Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 16, 2023, 2:03 p.m.	Sept. 16, 2023, 2:06 p.m.

Size	1001.8KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`e0ce28aad08a3286e1832c9677049bbb`
SHA256	`67b2831582cad6753246c71526bee8bdf29e3150d8dd5ec59a2d376c53493929`
CRC32	`BA7DBEEE`
ssdeep	`24576:bTbBv5rUNt/Hl0t/pLVp5Qy/W1WCoxMIFf6MV:FBetvetxLVp5QQ8hKMIFyMV`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check

1.exe "C:\Users\test22\AppData\Local\Temp\1.exe"
1684
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\RarSFX0\wmm-w.vbe"
  2112
  - cmd.exe "C:\Windows\System32\cmd.exe" /c uvscgumxs.txt wjdro.msc
    2440
    - uvscgumxs.txt uvscgumxs.txt wjdro.msc
      2520
      - RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2928
  - cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
    2800
    - ipconfig.exe ipconfig /renew
      2864
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
142.11.240.191	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 16, 2023, 2:04 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 16, 2023, 2:04 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 16, 2023, 2:04 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 16, 2023, 2:03 p.m.			0	0
IsDebuggerPresent Sept. 16, 2023, 2:03 p.m.			0	0
IsDebuggerPresent Sept. 16, 2023, 2:03 p.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Sept. 16, 2023, 2:03 p.m.	buffer: Windows IP Configuration console_handle: 0x00000007	1	1	0
WriteConsoleW Sept. 16, 2023, 2:03 p.m.	buffer: The operation failed as no adapter is in the state permissible for this operation. console_handle: 0x00000007	1	1	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 16, 2023, 2:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00cfc9c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00cfc9c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00cfca48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 16, 2023, 2:03 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (28 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a90000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00beb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00fe0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b56000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b57000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00fe1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates (office) documents on the filesystem (5 events)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\iagp.xls
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\orwurbcd.pdf
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\eegqfk.docx
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\fagtk.docx
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\tidgwg.docx

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\cuue.dll
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\prdi.dll
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\wmm-w.vbe
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\fcns.dll

Creates a suspicious process (4 events)

cmdline	cmd.exe /c uvscgumxs.txt wjdro.msc
cmdline	cmd.exe /c ipconfig /renew
cmdline	"C:\Windows\System32\cmd.exe" /c uvscgumxs.txt wjdro.msc
cmdline	"C:\Windows\System32\cmd.exe" /c ipconfig /renew

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\wmm-w.vbe
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\uvscgumxs.txt

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\uvscgumxs.txt

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Sept. 16, 2023, 2:03 p.m.	show_type: 0 filepath_r: parameters: /c ipconfig /release filepath:	1	1
ShellExecuteExW Sept. 16, 2023, 2:03 p.m.	show_type: 0 filepath_r: cmd.exe parameters: /c uvscgumxs.txt wjdro.msc filepath: cmd.exe	1	1
ShellExecuteExW Sept. 16, 2023, 2:03 p.m.	show_type: 0 filepath_r: cmd.exe parameters: /c ipconfig /renew filepath: cmd.exe	1	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (38 events)

Time & API	Arguments	Status	Return
Process32FirstW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: [System Process] process_identifier: 0	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: System process_identifier: 4	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: smss.exe process_identifier: 232	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: csrss.exe process_identifier: 308	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: wininit.exe process_identifier: 344	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: csrss.exe process_identifier: 356	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: winlogon.exe process_identifier: 392	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: services.exe process_identifier: 436	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: lsass.exe process_identifier: 452	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: lsm.exe process_identifier: 460	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 560	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 636	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 716	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 780	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 824	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: audiodg.exe process_identifier: 896	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 984	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 340	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: spoolsv.exe process_identifier: 1060	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: taskhost.exe process_identifier: 1112	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 1120	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: dwm.exe process_identifier: 1192	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: explorer.exe process_identifier: 1236	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 1744	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: pw.exe process_identifier: 1888	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: SearchIndexer.exe process_identifier: 1652	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: pw.exe process_identifier: 1800	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: taskhost.exe process_identifier: 1872	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: SearchProtocolHost.exe process_identifier: 652	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: SearchFilterHost.exe process_identifier: 1820	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: 1.exe process_identifier: 1684	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: svchost.exe process_identifier: 2328	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: mscorsvw.exe process_identifier: 2356	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: cmd.exe process_identifier: 2440	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: conhost.exe process_identifier: 2476	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: uvscgumxs.txt process_identifier: 2520	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: mscorsvw.exe process_identifier: 2672	1	1
Process32NextW Sept. 16, 2023, 2:03 p.m.	snapshot_handle: 0x00000120 process_name: sppsvc.exe process_identifier: 2732	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 16, 2023, 2:03 p.m.	flags: 15 family: 2		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00016c00', u'virtual_address': u'0x00064000', u'entropy': 6.99310304716313, u'name': u'.rsrc', u'virtual_size': u'0x00016bc8'}

entropy

6.99310304716

description

A section with a high entropy has been found

entropy

0.261870503597

description

Overall entropy of this PE file is high

Yara rule detected in process memory (19 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	RedLine stealer	rule	RedLine_Stealer_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Virtual currency	rule	Virtual_currency_Zero

Uses Windows utilities for basic Windows functionality (4 events)

cmdline	/c ipconfig /release
cmdline	ipconfig /renew
cmdline	cmd.exe /c ipconfig /renew
cmdline	"C:\Windows\System32\cmd.exe" /c ipconfig /renew

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 374e792559be97848643af9c333384fbb707cafa

Communicates with host for which no DNS query was performed (1 event)

host

142.11.240.191

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 7528448 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00360000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000124	1	0	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 16, 2023, 2:03 p.m.	buffer: ÿÿÿÿ6û~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 2928 process_handle: 0x00000124	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2520 called NtSetContextThread to modify thread in remote process 2928
NtSetContextThread Sept. 16, 2023, 2:03 p.m.	registers.eip: 2005598660 registers.esp: 3538860 registers.edi: 0 registers.eax: 3642174 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000110 process_identifier: 2928	1	0	0

One or more non-whitelisted processes were created (5 events)

parent_process	wscript.exe	martian_process	cmd.exe /c ipconfig /renew
parent_process	wscript.exe	martian_process	cmd.exe /c uvscgumxs.txt wjdro.msc
parent_process	wscript.exe	martian_process	/c ipconfig /release
parent_process	wscript.exe	martian_process	"C:\Windows\System32\cmd.exe" /c uvscgumxs.txt wjdro.msc
parent_process	wscript.exe	martian_process	"C:\Windows\System32\cmd.exe" /c ipconfig /renew

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1684 resumed a thread in remote process 2112
Process injection	Process 2520 resumed a thread in remote process 2928
NtResumeThread Sept. 16, 2023, 2:03 p.m.	thread_handle: 0x000002f0 suspend_count: 1 process_identifier: 2112	1	0	0
NtResumeThread Sept. 16, 2023, 2:03 p.m.	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2928	1	0	0

Collects information on the system (ipconfig, netstat, systeminfo) (1 event)

cmdline

cmd.exe /c ipconfig /renew

Executed a process and injected code into it, probably while unpacking (18 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 16, 2023, 2:03 p.m.	thread_handle: 0x00000180 suspend_count: 1 process_identifier: 1684	1	0
CreateProcessInternalW Sept. 16, 2023, 2:03 p.m.	thread_identifier: 2116 thread_handle: 0x000002f0 process_identifier: 2112 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\wscript.exe track: 1 command_line: "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\RarSFX0\wmm-w.vbe" filepath_r: C:\Windows\System32\WScript.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002e8	1	1
NtResumeThread Sept. 16, 2023, 2:03 p.m.	thread_handle: 0x000002f0 suspend_count: 1 process_identifier: 2112	1	0
CreateProcessInternalW Sept. 16, 2023, 2:03 p.m.	thread_identifier: 2444 thread_handle: 0x00000370 process_identifier: 2440 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c uvscgumxs.txt wjdro.msc filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000378	1	1
CreateProcessInternalW Sept. 16, 2023, 2:03 p.m.	thread_identifier: 2804 thread_handle: 0x00000304 process_identifier: 2800 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c ipconfig /renew filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000378	1	1
CreateProcessInternalW Sept. 16, 2023, 2:03 p.m.	thread_identifier: 2524 thread_handle: 0x00000084 process_identifier: 2520 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Users\test22\AppData\Local\Temp\RarSFX0\uvscgumxs.txt track: 1 command_line: uvscgumxs.txt wjdro.msc filepath_r: C:\Users\test22\AppData\Local\Temp\RarSFX0\uvscgumxs.txt stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
CreateProcessInternalW Sept. 16, 2023, 2:03 p.m.	thread_identifier: 2932 thread_handle: 0x00000110 process_identifier: 2928 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000124	1	1
NtGetContextThread Sept. 16, 2023, 2:03 p.m.	thread_handle: 0x00000110	1	0
NtAllocateVirtualMemory Sept. 16, 2023, 2:03 p.m.	process_identifier: 2928 region_size: 7528448 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00360000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000124	1	0
WriteProcessMemory Sept. 16, 2023, 2:03 p.m.	buffer: base_address: 0x00360000 process_identifier: 2928 process_handle: 0x00000124	1	1
WriteProcessMemory Sept. 16, 2023, 2:03 p.m.	buffer: ÿÿÿÿ6û~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 2928 process_handle: 0x00000124	1	1
NtSetContextThread Sept. 16, 2023, 2:03 p.m.	registers.eip: 2005598660 registers.esp: 3538860 registers.edi: 0 registers.eax: 3642174 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000110 process_identifier: 2928	1	0
NtResumeThread Sept. 16, 2023, 2:03 p.m.	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2928	1	0
CreateProcessInternalW Sept. 16, 2023, 2:03 p.m.	thread_identifier: 2868 thread_handle: 0x00000084 process_identifier: 2864 current_directory: C:\Users\test22\AppData\Local\Temp\RarSFX0 filepath: C:\Windows\System32\ipconfig.exe track: 1 command_line: ipconfig /renew filepath_r: C:\Windows\system32\ipconfig.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
NtResumeThread Sept. 16, 2023, 2:03 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2928	1	0
NtResumeThread Sept. 16, 2023, 2:03 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2928	1	0
NtResumeThread Sept. 16, 2023, 2:03 p.m.	thread_handle: 0x000001e4 suspend_count: 1 process_identifier: 2928	1	0
NtResumeThread Sept. 16, 2023, 2:03 p.m.	thread_handle: 0x00000360 suspend_count: 1 process_identifier: 2928	1	0

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Rasftuby.4!c
MicroWorld-eScan	Trojan.Rasftuby.Gen.8
ClamAV	Win.Malware.Generickdz-9980699-0
FireEye	Generic.mg.e0ce28aad08a3286
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005a5bbc1 )
Alibaba	Trojan:Win32/Kryptik.4992345b
K7GW	Trojan ( 005a5bbc1 )
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	Win32/Kryptik.HSGL
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.Rasftuby.Gen.8
NANO-Antivirus	Trojan.Win32.Autoit.jtxofu
Emsisoft	Trojan.Rasftuby.Gen.8 (B)
F-Secure	Dropper.DR/AutoIt.Gen
VIPRE	Trojan.Rasftuby.Gen.8
TrendMicro	TrojanSpy.Win32.REDLINE.YXDIPZ
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Sophos	Mal/Generic-S
Ikarus	Trojan.Script
GData	Trojan.Rasftuby.Gen.8
Avira	DR/AutoIt.Gen
Antiy-AVL	GrayWare/Win32.Wacapew
Gridinsoft	Malware.Win32.RedLine.bot
Arcabit	Trojan.Rasftuby.Gen.8
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/Znyonm
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5434242
McAfee	Artemis!E0CE28AAD08A
MAX	malware (ai score=88)
DeepInstinct	MALICIOUS
VBA32	Trojan.Agent
Panda	Trj/Genetic.gen
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	VBS/Agent.PIFG!tr
AVG	FileRepMalware [Misc]
Cybereason	malicious.96e736
Avast	FileRepMalware [Misc]

The process wscript.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\cmd.exe

1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All