Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 8, 2023, 6:02 p.m.	June 8, 2023, 6:04 p.m.

Size	21.9MB
Type	RAR archive data, v5
MD5	`a254e95af764b162db0dc73636f7f5dd`
SHA256	`bb02043cb749f91364f655b35404dc37e517d6aa7cdcbf474bee1fa6be5abe5f`
CRC32	`F1FCE7C8`
ssdeep	`393216:iGAGCSlH/Lzw8nNnil9nLTYDdfG9QaGfRpH93VaxNIo9V/zj1c7llwjvd:dZH/Lxil9vYDd4QaYpH9Far9Pzj1c7lU`
Yara	None matched

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "oaMQtrWKBepT" C:\Users\test22\AppData\Local\Temp\1234.rar
3016
- 7zFM.exe "C:\Program Files (x86)\7-Zip\7zFM.exe" "C:\Users\test22\AppData\Local\Temp\1234.rar"
  2208

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 8, 2023, 6:02 p.m.			0	0

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 8, 2023, 6:02 p.m.		1	1	0

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 8, 2023, 6:02 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74002000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 8, 2023, 6:02 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737e3000 process_handle: 0xffffffff	1	0	0

file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-17.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-6.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-13.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-2.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-5.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-14.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-15.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-19.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-8.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-3.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-12.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-9.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-4.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-11.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\setup.exe
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-18.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-1.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-10.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-7.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-16.dll
file	C:\Users\test22\AppData\Local\Temp\7zE0A8CCC36\dll\dll-20.dll

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 8, 2023, 6:02 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1	0
LookupPrivilegeValueW June 8, 2023, 6:02 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1	0

1234.rar