Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 25, 2023, 6:50 p.m.	July 25, 2023, 6:56 p.m.

Size	2.1MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`92899ca104e6ac22954956977522eebb`
SHA256	`a3a5623bd0649f324b19c882ff48f76fe7aa674352d2f470ed35313cfb7ea92a`
CRC32	`FDD4185F`
ssdeep	`6144:39/bSahcEmWfxHd4zIlry42KrdABnd7gYbShZWCFK:oahwWf34wrNrSBd0CShZ`
Yara	Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

scand548226.exe "C:\Users\test22\AppData\Local\Temp\scand548226.exe"
1648
- scand548226.exe "C:\Users\test22\AppData\Local\Temp\scand548226.exe"
  2508
- chrome.exe "C:\Users\test22\AppData\Local\Temp\chrome.exe"
  2628
  - chrome.exe "C:\Users\test22\AppData\Local\Temp\chrome.exe"
    3012
  - cmd.exe "cmd.exe" /C mkdir "C:\Users\test22\AppData\Roaming\svchost"
    2224
  - cmd.exe "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
    1676
    - schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
      1896
  - cmd.exe "cmd.exe" /C copy "C:\Users\test22\AppData\Local\Temp\chrome.exe" "C:\Users\test22\AppData\Roaming\svchost\svchost.exe"
    2520
- cmd.exe "cmd.exe" /C mkdir "C:\Users\test22\AppData\Roaming\chrome"
  2668
- cmd.exe "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\chrome\chrome.exe'" /f
  2740
  - schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\chrome\chrome.exe'" /f
    2812
- cmd.exe "cmd.exe" /C copy "C:\Users\test22\AppData\Local\Temp\scand548226.exe" "C:\Users\test22\AppData\Roaming\chrome\chrome.exe"
  2860

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
161.129.36.99	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW July 25, 2023, 5:54 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW July 25, 2023, 5:55 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (8 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 25, 2023, 5:54 p.m.			0	0
IsDebuggerPresent July 25, 2023, 5:54 p.m.			0	0
IsDebuggerPresent July 25, 2023, 5:54 p.m.			0	0
IsDebuggerPresent July 25, 2023, 5:54 p.m.			0	0
IsDebuggerPresent July 25, 2023, 5:54 p.m.			0	0
IsDebuggerPresent July 25, 2023, 5:54 p.m.			0	0
IsDebuggerPresent July 25, 2023, 5:55 p.m.			0	0
IsDebuggerPresent July 25, 2023, 5:55 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey July 25, 2023, 5:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056ee98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056ee98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056ef18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 25, 2023, 5:54 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 91 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00500000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008cf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00721000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00722000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00723000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00462000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00495000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00497000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00486000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00487000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00991000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00488000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\chrome.exe

Creates a suspicious process (8 events)

cmdline	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
cmdline	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\chrome\chrome.exe'" /f
cmdline	"cmd.exe" /C mkdir "C:\Users\test22\AppData\Roaming\chrome"
cmdline	"cmd.exe" /C mkdir "C:\Users\test22\AppData\Roaming\svchost"
cmdline	"cmd.exe" /C copy "C:\Users\test22\AppData\Local\Temp\scand548226.exe" "C:\Users\test22\AppData\Roaming\chrome\chrome.exe"
cmdline	"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\chrome\chrome.exe'" /f
cmdline	"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
cmdline	"cmd.exe" /C copy "C:\Users\test22\AppData\Local\Temp\chrome.exe" "C:\Users\test22\AppData\Roaming\svchost\svchost.exe"

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\chrome.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\chrome.exe

A process created a hidden window (6 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW July 25, 2023, 5:54 p.m.	thread_identifier: 2672 thread_handle: 0x00000440 process_identifier: 2668 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /C mkdir "C:\Users\test22\AppData\Roaming\chrome" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000404	1	1
CreateProcessInternalW July 25, 2023, 5:54 p.m.	thread_identifier: 2744 thread_handle: 0x00000440 process_identifier: 2740 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\chrome\chrome.exe'" /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000468	1	1
CreateProcessInternalW July 25, 2023, 5:54 p.m.	thread_identifier: 2864 thread_handle: 0x00000440 process_identifier: 2860 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /C copy "C:\Users\test22\AppData\Local\Temp\scand548226.exe" "C:\Users\test22\AppData\Roaming\chrome\chrome.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000470	1	1
CreateProcessInternalW July 25, 2023, 5:55 p.m.	thread_identifier: 2340 thread_handle: 0x00000338 process_identifier: 2224 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /C mkdir "C:\Users\test22\AppData\Roaming\svchost" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000344	1	1
CreateProcessInternalW July 25, 2023, 5:55 p.m.	thread_identifier: 748 thread_handle: 0x00000338 process_identifier: 1676 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000350	1	1
CreateProcessInternalW July 25, 2023, 5:55 p.m.	thread_identifier: 2528 thread_handle: 0x00000338 process_identifier: 2520 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /C copy "C:\Users\test22\AppData\Local\Temp\chrome.exe" "C:\Users\test22\AppData\Roaming\svchost\svchost.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000354	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 25, 2023, 5:54 p.m.	flags: 15 family: 0		111	0

Yara rule detected in process memory (18 events)

description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	RedLine stealer	rule	RedLine_Stealer_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Virtual currency	rule	Virtual_currency_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (6 events)

cmdline	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
cmdline	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\chrome\chrome.exe'" /f
cmdline	"cmd.exe" /C mkdir "C:\Users\test22\AppData\Roaming\chrome"
cmdline	"cmd.exe" /C mkdir "C:\Users\test22\AppData\Roaming\svchost"
cmdline	"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\chrome\chrome.exe'" /f
cmdline	"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f

Communicates with host for which no DNS query was performed (1 event)

host

161.129.36.99

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 122880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000027c	1	0	0
NtAllocateVirtualMemory July 25, 2023, 5:55 p.m.	process_identifier: 3012 region_size: 98304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000280	1	0	0

Installs itself for autorun at Windows startup (4 events)

cmdline	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
cmdline	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\chrome\chrome.exe'" /f
cmdline	"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\chrome\chrome.exe'" /f
cmdline	"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f

Potential code injection by writing to the memory of another process (7 events)

Time & API	Arguments	Status	Return
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¢©ðà0t. @ à@àK ÞÀ H.text4s t `.rsrcÞ v@@.relocÀ\|@B base_address: 0x00400000 process_identifier: 2508 process_handle: 0x0000027c	1	1
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: P8h Tô¢êT4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°´StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0>InternalNameImplosions.exe(LegalCopyright FOriginalFilenameImplosions.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0041a000 process_identifier: 2508 process_handle: 0x0000027c	1	1
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: 03 base_address: 0x0041c000 process_identifier: 2508 process_handle: 0x0000027c	1	1
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2508 process_handle: 0x0000027c	1	1
WriteProcessMemory July 25, 2023, 5:55 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²X`à þ= @@ .@¤=W@¸ ` H.text `.rsrc¸ @"@@.reloc`0@B base_address: 0x00400000 process_identifier: 3012 process_handle: 0x00000280	1	1
WriteProcessMemory July 25, 2023, 5:55 p.m.	buffer: 0> base_address: 0x00416000 process_identifier: 3012 process_handle: 0x00000280	1	1
WriteProcessMemory July 25, 2023, 5:55 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3012 process_handle: 0x00000280	1	1

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¢©ðà0t. @ à@àK ÞÀ H.text4s t `.rsrcÞ v@@.relocÀ\|@B base_address: 0x00400000 process_identifier: 2508 process_handle: 0x0000027c	1	1	0
WriteProcessMemory July 25, 2023, 5:55 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²X`à þ= @@ .@¤=W@¸ ` H.text `.rsrc¸ @"@@.reloc`0@B base_address: 0x00400000 process_identifier: 3012 process_handle: 0x00000280	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1648 called NtSetContextThread to modify thread in remote process 2508
Process injection	Process 2628 called NtSetContextThread to modify thread in remote process 3012
NtSetContextThread July 25, 2023, 5:54 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4297518 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000278 process_identifier: 2508	1	0	0
NtSetContextThread July 25, 2023, 5:55 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4210174 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000027c process_identifier: 3012	1	0	0

One or more non-whitelisted processes were created (4 events)

parent_process	chrome.exe	martian_process	"C:\Users\test22\AppData\Local\Temp\chrome.exe"
parent_process	chrome.exe	martian_process	"cmd.exe" /C copy "C:\Users\test22\AppData\Local\Temp\chrome.exe" "C:\Users\test22\AppData\Roaming\svchost\svchost.exe"
parent_process	chrome.exe	martian_process	"cmd.exe" /C mkdir "C:\Users\test22\AppData\Roaming\svchost"
parent_process	chrome.exe	martian_process	"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1648 resumed a thread in remote process 2508
Process injection	Process 2628 resumed a thread in remote process 3012
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x00000278 suspend_count: 1 process_identifier: 2508	1	0	0
NtResumeThread July 25, 2023, 5:55 p.m.	thread_handle: 0x0000027c suspend_count: 1 process_identifier: 3012	1	0	0

Generates some ICMP traffic

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

161.129.36.99:55615

Executed a process and injected code into it, probably while unpacking (45 events)

Time & API	Arguments	Status	Return
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 1648	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 1648	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 1648	1	0
CreateProcessInternalW July 25, 2023, 5:54 p.m.	thread_identifier: 2512 thread_handle: 0x00000278 process_identifier: 2508 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\scand548226.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\scand548226.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\scand548226.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000027c	1	1
NtGetContextThread July 25, 2023, 5:54 p.m.	thread_handle: 0x00000278	1	0
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2508 region_size: 122880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000027c	1	0
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¢©ðà0t. @ à@àK ÞÀ H.text4s t `.rsrcÞ v@@.relocÀ\|@B base_address: 0x00400000 process_identifier: 2508 process_handle: 0x0000027c	1	1
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x00000290 suspend_count: 1 process_identifier: 1648	1	0
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: base_address: 0x00402000 process_identifier: 2508 process_handle: 0x0000027c	1	1
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: P8h Tô¢êT4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°´StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0>InternalNameImplosions.exe(LegalCopyright FOriginalFilenameImplosions.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0041a000 process_identifier: 2508 process_handle: 0x0000027c	1	1
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: 03 base_address: 0x0041c000 process_identifier: 2508 process_handle: 0x0000027c	1	1
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2508 process_handle: 0x0000027c	1	1
NtSetContextThread July 25, 2023, 5:54 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4297518 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000278 process_identifier: 2508	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x00000278 suspend_count: 1 process_identifier: 2508	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x000002c0 suspend_count: 1 process_identifier: 1648	1	0
CreateProcessInternalW July 25, 2023, 5:54 p.m.	thread_identifier: 2632 thread_handle: 0x00000468 process_identifier: 2628 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\chrome.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\chrome.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\chrome.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000470	1	1
CreateProcessInternalW July 25, 2023, 5:54 p.m.	thread_identifier: 2672 thread_handle: 0x00000440 process_identifier: 2668 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /C mkdir "C:\Users\test22\AppData\Roaming\chrome" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000404	1	1
CreateProcessInternalW July 25, 2023, 5:54 p.m.	thread_identifier: 2744 thread_handle: 0x00000440 process_identifier: 2740 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\chrome\chrome.exe'" /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000468	1	1
CreateProcessInternalW July 25, 2023, 5:54 p.m.	thread_identifier: 2864 thread_handle: 0x00000440 process_identifier: 2860 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /C copy "C:\Users\test22\AppData\Local\Temp\scand548226.exe" "C:\Users\test22\AppData\Roaming\chrome\chrome.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000470	1	1
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2508	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2508	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x000001b8 suspend_count: 1 process_identifier: 2508	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x0000035c suspend_count: 1 process_identifier: 2508	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2628	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2628	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x000001c4 suspend_count: 1 process_identifier: 2628	1	0
CreateProcessInternalW July 25, 2023, 5:55 p.m.	thread_identifier: 3016 thread_handle: 0x0000027c process_identifier: 3012 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\chrome.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\chrome.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\chrome.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000280	1	1
NtGetContextThread July 25, 2023, 5:55 p.m.	thread_handle: 0x0000027c	1	0
NtAllocateVirtualMemory July 25, 2023, 5:55 p.m.	process_identifier: 3012 region_size: 98304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000280	1	0
WriteProcessMemory July 25, 2023, 5:55 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²X`à þ= @@ .@¤=W@¸ ` H.text `.rsrc¸ @"@@.reloc`0@B base_address: 0x00400000 process_identifier: 3012 process_handle: 0x00000280	1	1
WriteProcessMemory July 25, 2023, 5:55 p.m.	buffer: base_address: 0x00402000 process_identifier: 3012 process_handle: 0x00000280	1	1
WriteProcessMemory July 25, 2023, 5:55 p.m.	buffer: base_address: 0x00404000 process_identifier: 3012 process_handle: 0x00000280	1	1
WriteProcessMemory July 25, 2023, 5:55 p.m.	buffer: 0> base_address: 0x00416000 process_identifier: 3012 process_handle: 0x00000280	1	1
WriteProcessMemory July 25, 2023, 5:55 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3012 process_handle: 0x00000280	1	1
NtSetContextThread July 25, 2023, 5:55 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4210174 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000027c process_identifier: 3012	1	0
NtResumeThread July 25, 2023, 5:55 p.m.	thread_handle: 0x0000027c suspend_count: 1 process_identifier: 3012	1	0
CreateProcessInternalW July 25, 2023, 5:55 p.m.	thread_identifier: 2340 thread_handle: 0x00000338 process_identifier: 2224 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /C mkdir "C:\Users\test22\AppData\Roaming\svchost" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000344	1	1
CreateProcessInternalW July 25, 2023, 5:55 p.m.	thread_identifier: 748 thread_handle: 0x00000338 process_identifier: 1676 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000350	1	1
CreateProcessInternalW July 25, 2023, 5:55 p.m.	thread_identifier: 2528 thread_handle: 0x00000338 process_identifier: 2520 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /C copy "C:\Users\test22\AppData\Local\Temp\chrome.exe" "C:\Users\test22\AppData\Roaming\svchost\svchost.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000354	1	1
CreateProcessInternalW July 25, 2023, 5:54 p.m.	thread_identifier: 2816 thread_handle: 0x00000084 process_identifier: 2812 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\chrome\chrome.exe'" /f filepath_r: C:\Windows\system32\schtasks.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
NtResumeThread July 25, 2023, 5:55 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 3012	1	0
NtResumeThread July 25, 2023, 5:55 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 3012	1	0
NtResumeThread July 25, 2023, 5:55 p.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 3012	1	0
NtResumeThread July 25, 2023, 5:55 p.m.	thread_handle: 0x0000020c suspend_count: 1 process_identifier: 3012	1	0
CreateProcessInternalW July 25, 2023, 5:55 p.m.	thread_identifier: 2132 thread_handle: 0x00000084 process_identifier: 1896 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f filepath_r: C:\Windows\system32\schtasks.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ransom.Loki.8883
FireEye	Generic.mg.92899ca104e6ac22
ALYac	Gen:Variant.Ransom.Loki.8883
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Ransom.Loki.D22B3
BitDefenderTheta	Gen:NN.ZemsilF.36318.jo0@ayaHnZlG
Cyren	W32/MSIL_Kryptik.JLT.gen!Eldorado
Symantec	Trojan Horse
ESET-NOD32	a variant of MSIL/Kryptik.AHUA
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Ransom.Loki.8883
Avast	Win32:PWSX-gen [Trj]
Emsisoft	Gen:Variant.Ransom.Loki.8883 (B)
F-Secure	Heuristic.HEUR/AGEN.1307491
VIPRE	Gen:Variant.Ransom.Loki.8883
Sophos	ML/PE-A
SentinelOne	Static AI - Suspicious PE
Avira	HEUR/AGEN.1307491
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.Ransom.Loki.8883
Google	Detected
Acronis	suspicious
MAX	malware (ai score=83)
Malwarebytes	Trojan.Crypt.MSIL
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:qadxE6D6dNpYxFPncVzMjQ)
Ikarus	Trojan.Agent
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.AHBB!tr
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.104e6a
DeepInstinct	MALICIOUS

scand548226.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All