifier: 1048	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: srvany.exe process_identifier: 1284	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: KMService.exe process_identifier: 1436	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: conhost.exe process_identifier: 1448	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: taskhost.exe process_identifier: 1600	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: sppsvc.exe process_identifier: 1820	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: svchost.exe process_identifier: 1896	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: dwm.exe process_identifier: 1260	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: explorer.exe process_identifier: 1452	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: pw.exe process_identifier: 988	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: SearchIndexer.exe process_identifier: 1160	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: SearchProtocolHost.exe process_identifier: 936	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: SearchFilterHost.exe process_identifier: 2000	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: mobsync.exe process_identifier: 2272	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: pw.exe process_identifier: 2316	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: 7e8e3c8b54a3dd86e1b6afb3300169b0f41449d860921fef25d1038c26215f3f6f88efa1616203fc5b51.exe process_identifier: 2540	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: wscript.exe process_identifier: 2664	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: cmd.exe process_identifier: 2812	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: conhost.exe process_identifier: 2852	1	1
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: fjxcrdcio.xl process_identifier: 2904	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 4, 2023, 5:35 p.m.	flags: 15 family: 2		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00019800', u'virtual_address': u'0x00064000', u'entropy': 7.368249638489738, u'name': u'.rsrc', u'virtual_size': u'0x0001963f'}

entropy

7.36824963849

description

A section with a high entropy has been found

entropy

0.284518828452

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 4, 2023, 5:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (7 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: fjxcrdcio.xl process_identifier: 2904		0	0
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: fjxcrdcio.xl process_identifier: 2904		0	0
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: fjxcrdcio.xl process_identifier: 2904		0	0
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: fjxcrdcio.xl process_identifier: 2904		0	0
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: fjxcrdcio.xl process_identifier: 2904		0	0
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: fjxcrdcio.xl process_identifier: 2904		0	0
Process32NextW June 4, 2023, 5:35 p.m.	snapshot_handle: 0x0000012c process_name: fjxcrdcio.xl process_identifier: 2904		0	0

Yara rule detected in process memory (50 out of 64 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo

Uses Windows utilities for basic Windows functionality (6 events)

cmdline	ipconfig /release
cmdline	cmd.exe /c ipconfig /renew
cmdline	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
cmdline	"C:\Windows\System32\cmd.exe" /c ipconfig /release
cmdline	cmd.exe /c ipconfig /release
cmdline	ipconfig /renew

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 956a4bbfd90921de57ee3a2c85182ee969a33105

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 7479296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000134	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Update

reg_value

0\ebpa\fjxcrdcio.xl 0\ebpa\oadvacttxm.msc

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory June 4, 2023, 5:36 p.m.	buffer: ÿÿÿÿ=û~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 1512 process_handle: 0x00000134	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2904 called NtSetContextThread to modify thread in remote process 1512
NtSetContextThread June 4, 2023, 5:36 p.m.	registers.eip: 1995571652 registers.esp: 3997000 registers.edi: 0 registers.eax: 4008894 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001f8 process_identifier: 1512	1	0	0

One or more non-whitelisted processes were created (6 events)

parent_process	wscript.exe	martian_process	"C:\Windows\System32\cmd.exe" /c fjxcrdcio.xl oadvacttxm.msc
parent_process	wscript.exe	martian_process	cmd.exe /c ipconfig /renew
parent_process	wscript.exe	martian_process	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
parent_process	wscript.exe	martian_process	"C:\Windows\System32\cmd.exe" /c ipconfig /release
parent_process	wscript.exe	martian_process	cmd.exe /c ipconfig /release
parent_process	wscript.exe	martian_process	cmd.exe /c fjxcrdcio.xl oadvacttxm.msc

Resumed a suspended thread in a remote process potentially indicative of process injection (16 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2904 resumed a thread in remote process 2108
Process injection	Process 2904 resumed a thread in remote process 2240
Process injection	Process 2904 resumed a thread in remote process 2508
Process injection	Process 2904 resumed a thread in remote process 2644
Process injection	Process 2904 resumed a thread in remote process 2836
Process injection	Process 2904 resumed a thread in remote process 2980
Process injection	Process 2904 resumed a thread in remote process 2600
Process injection	Process 2904 resumed a thread in remote process 1512
NtResumeThread June 4, 2023, 5:35 p.m.	thread_handle: 0x00000268 suspend_count: 1 process_identifier: 2108	1	0	0
NtResumeThread June 4, 2023, 5:35 p.m.	thread_handle: 0x000001ac suspend_count: 1 process_identifier: 2240	1	0	0
NtResumeThread June 4, 2023, 5:35 p.m.	thread_handle: 0x0000019c suspend_count: 1 process_identifier: 2508	1	0	0
NtResumeThread June 4, 2023, 5:35 p.m.	thread_handle: 0x00000134 suspend_count: 1 process_identifier: 2644	1	0	0
NtResumeThread June 4, 2023, 5:36 p.m.	thread_handle: 0x00000134 suspend_count: 1 process_identifier: 2836	1	0	0
NtResumeThread June 4, 2023, 5:36 p.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 2980	1	0	0
NtResumeThread June 4, 2023, 5:36 p.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 2600	1	0	0
NtResumeThread June 4, 2023, 5:36 p.m.	thread_handle: 0x000001f8 suspend_count: 1 process_identifier: 1512	1	0	0

Collects information on the system (ipconfig, netstat, systeminfo) (2 events)

cmdline	cmd.exe /c ipconfig /renew
cmdline	cmd.exe /c ipconfig /release

Executed a process and injected code into it, probably while unpacking (41 events)

Time & API	Arguments	Status	Return
NtResumeThread June 4, 2023, 5:35 p.m.	thread_handle: 0x0000017c suspend_count: 1 process_identifier: 2540	1	0
CreateProcessInternalW June 4, 2023, 5:35 p.m.	thread_identifier: 2668 thread_handle: 0x000002a8 process_identifier: 2664 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\wscript.exe track: 1 command_line: "C:\Windows\System32\wscript.exe" ork.vbe filepath_r: C:\Windows\System32\wscript.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002b0	1	1
CreateProcessInternalW June 4, 2023, 5:35 p.m.	thread_identifier: 2760 thread_handle: 0x000002ec process_identifier: 2756 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c ipconfig /release filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002f4	1	1
CreateProcessInternalW June 4, 2023, 5:35 p.m.	thread_identifier: 2816 thread_handle: 0x00000298 process_identifier: 2812 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c fjxcrdcio.xl oadvacttxm.msc filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002f4	1	1
CreateProcessInternalW June 4, 2023, 5:35 p.m.	thread_identifier: 3008 thread_handle: 0x000002a8 process_identifier: 3004 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c ipconfig /renew filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002f0	1	1
CreateProcessInternalW June 4, 2023, 5:35 p.m.	thread_identifier: 2884 thread_handle: 0x00000084 process_identifier: 2880 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\ipconfig.exe track: 1 command_line: ipconfig /release filepath_r: C:\Windows\system32\ipconfig.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
CreateProcessInternalW June 4, 2023, 5:35 p.m.	thread_identifier: 2908 thread_handle: 0x00000084 process_identifier: 2904 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Users\test22\AppData\Local\Temp\RarSFX0\fjxcrdcio.xl track: 1 command_line: fjxcrdcio.xl oadvacttxm.msc filepath_r: C:\Users\test22\AppData\Local\Temp\RarSFX0\fjxcrdcio.xl stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
NtResumeThread June 4, 2023, 5:35 p.m.	thread_handle: 0x00000214 suspend_count: 1 process_identifier: 2904	1	0
CreateProcessInternalW June 4, 2023, 5:35 p.m.	thread_identifier: 2100 thread_handle: 0x00000268 process_identifier: 2108 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\SysWOW64\mshta.exe track: 1 command_line: "C:\Windows\SysWOW64\mshta.exe" filepath_r: C:\Windows\SysWOW64\mshta.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000026c	1	1
NtResumeThread June 4, 2023, 5:35 p.m.	thread_handle: 0x00000268 suspend_count: 1 process_identifier: 2108	1	0
CreateProcessInternalW June 4, 2023, 5:35 p.m.	thread_identifier: 2236 thread_handle: 0x000001ac process_identifier: 2240 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\SysWOW64\mshta.exe track: 1 command_line: "C:\Windows\SysWOW64\mshta.exe" filepath_r: C:\Windows\SysWOW64\mshta.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000120	1	1
NtResumeThread June 4, 2023, 5:35 p.m.	thread_handle: 0x000001ac suspend_count: 1 process_identifier: 2240	1	0
CreateProcessInternalW June 4, 2023, 5:35 p.m.	thread_identifier: 2504 thread_handle: 0x0000019c process_identifier: 2508 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\SysWOW64\mshta.exe track: 1 command_line: "C:\Windows\SysWOW64\mshta.exe" filepath_r: C:\Windows\SysWOW64\mshta.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000012c	1	1
NtResumeThread June 4, 2023, 5:35 p.m.	thread_handle: 0x0000019c suspend_count: 1 process_identifier: 2508	1	0
CreateProcessInternalW June 4, 2023, 5:35 p.m.	thread_identifier: 2372 thread_handle: 0x00000134 process_identifier: 2644 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\SysWOW64\mshta.exe track: 1 command_line: "C:\Windows\SysWOW64\mshta.exe" filepath_r: C:\Windows\SysWOW64\mshta.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000130	1	1
NtResumeThread June 4, 2023, 5:35 p.m.	thread_handle: 0x00000134 suspend_count: 1 process_identifier: 2644	1	0
CreateProcessInternalW June 4, 2023, 5:36 p.m.	thread_identifier: 2848 thread_handle: 0x00000134 process_identifier: 2836 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\SysWOW64\mshta.exe track: 1 command_line: "C:\Windows\SysWOW64\mshta.exe" filepath_r: C:\Windows\SysWOW64\mshta.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000001a4	1	1
NtResumeThread June 4, 2023, 5:36 p.m.	thread_handle: 0x00000134 suspend_count: 1 process_identifier: 2836	1	0
CreateProcessInternalW June 4, 2023, 5:36 p.m.	thread_identifier: 2992 thread_handle: 0x00000270 process_identifier: 2980 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\SysWOW64\mshta.exe track: 1 command_line: "C:\Windows\SysWOW64\mshta.exe" filepath_r: C:\Windows\SysWOW64\mshta.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000268	1	1
NtResumeThread June 4, 2023, 5:36 p.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 2980	1	0
CreateProcessInternalW June 4, 2023, 5:36 p.m.	thread_identifier: 416 thread_handle: 0x00000270 process_identifier: 2600 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\SysWOW64\mshta.exe track: 1 command_line: "C:\Windows\SysWOW64\mshta.exe" filepath_r: C:\Windows\SysWOW64\mshta.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000001a8	1	1
NtResumeThread June 4, 2023, 5:36 p.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 2600	1	0
CreateProcessInternalW June 4, 2023, 5:36 p.m.	thread_identifier: 1576 thread_handle: 0x000001f8 process_identifier: 1512 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\RegSvcs.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000134	1	1
NtGetContextThread June 4, 2023, 5:36 p.m.	thread_handle: 0x000001f8	1	0
NtAllocateVirtualMemory June 4, 2023, 5:36 p.m.	process_identifier: 1512 region_size: 7479296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000134	1	0
WriteProcessMemory June 4, 2023, 5:36 p.m.	buffer: base_address: 0x003d0000 process_identifier: 1512 process_handle: 0x00000134	1	1
WriteProcessMemory June 4, 2023, 5:36 p.m.	buffer: ÿÿÿÿ=û~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 1512 process_handle: 0x00000134	1	1
NtSetContextThread June 4, 2023, 5:36 p.m.	registers.eip: 1995571652 registers.esp: 3997000 registers.edi: 0 registers.eax: 4008894 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001f8 process_identifier: 1512	1	0
NtResumeThread June 4, 2023, 5:36 p.m.	thread_handle: 0x000001f8 suspend_count: 1 process_identifier: 1512	1	0
CreateProcessInternalW June 4, 2023, 5:35 p.m.	thread_identifier: 3068 thread_handle: 0x00000084 process_identifier: 3064 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\ipconfig.exe track: 1 command_line: ipconfig /renew filepath_r: C:\Windows\system32\ipconfig.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
NtResumeThread June 4, 2023, 5:35 p.m.	thread_handle: 0x00000104 suspend_count: 1 process_identifier: 2108	1	0
NtResumeThread June 4, 2023, 5:35 p.m.	thread_handle: 0x00000104 suspend_count: 1 process_identifier: 2240	1	0
NtResumeThread June 4, 2023, 5:35 p.m.	thread_handle: 0x00000104 suspend_count: 1 process_identifier: 2508	1	0
NtResumeThread June 4, 2023, 5:35 p.m.	thread_handle: 0x00000104 suspend_count: 1 process_identifier: 2644	1	0
NtResumeThread June 4, 2023, 5:36 p.m.	thread_handle: 0x00000104 suspend_count: 1 process_identifier: 2836	1	0
NtResumeThread June 4, 2023, 5:36 p.m.	thread_handle: 0x00000104 suspend_count: 1 process_identifier: 2980	1	0
NtResumeThread June 4, 2023, 5:36 p.m.	thread_handle: 0x00000104 suspend_count: 1 process_identifier: 2600	1	0
NtResumeThread June 4, 2023, 5:36 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1512	1	0
NtResumeThread June 4, 2023, 5:36 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1512	1	0
NtResumeThread June 4, 2023, 5:36 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 1512	1	0
NtResumeThread June 4, 2023, 5:36 p.m.	thread_handle: 0x000002bc suspend_count: 1 process_identifier: 1512	1	0

File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Mycop.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	AIT.Heur.Lisk.2.8AE16A8C.Gen
ClamAV	Win.Dropper.Formbook-9980566-0
ALYac	AIT.Heur.Lisk.2.8AE16A8C.Gen
Cylance	unsafe
VIPRE	AIT.Heur.Lisk.2.8AE16A8C.Gen
Sangfor	Trojan.Win32.Save.a
Arcabit	AIT.Heur.Lisk.2.8AE16A8C.Gen
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan.Win32.Mycop.gen
BitDefender	AIT.Heur.Lisk.2.8AE16A8C.Gen
NANO-Antivirus	Trojan.Win32.Autoit.jtxofu
Avast	FileRepMalware [Misc]
Rising	Trojan.Generic@AI.96 (RDML:Do8YW8DjaaybOEABqA098w)
Emsisoft	AIT.Heur.Lisk.2.8AE16A8C.Gen (B)
F-Secure	Dropper.DR/AutoIt.Gen
McAfee-GW-Edition	BehavesLike.Win32.Playtech.tc
FireEye	Generic.mg.c4b9d83a65b7a0b0
Avira	DR/AutoIt.Gen
MAX	malware (ai score=85)
Antiy-AVL	GrayWare/Win32.Wacapew
Gridinsoft	Ransom.Win32.Wacatac.oa!s1
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	UDS:Trojan.Win32.Mycop.gen
GData	AIT.Heur.Lisk.2.8AE16A8C.Gen
Google	Detected
Acronis	suspicious
McAfee	Artemis!C4B9D83A65B7
VBA32	Trojan.Agent
Malwarebytes	Generic.Malware.AI.DDS
Ikarus	Trojan.Script
Fortinet	VBS/Agent.PIFD!tr
AVG	FileRepMalware [Misc]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_60% (W)

The process wscript.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\cmd.exe

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 events)

dead_host	37.46.117.90:35919
dead_host	37.46.117.90:35920
dead_host	37.46.117.90:35921

7e8e3c8b54a3dd86e1b6afb3300169b0f41449d860921fef25d1038c26215f3f6f88efa1616203fc5b51

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All