Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 19, 2023, 9:38 a.m.	June 19, 2023, 9:42 a.m.

Size	2.5MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d0fe5e997fb01417b2fe62989f94f6d6`
SHA256	`e8b1b453ce8a53ccd0441c0937916524f6a328e7d5af5fd27b338ced00ce42b5`
CRC32	`A9831D0F`
ssdeep	`49152:ApUiTF2pHbu5yFEsuQF8WxzWXK59YXbfEhpBIGeizrlfAJ:FZ5EzMYhrEhv+i+J`
PDB Path	wextract.pdb
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet CAB_file_format - CAB archive file IsPE32 - (no description) PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet

fiki0614242.exe "C:\Users\test22\AppData\Local\Temp\fiki0614242.exe"
1880
- cmd.exe cmd.exe /d /c bqkegju.bat 597582245
  2128
  - fnnauaugqv.exe fnnauaugqv.exe lqdhsylp.dat 597582245
    2188
    - WMIC.exe wmic process get processid,parentprocessid,name,executablepath /format:csv
      2268
    - node.exe node.exe node.lib 597582245 2382221817
      2380
      - cmd.exe cmd.exe /c dir C:\
        2784
      - cacls.exe cacls.exe C:\ProgramData\DNTException /t /e /c /g Everyone:F
        2832
      - icacls.exe icacls.exe C:\ProgramData\DNTException /t /c /grant *S-1-1-0:(f)
        2880
      - attrib.exe attrib.exe +H C:\ProgramData\DNTException
        2928
      - attrib.exe attrib.exe +H C:\ProgramData\DNTException\node.exe
        2972
      - cacls.exe cacls.exe C:\ProgramData\Intel /t /e /c /g Everyone:F
        2156
      - icacls.exe icacls.exe C:\ProgramData\Intel /t /c /grant *S-1-1-0:(f)
        2108
      - attrib.exe attrib.exe +H C:\ProgramData\Intel
        2296
      - attrib.exe attrib.exe +H "C:\ProgramData\Intel\Intel(R) Management Engine Components"
        2392
      - attrib.exe attrib.exe +H "C:\ProgramData\Intel\Intel(R) Management Engine Components\Intel MEC 4206229241"
        2232
      - attrib.exe attrib.exe +H "C:\ProgramData\Intel\Intel(R) Management Engine Components\Intel MEC 3095983164"
        2508
      - reg.exe reg.exe query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
        2760
      - reg.exe reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Intel Management Engine Components 1150041058" /t REG_SZ /d "wscript.exe /t:30 /nologo /e:jscript \"C:\ProgramData\Intel\Intel(R) Management Engine Components\Intel MEC 3095983164\" \"C:\ProgramData\Intel\Intel(R) Management Engine Components\" 1581449722" /f
        2056
      - tasklist.exe tasklist /fo csv /nh
        1228
      - WMIC.exe wmic process get processid,parentprocessid,name,executablepath /format:csv
        2900
      - ipconfig.exe ipconfig.exe /all
        3004
      - ROUTE.EXE route.exe print
        3032
      - NETSTAT.EXE netstat.exe -ano
        904
      - systeminfo.exe systeminfo.exe /fo csv
        2264
      - reg.exe reg.exe query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}
        1820
      - reg.exe reg.exe query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000
        2896

Name	Response	Post-Analysis Lookup
883c5b2846721687166301796.bag.sack54.net	A 46.249.49.132	185.82.126.147
deb2533e357016871662949520000611db13292a50ae8009b6b46004d42bf.aoa.aent78.sbs	A 176.10.119.186	46.30.190.83
883c5b2846721687166301796.bag.sack55.net

IP Address	Status	Action
164.124.101.2	Active	Moloch
176.10.119.186	Active	Moloch
46.249.49.132	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (13 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 19, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 19, 2023, 9:38 a.m.			0	0
IsDebuggerPresent June 19, 2023, 9:39 a.m.			0	0

Command line console output was observed (13 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 19, 2023, 9:38 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW June 19, 2023, 9:38 a.m.	buffer: rem console_handle: 0x00000007	1	1
WriteConsoleW June 19, 2023, 9:38 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW June 19, 2023, 9:38 a.m.	buffer: copy console_handle: 0x00000007	1	1
WriteConsoleW June 19, 2023, 9:38 a.m.	buffer: /b eodgdvifup.dat + eodgdvifup.dat.1 + eodgdvifup.dat.2 + eodgdvifup.dat.3 fnnauaugqv.exe console_handle: 0x00000007	1	1
WriteConsoleW June 19, 2023, 9:38 a.m.	buffer: eodgdvifup.dat console_handle: 0x00000007	1	1
WriteConsoleW June 19, 2023, 9:38 a.m.	buffer: eodgdvifup.dat.1 console_handle: 0x00000007	1	1
WriteConsoleW June 19, 2023, 9:38 a.m.	buffer: eodgdvifup.dat.2 console_handle: 0x00000007	1	1
WriteConsoleW June 19, 2023, 9:38 a.m.	buffer: eodgdvifup.dat.3 console_handle: 0x00000007	1	1
WriteConsoleW June 19, 2023, 9:38 a.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW June 19, 2023, 9:38 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW June 19, 2023, 9:38 a.m.	buffer: fnnauaugqv.exe console_handle: 0x00000007	1	1
WriteConsoleW June 19, 2023, 9:38 a.m.	buffer: lqdhsylp.dat 597582245 console_handle: 0x00000007	1	1

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Tries to locate where the browsers are installed (1 event)

file	C:\Program Files\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 19, 2023, 9:38 a.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

One or more processes crashed (4 events)

Time & API	Arguments	Status
__exception__ June 19, 2023, 9:38 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b CoReleaseServerProcess+0x73 OleSaveToStream-0xad ole32+0x64387 @ 0x75b94387 NdrpMemoryIncrement+0x3d1 NdrComplexStructMarshall-0x2f rpcrt4+0x1ef51 @ 0x754bef51 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c NdrPointerMarshall+0xd6 NdrPointerBufferSize-0x10 rpcrt4+0x16b42 @ 0x754b6b42 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c NdrConformantArrayFree+0x8c NdrOleFree-0xa rpcrt4+0x35c3a @ 0x754d5c3a NdrStubCall2+0x31d NdrUnmarshallBasetypeInline-0x23a rpcrt4+0xb06b8 @ 0x755506b8 WdtpInterfacePointer_UserUnmarshal+0x256f DllDebugObjectRPCHook-0x1e89 ole32+0x13d7e6 @ 0x75c6d7e6 WdtpInterfacePointer_UserUnmarshal+0x25ff DllDebugObjectRPCHook-0x1df9 ole32+0x13d876 @ 0x75c6d876 WdtpInterfacePointer_UserUnmarshal+0x2b59 DllDebugObjectRPCHook-0x189f ole32+0x13ddd0 @ 0x75c6ddd0 CoTaskMemFree+0x1b02 DcomChannelSetHResult-0x1c8 ole32+0x58a43 @ 0x75b88a43 CoTaskMemFree+0x19f7 DcomChannelSetHResult-0x2d3 ole32+0x58938 @ 0x75b88938 DcomChannelSetHResult+0x8ff CoGetObject-0x2183 ole32+0x5950a @ 0x75b8950a WdtpInterfacePointer_UserUnmarshal+0x2a56 DllDebugObjectRPCHook-0x19a2 ole32+0x13dccd @ 0x75c6dccd WdtpInterfacePointer_UserUnmarshal+0x28ca DllDebugObjectRPCHook-0x1b2e ole32+0x13db41 @ 0x75c6db41 WdtpInterfacePointer_UserUnmarshal+0x2f86 DllDebugObjectRPCHook-0x1472 ole32+0x13e1fd @ 0x75c6e1fd DcomChannelSetHResult+0x75c CoGetObject-0x2326 ole32+0x59367 @ 0x75b89367 DcomChannelSetHResult+0x71b CoGetObject-0x2367 ole32+0x59326 @ 0x75b89326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755f62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755f6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755f77c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755f788a CoWaitForMultipleHandles+0x4311 CoRegisterSurrogateEx-0x2fe ole32+0x1a48b @ 0x75b4a48b CoWaitForMultipleHandles+0x23c1 CoRegisterSurrogateEx-0x224e ole32+0x1853b @ 0x75b4853b CoWaitForMultipleHandles+0x4332 CoRegisterSurrogateEx-0x2dd ole32+0x1a4ac @ 0x75b4a4ac CoGetTreatAsClass+0x2619 CoRegisterChannelHook-0x1269 ole32+0x2cd48 @ 0x75b5cd48 CoGetTreatAsClass+0x314b CoRegisterChannelHook-0x737 ole32+0x2d87a @ 0x75b5d87a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 44299072 registers.edi: 4290780 registers.eax: 44299072 registers.ebp: 44299152 registers.edx: 14 registers.ebx: 44299436 registers.esi: 2147746133 registers.ecx: 4287592	1
__exception__ June 19, 2023, 9:38 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x75c6f725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x754d414b ObjectStublessClient25+0x65c CoImpersonateClient-0xbc ole32+0xfe14 @ 0x75b3fe14 StgGetIFillLockBytesOnFile+0x16ab5 WdtpInterfacePointer_UserSize-0xe21 ole32+0x13a338 @ 0x75c6a338 IsValidURL+0x4b8c MkParseDisplayNameEx-0x1c6a4 urlmon+0x4e99f @ 0x7532e99f IntlPercentEncodeNormalize+0x1ff8 CoInternetCombineIUri-0x940 urlmon+0x272ed @ 0x753072ed RegisterBindStatusCallback+0x40d9 CopyBindInfo-0xbe4 urlmon+0x1ab0d @ 0x752fab0d IsValidURL+0x2235 MkParseDisplayNameEx-0x1effb urlmon+0x4c048 @ 0x7532c048 RegisterBindStatusCallback+0x1dc3 CopyBindInfo-0x2efa urlmon+0x187f7 @ 0x752f87f7 RegisterBindStatusCallback+0x1ef2 CopyBindInfo-0x2dcb urlmon+0x18926 @ 0x752f8926 RevokeBindStatusCallback+0x13ad CreateURLMoniker-0x4b1 urlmon+0x1d55e @ 0x752fd55e IsValidURL+0x2638 MkParseDisplayNameEx-0x1ebf8 urlmon+0x4c44b @ 0x7532c44b RevokeBindStatusCallback+0x1045 CreateURLMoniker-0x819 urlmon+0x1d1f6 @ 0x752fd1f6 RevokeBindStatusCallback+0xffb CreateURLMoniker-0x863 urlmon+0x1d1ac @ 0x752fd1ac RevokeBindStatusCallback+0x125a CreateURLMoniker-0x604 urlmon+0x1d40b @ 0x752fd40b RegisterBindStatusCallback+0x2ee7 CopyBindInfo-0x1dd6 urlmon+0x1991b @ 0x752f991b RegisterBindStatusCallback+0x2333 CopyBindInfo-0x298a urlmon+0x18d67 @ 0x752f8d67 RegisterBindStatusCallback+0x36a4 CopyBindInfo-0x1619 urlmon+0x1a0d8 @ 0x752fa0d8 RegisterBindStatusCallback+0x3151 CopyBindInfo-0x1b6c urlmon+0x19b85 @ 0x752f9b85 RegisterBindStatusCallback+0x3074 CopyBindInfo-0x1c49 urlmon+0x19aa8 @ 0x752f9aa8 DllRegisterServer+0x14b2 msxml3+0x46f4f @ 0x73486f4f DllRegisterServer+0x13a3 msxml3+0x46e40 @ 0x73486e40 DllGetClassObject+0x3536b DllCanUnloadNow-0x1017 msxml3+0x427a4 @ 0x734827a4 DllGetClassObject+0x35219 DllCanUnloadNow-0x1169 msxml3+0x42652 @ 0x73482652 DllGetClassObject+0x35104 DllCanUnloadNow-0x127e msxml3+0x4253d @ 0x7348253d DllGetClassObject+0x34fd8 DllCanUnloadNow-0x13aa msxml3+0x42411 @ 0x73482411 DllGetClassObject+0x35172 DllCanUnloadNow-0x1210 msxml3+0x425ab @ 0x734825ab wmic+0x39c80 @ 0x329c80 wmic+0x3b06a @ 0x32b06a wmic+0x3b1f8 @ 0x32b1f8 wmic+0x36fcd @ 0x326fcd wmic+0x3d6e9 @ 0x32d6e9 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1894360 registers.edi: 1974991376 registers.eax: 1894360 registers.ebp: 1894440 registers.edx: 1 registers.ebx: 4020484 registers.esi: 2147746133 registers.ecx: 327736542	1
__exception__ June 19, 2023, 9:39 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b CoReleaseServerProcess+0x73 OleSaveToStream-0xad ole32+0x64387 @ 0x75b94387 NdrpMemoryIncrement+0x3d1 NdrComplexStructMarshall-0x2f rpcrt4+0x1ef51 @ 0x754bef51 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c NdrPointerMarshall+0xd6 NdrPointerBufferSize-0x10 rpcrt4+0x16b42 @ 0x754b6b42 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c NdrConformantArrayFree+0x8c NdrOleFree-0xa rpcrt4+0x35c3a @ 0x754d5c3a NdrStubCall2+0x31d NdrUnmarshallBasetypeInline-0x23a rpcrt4+0xb06b8 @ 0x755506b8 WdtpInterfacePointer_UserUnmarshal+0x256f DllDebugObjectRPCHook-0x1e89 ole32+0x13d7e6 @ 0x75c6d7e6 WdtpInterfacePointer_UserUnmarshal+0x25ff DllDebugObjectRPCHook-0x1df9 ole32+0x13d876 @ 0x75c6d876 WdtpInterfacePointer_UserUnmarshal+0x2b59 DllDebugObjectRPCHook-0x189f ole32+0x13ddd0 @ 0x75c6ddd0 CoTaskMemFree+0x1b02 DcomChannelSetHResult-0x1c8 ole32+0x58a43 @ 0x75b88a43 CoTaskMemFree+0x19f7 DcomChannelSetHResult-0x2d3 ole32+0x58938 @ 0x75b88938 DcomChannelSetHResult+0x8ff CoGetObject-0x2183 ole32+0x5950a @ 0x75b8950a WdtpInterfacePointer_UserUnmarshal+0x2a56 DllDebugObjectRPCHook-0x19a2 ole32+0x13dccd @ 0x75c6dccd WdtpInterfacePointer_UserUnmarshal+0x28ca DllDebugObjectRPCHook-0x1b2e ole32+0x13db41 @ 0x75c6db41 WdtpInterfacePointer_UserUnmarshal+0x2f86 DllDebugObjectRPCHook-0x1472 ole32+0x13e1fd @ 0x75c6e1fd DcomChannelSetHResult+0x75c CoGetObject-0x2326 ole32+0x59367 @ 0x75b89367 DcomChannelSetHResult+0x71b CoGetObject-0x2367 ole32+0x59326 @ 0x75b89326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755f62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755f6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755f77c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755f788a CoWaitForMultipleHandles+0x4311 CoRegisterSurrogateEx-0x2fe ole32+0x1a48b @ 0x75b4a48b CoWaitForMultipleHandles+0x23c1 CoRegisterSurrogateEx-0x224e ole32+0x1853b @ 0x75b4853b CoWaitForMultipleHandles+0x4332 CoRegisterSurrogateEx-0x2dd ole32+0x1a4ac @ 0x75b4a4ac CoGetTreatAsClass+0x2619 CoRegisterChannelHook-0x1269 ole32+0x2cd48 @ 0x75b5cd48 CoGetTreatAsClass+0x314b CoRegisterChannelHook-0x737 ole32+0x2d87a @ 0x75b5d87a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 47378540 registers.edi: 8507660 registers.eax: 47378540 registers.ebp: 47378620 registers.edx: 23453 registers.ebx: 47378904 registers.esi: 2147746133 registers.ecx: 8501752	1
__exception__ June 19, 2023, 9:39 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x75c6f725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x754d414b ObjectStublessClient25+0x65c CoImpersonateClient-0xbc ole32+0xfe14 @ 0x75b3fe14 StgGetIFillLockBytesOnFile+0x16ab5 WdtpInterfacePointer_UserSize-0xe21 ole32+0x13a338 @ 0x75c6a338 IsValidURL+0x4b8c MkParseDisplayNameEx-0x1c6a4 urlmon+0x4e99f @ 0x7532e99f IntlPercentEncodeNormalize+0x1ff8 CoInternetCombineIUri-0x940 urlmon+0x272ed @ 0x753072ed RegisterBindStatusCallback+0x40d9 CopyBindInfo-0xbe4 urlmon+0x1ab0d @ 0x752fab0d IsValidURL+0x2235 MkParseDisplayNameEx-0x1effb urlmon+0x4c048 @ 0x7532c048 RegisterBindStatusCallback+0x1dc3 CopyBindInfo-0x2efa urlmon+0x187f7 @ 0x752f87f7 RegisterBindStatusCallback+0x1ef2 CopyBindInfo-0x2dcb urlmon+0x18926 @ 0x752f8926 RevokeBindStatusCallback+0x13ad CreateURLMoniker-0x4b1 urlmon+0x1d55e @ 0x752fd55e IsValidURL+0x2638 MkParseDisplayNameEx-0x1ebf8 urlmon+0x4c44b @ 0x7532c44b RevokeBindStatusCallback+0x1045 CreateURLMoniker-0x819 urlmon+0x1d1f6 @ 0x752fd1f6 RevokeBindStatusCallback+0xffb CreateURLMoniker-0x863 urlmon+0x1d1ac @ 0x752fd1ac RevokeBindStatusCallback+0x125a CreateURLMoniker-0x604 urlmon+0x1d40b @ 0x752fd40b RegisterBindStatusCallback+0x2ee7 CopyBindInfo-0x1dd6 urlmon+0x1991b @ 0x752f991b RegisterBindStatusCallback+0x2333 CopyBindInfo-0x298a urlmon+0x18d67 @ 0x752f8d67 RegisterBindStatusCallback+0x36a4 CopyBindInfo-0x1619 urlmon+0x1a0d8 @ 0x752fa0d8 RegisterBindStatusCallback+0x3151 CopyBindInfo-0x1b6c urlmon+0x19b85 @ 0x752f9b85 RegisterBindStatusCallback+0x3074 CopyBindInfo-0x1c49 urlmon+0x19aa8 @ 0x752f9aa8 DllRegisterServer+0x14b2 msxml3+0x46f4f @ 0x733c6f4f DllRegisterServer+0x13a3 msxml3+0x46e40 @ 0x733c6e40 DllGetClassObject+0x3536b DllCanUnloadNow-0x1017 msxml3+0x427a4 @ 0x733c27a4 DllGetClassObject+0x35219 DllCanUnloadNow-0x1169 msxml3+0x42652 @ 0x733c2652 DllGetClassObject+0x35104 DllCanUnloadNow-0x127e msxml3+0x4253d @ 0x733c253d DllGetClassObject+0x34fd8 DllCanUnloadNow-0x13aa msxml3+0x42411 @ 0x733c2411 DllGetClassObject+0x35172 DllCanUnloadNow-0x1210 msxml3+0x425ab @ 0x733c25ab wmic+0x39c80 @ 0x649c80 wmic+0x3b06a @ 0x64b06a wmic+0x3b1f8 @ 0x64b1f8 wmic+0x36fcd @ 0x646fcd wmic+0x3d6e9 @ 0x64d6e9 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 2878192 registers.edi: 1974991376 registers.eax: 2878192 registers.ebp: 2878272 registers.edx: 1 registers.ebx: 8214820 registers.esi: 2147746133 registers.ecx: 528846046	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 61 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fe1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x16300000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x17400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x1f900000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x34700000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x17d00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x15e00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x2dd00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0fd0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x1c60a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 region_size: 1003520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x1470a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ef1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ea1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e71000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2188 region_size: 1003520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x3d20a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73381000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c41000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05200000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x24a00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x25800000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x14100000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06f00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07500000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0530a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0e00a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 region_size: 1003520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x3e10a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ef1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ea1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73db1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73da1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e71000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 region_size: 1003520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0de0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2023, 9:39 a.m.	process_identifier: 2380 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x1540a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2023, 9:39 a.m.	process_identifier: 2108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (3 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW June 19, 2023, 9:38 a.m.	number_of_free_clusters: 2424681 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 19, 2023, 9:38 a.m.	number_of_free_clusters: 2424681 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW June 19, 2023, 9:38 a.m.	total_number_of_free_bytes: 9919553536 free_bytes_available: 9919553536 root_path: C:\ total_number_of_bytes: 34252779520	1	1

Creates executable files on the filesystem (5 events)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\fnnauaugqv.exe
file	C:\ProgramData\DNTException\node.exe
file	C:\ProgramData\wyMwestbtU\BUIRpkRc.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\bqkegju.bat
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uknealjyaTP.lnk

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uknealjyaTP.lnk

Creates a suspicious process (3 events)

cmdline	cmd.exe /d /c bqkegju.bat 597582245
cmdline	cmd.exe /c dir C:\
cmdline	wmic process get processid,parentprocessid,name,executablepath /format:csv

Drops a binary and executes it (1 event)

file	C:\ProgramData\DNTException\node.exe

Executes one or more WMI queries (2 events)

wmi	SELECT ProcessId, ParentProcessId, Name, ExecutablePath FROM Win32_Process
wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (18 events)

Time & API	Arguments	Status	Return
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x0000024c process_name: mobsync.exe process_identifier: 2032	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x0000024c process_name: pw.exe process_identifier: 1700	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x0000024c process_name: wsqmcons.exe process_identifier: 804	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x0000024c process_name: taskhost.exe process_identifier: 1940	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x0000024c process_name: sdclt.exe process_identifier: 2004	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x0000024c process_name: cmd.exe process_identifier: 1648	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x0000024c process_name: SearchProtocolHost.exe process_identifier: 1968	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x0000024c process_name: conhost.exe process_identifier: 160	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x0000024c process_name: SearchFilterHost.exe process_identifier: 300	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x0000024c process_name: fiki0614242.exe process_identifier: 1880	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x0000024c process_name: schtasks.exe process_identifier: 2104	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x0000024c process_name: conhost.exe process_identifier: 2112	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x0000024c process_name: cmd.exe process_identifier: 2128	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x0000024c process_name: conhost.exe process_identifier: 2164	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x0000024c process_name: fnnauaugqv.exe process_identifier: 2188	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x00000244 process_name: WmiPrvSE.exe process_identifier: 2336	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x00000244 process_name: node.exe process_identifier: 2380	1	1
Process32NextW June 19, 2023, 9:38 a.m.	snapshot_handle: 0x00000244 process_name: process_identifier: 14236936		0

File has been identified by 6 AntiVirus engines on VirusTotal as malicious (6 events)

Cybereason	malicious.97fb01
ESET-NOD32	a variant of Win32/Packed.CAB.GE suspicious
Trapmine	malicious.high.ml.score
Microsoft	Trojan:Win32/Wacatac.B!ml
AhnLab-V3	Trojan/Win.Generic.C5312104
MaxSecure	Trojan.Malware.300983.susgen

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 19, 2023, 9:38 a.m.	process_identifier: 2380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x07500000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 19, 2023, 9:38 a.m.	flags: 0 family: 0	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0027cc00', u'virtual_address': u'0x0000c000', u'entropy': 7.990937511672404, u'name': u'.rsrc', u'virtual_size': u'0x0027d000'}

entropy

7.99093751167

description

A section with a high entropy has been found

entropy

0.987018019764

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW June 19, 2023, 9:39 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 19, 2023, 9:39 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 19, 2023, 9:39 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Uses Windows utilities for basic Windows functionality (19 events)

cmdline	cmd.exe /d /c bqkegju.bat 597582245
cmdline	attrib.exe +H "C:\ProgramData\Intel\Intel(R) Management Engine Components"
cmdline	route.exe print
cmdline	systeminfo.exe /fo csv
cmdline	ipconfig.exe /all
cmdline	cmd.exe /c dir C:\
cmdline	fnnauaugqv.exe lqdhsylp.dat 597582245
cmdline	wmic process get processid,parentprocessid,name,executablepath /format:csv
cmdline	attrib.exe +H C:\ProgramData\Intel
cmdline	tasklist /fo csv /nh
cmdline	attrib.exe +H C:\ProgramData\DNTException\node.exe
cmdline	reg.exe query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000
cmdline	attrib.exe +H C:\ProgramData\DNTException
cmdline	attrib.exe +H "C:\ProgramData\Intel\Intel(R) Management Engine Components\Intel MEC 4206229241"
cmdline	attrib.exe +H "C:\ProgramData\Intel\Intel(R) Management Engine Components\Intel MEC 3095983164"
cmdline	reg.exe query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
cmdline	reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Intel Management Engine Components 1150041058" /t REG_SZ /d "wscript.exe /t:30 /nologo /e:jscript \"C:\ProgramData\Intel\Intel(R) Management Engine Components\Intel MEC 3095983164\" \"C:\ProgramData\Intel\Intel(R) Management Engine Components\" 1581449722" /f
cmdline	reg.exe query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}
cmdline	netstat.exe -ano

Creates an Alternate Data Stream (ADS) (3 events)

file	C:\ProgramData\DNTException\node.exe:51d34c9ea9905d124820da74c97d1b68
file	C:\Users\test22\AppData\Local\Temp\223befade8897437:ads
file	C:\ProgramData\DNTException\node.exe:5bc4ef2e9d8b38cd49fecd7d51d8bbd1

Attempts to identify installed AV products by installation directory (1 event)

file	C:\Users\test22\AppData\Local\Temp\SandboxieInstall.exe

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation June 19, 2023, 9:38 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Checks the CPU name from registry, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString

Installs itself for autorun at Windows startup (3 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Intel Management Engine Components 1150041058	reg_value	wscript.exe /t:30 /nologo /e:jscript "C:\ProgramData\Intel\Intel(R) Management Engine Components\Intel MEC 3095983164" "C:\ProgramData\Intel\Intel(R) Management Engine Components" 1581449722
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uknealjyaTP.lnk

Uses suspicious command line tools or Windows utilities (4 events)

cmdline	cacls.exe C:\ProgramData\DNTException /t /e /c /g Everyone:F
cmdline	icacls.exe C:\ProgramData\Intel /t /c /grant *S-1-1-0:(f)
cmdline	cacls.exe C:\ProgramData\Intel /t /e /c /g Everyone:F
cmdline	icacls.exe C:\ProgramData\DNTException /t /c /grant *S-1-1-0:(f)

fiki0614242.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All