Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 25, 2023, 4:59 p.m.	Sept. 25, 2023, 5:04 p.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`be1b63ef6abc588245cdf4f346b26154`
SHA256	`323f7a2c28d21f7098817977c3854be91f379cb2791fbc5504d6c3342fb163ac`
CRC32	`B0E546BC`
ssdeep	`24576:DJaKfqD927EyXdyIA+T/QOb5zKPd+fDFBS8tzFr6iOhhRwQ35rmrfYYWThRhT:DJKk7EytyTiYuBnOhB3yYd1zT`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Is_DotNET_EXE - (no description)

docrw20230925.exe "C:\Users\test22\AppData\Local\Temp\docrw20230925.exe"
2552
- docrw20230925.exe "C:\Users\test22\AppData\Local\Temp\docrw20230925.exe"
  2820
  - rw22.exe "C:\Users\test22\AppData\Roaming\rw22.exe"
    3028
  - rw22s.exe "C:\Users\test22\AppData\Roaming\rw22s.exe"
    940
- svchost.exe "C:\Users\test22\AppData\Local\Temp\svchost.exe"
  2896
  - svchost.exe "C:\Users\test22\AppData\Local\Temp\svchost.exe"
    1380
  - cmd.exe "cmd" /c mkdir "C:\Users\test22\AppData\Roaming\avast"
    2764
  - cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\avast\avast.exe'" /f
    2836
    - schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\avast\avast.exe'" /f
      2816
  - cmd.exe "cmd" /c copy "C:\Users\test22\AppData\Local\Temp\svchost.exe" "C:\Users\test22\AppData\Roaming\avast\avast.exe"
    2924
- cmd.exe "cmd" /c mkdir "C:\Users\test22\AppData\Roaming\svchost"
  2940
- cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
  2996
  - schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
    2256
- cmd.exe "cmd" /c copy "C:\Users\test22\AppData\Local\Temp\docrw20230925.exe" "C:\Users\test22\AppData\Roaming\svchost\svchost.exe"
  908

Name	Response	Post-Analysis Lookup
mail.royalcheckout.store	CNAME royalcheckout.store A 179.43.183.46	179.43.183.46
ftp.royalcheckout.store	CNAME royalcheckout.store A 179.43.183.46	179.43.183.46
softwarez.online
checkip.dyndns.org	A 132.226.8.169 CNAME checkip.dyndns.com A 193.122.130.0 A 132.226.247.73 A 158.101.44.242 A 193.122.6.168	158.101.44.242
api.ipify.org	A 173.231.16.77 A 64.185.227.156 CNAME api4.ipify.org A 104.237.62.212	104.237.62.212

IP Address	Status	Action
164.124.101.2	Active	Moloch
179.43.183.46	Active	Moloch
193.122.130.0	Active	Moloch
64.185.227.156	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:54148 -> 164.124.101.2:53	2047702	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup	Misc activity
TCP 179.43.183.46:587 -> 192.168.56.101:49174	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 179.43.183.46:587 -> 192.168.56.101:49174	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49174 -> 179.43.183.46:587	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 64.185.227.156:443 -> 192.168.56.101:49173	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49173 -> 64.185.227.156:443	2047703	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI	Misc activity
TCP 192.168.56.101:49173 -> 64.185.227.156:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49173 -> 64.185.227.156:443	2047703	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI	Misc activity
TCP 192.168.56.101:49172 -> 193.122.130.0:80	2021378	ET POLICY External IP Lookup - checkip.dyndns.org	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49172 -> 193.122.130.0:80	2039190	ET INFO 404/Snake/Matiex Keylogger Style External IP Check	Device Retrieving External IP Address Detected
UDP 192.168.56.101:54148 -> 8.8.8.8:53	2047702	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup	Misc activity
TCP 179.43.183.46:21 -> 192.168.56.101:49175	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2043238	ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49173 -> 64.185.227.156:443	2047703	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI	Misc activity

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 25, 2023, 5 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2023, 5 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2023, 5 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2023, 5 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2023, 5 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2023, 5 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2023, 5 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2023, 5 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2023, 5 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2023, 5 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2023, 5 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2023, 5 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (12 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 25, 2023, 4:59 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 4:59 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 5 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 5 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 5 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 5 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 5 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 5 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 5 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 5 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 5 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 5 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 56 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 25, 2023, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b2f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b2f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b2f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b2f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0032b138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cc660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cc660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cc660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cc660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003f4898 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003f4898 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003f4898 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003f4898 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b150 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b150 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b150 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b150 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b190 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b190 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b150 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a4ef8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a4ef8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a4ef8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a4ef8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cd2d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cd2d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cd2d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 5 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cd2d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 25, 2023, 4:59 p.m.		1	1	0

One or more processes crashed (12 events)

Time & API	Arguments	Status
__exception__ Sept. 25, 2023, 5 p.m.	stacktrace: 0x7b0a2c 0x7b09b6 0x7b07f9 0x7b0084 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741d4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 e0 8b 4d dc ff 15 1c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7b3d15 registers.esp: 1372676 registers.edi: 1372700 registers.eax: 0 registers.ebp: 1372712 registers.edx: 195 registers.ebx: 36509788 registers.esi: 36546532 registers.ecx: 0	1
__exception__ Sept. 25, 2023, 5 p.m.	stacktrace: 0x1f014ce DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741d4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 e8 77 dd b4 6f 89 85 b8 fe ff ff 8b 8d b8 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1f02dba registers.esp: 1371584 registers.edi: 1372024 registers.eax: 0 registers.ebp: 1372032 registers.edx: 36901416 registers.ebx: 1372204 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 25, 2023, 5 p.m.	stacktrace: 0x1f09d33 0x1f04a76 0x1f014f1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741d4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 50 04 b8 01 00 00 00 2b d0 71 05 e8 f5 b4 b2 exception.instruction: mov edx, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1f0b04c registers.esp: 1369572 registers.edi: 1370408 registers.eax: 0 registers.ebp: 1371596 registers.edx: 0 registers.ebx: 0 registers.esi: 37373164 registers.ecx: 1	1
__exception__ Sept. 25, 2023, 5 p.m.	stacktrace: 0x1f09d33 0x1f04a76 0x1f014f1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741d4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 ba 01 00 00 00 2b c2 71 05 e8 99 b4 b2 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1f0b0a8 registers.esp: 1369572 registers.edi: 1370408 registers.eax: 0 registers.ebp: 1371596 registers.edx: 0 registers.ebx: 0 registers.esi: 37373164 registers.ecx: 6852284	1
__exception__ Sept. 25, 2023, 5 p.m.	stacktrace: 0x1f09d33 0x1f04a76 0x1f014f1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741d4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 3b 42 04 72 05 e8 df b3 b2 70 c1 e0 04 8d 44 02 exception.instruction: cmp eax, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1f0b0e0 registers.esp: 1369572 registers.edi: 1370408 registers.eax: 0 registers.ebp: 1371596 registers.edx: 0 registers.ebx: 0 registers.esi: 37373164 registers.ecx: 6852284	1
__exception__ Sept. 25, 2023, 5 p.m.	stacktrace: 0x1f09d33 0x1f04a76 0x1f014f1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741d4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 3b 42 04 72 05 e8 85 b3 b2 70 c1 e0 04 8d 44 02 exception.instruction: cmp eax, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1f0b13a registers.esp: 1369572 registers.edi: 1370408 registers.eax: 0 registers.ebp: 1371596 registers.edx: 0 registers.ebx: 0 registers.esi: 37373164 registers.ecx: 6852284	1
__exception__ Sept. 25, 2023, 5 p.m.	stacktrace: 0x1f09d33 0x1f04a76 0x1f014f1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741d4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 3b 42 04 72 05 e8 1f b1 b2 70 c1 e0 04 8d 44 02 exception.instruction: cmp eax, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1f0b3a0 registers.esp: 1369568 registers.edi: 1369812 registers.eax: 0 registers.ebp: 1371596 registers.edx: 0 registers.ebx: 0 registers.esi: 37373164 registers.ecx: 1785613321	1
__exception__ Sept. 25, 2023, 5 p.m.	stacktrace: 0x1f09d33 0x1f04a76 0x1f014f1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741d4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 3b 4f 04 72 05 e8 6c a7 b2 70 c1 e1 04 8d 4c 0f exception.instruction: cmp ecx, dword ptr [edi + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1f0bd53 registers.esp: 1369572 registers.edi: 0 registers.eax: 0 registers.ebp: 1371596 registers.edx: 0 registers.ebx: 0 registers.esi: 37373164 registers.ecx: 0	1
__exception__ Sept. 25, 2023, 5 p.m.	stacktrace: 0x1f0cad8 0x1f04abb 0x1f014f1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741d4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 3b 42 04 0f 9d c0 0f b6 c0 89 45 c8 83 7d c8 00 exception.instruction: cmp eax, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1f0cce1 registers.esp: 1371620 registers.edi: 1371688 registers.eax: 0 registers.ebp: 1371704 registers.edx: 0 registers.ebx: 0 registers.esi: 37373164 registers.ecx: 37504296	1
__exception__ Sept. 25, 2023, 5 p.m.	stacktrace: 0x1f0cad8 0x1f04ad8 0x1f014f1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741d4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 3b 42 04 0f 9d c0 0f b6 c0 89 45 c8 83 7d c8 00 exception.instruction: cmp eax, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1f0cce1 registers.esp: 1371620 registers.edi: 1371688 registers.eax: 3 registers.ebp: 1371704 registers.edx: 0 registers.ebx: 0 registers.esi: 37373164 registers.ecx: 37504296	1
__exception__ Sept. 25, 2023, 5 p.m.	stacktrace: 0x1f0cad8 0x1f04afb 0x1f014f1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741d4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 3b 42 04 0f 9d c0 0f b6 c0 89 45 c8 83 7d c8 00 exception.instruction: cmp eax, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1f0cce1 registers.esp: 1371620 registers.edi: 1371688 registers.eax: 5 registers.ebp: 1371704 registers.edx: 0 registers.ebx: 0 registers.esi: 37373164 registers.ecx: 37504296	1
__exception__ Sept. 25, 2023, 5 p.m.	stacktrace: 0x1f04b13 0x1f014f1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741d4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 e8 84 b9 bb 6f 89 45 ec 6a 00 8b 15 8c 22 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1f0cea5 registers.esp: 1371804 registers.edi: 1372024 registers.eax: 0 registers.ebp: 1371828 registers.edx: 0 registers.ebx: 1372204 registers.esi: 0 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (1 event)

domain

checkip.dyndns.org

Performs some HTTP requests (1 event)

request

GET http://checkip.dyndns.org/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 187 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00610000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00522000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00546000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a0f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 4:59 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02490000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00495000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00497000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00680000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00486000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00487000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2896 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00350000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2896 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (15 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Login Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera\profile\wand.dat
file	C:\Users\test22\AppData\Local\Chromium\User Data
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data

Looks up the external IP address (2 events)

domain	checkip.dyndns.org
domain	api.ipify.org

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Roaming\rw22.exe
file	C:\Users\test22\AppData\Local\Temp\svchost.exe
file	C:\Users\test22\AppData\Roaming\rw22s.exe

Creates a suspicious process (10 events)

cmdline	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
cmdline	"C:\Users\test22\AppData\Local\Temp\svchost.exe"
cmdline	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
cmdline	"cmd" /c mkdir "C:\Users\test22\AppData\Roaming\svchost"
cmdline	"cmd" /c copy "C:\Users\test22\AppData\Local\Temp\svchost.exe" "C:\Users\test22\AppData\Roaming\avast\avast.exe"
cmdline	"C:\Users\test22\AppData\Local\Temp\svchost.exe"
cmdline	C:\Users\test22\AppData\Local\Temp\svchost.exe
cmdline	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\avast\avast.exe'" /f
cmdline	"cmd" /c copy "C:\Users\test22\AppData\Local\Temp\docrw20230925.exe" "C:\Users\test22\AppData\Roaming\svchost\svchost.exe"
cmdline	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\avast\avast.exe'" /f

Drops a binary and executes it (3 events)

file	C:\Users\test22\AppData\Local\Temp\svchost.exe
file	C:\Users\test22\AppData\Roaming\rw22.exe
file	C:\Users\test22\AppData\Roaming\rw22s.exe

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Roaming\rw22.exe
file	C:\Users\test22\AppData\Roaming\rw22s.exe
file	C:\Users\test22\AppData\Local\Temp\svchost.exe

A process created a hidden window (6 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 2944 thread_handle: 0x00000420 process_identifier: 2940 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd" /c mkdir "C:\Users\test22\AppData\Roaming\svchost" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003e0	1	1
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 3000 thread_handle: 0x00000420 process_identifier: 2996 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000448	1	1
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 2072 thread_handle: 0x00000420 process_identifier: 908 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd" /c copy "C:\Users\test22\AppData\Local\Temp\docrw20230925.exe" "C:\Users\test22\AppData\Roaming\svchost\svchost.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000450	1	1
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 1156 thread_handle: 0x00000298 process_identifier: 2764 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd" /c mkdir "C:\Users\test22\AppData\Roaming\avast" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002ac	1	1
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 2840 thread_handle: 0x00000298 process_identifier: 2836 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\avast\avast.exe'" /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002b8	1	1
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 2964 thread_handle: 0x00000298 process_identifier: 2924 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd" /c copy "C:\Users\test22\AppData\Local\Temp\svchost.exe" "C:\Users\test22\AppData\Roaming\avast\avast.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002bc	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 25, 2023, 5 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00123200', u'virtual_address': u'0x00002000', u'entropy': 7.980499996239429, u'name': u'.text', u'virtual_size': u'0x00123078'}

entropy

7.98049999624

description

A section with a high entropy has been found

entropy

0.878867924528

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 25, 2023, 5 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 25, 2023, 5 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (19 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Communications smtp	rule	Network_SMTP_dotNet
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Run a KeyLogger	rule	KeyLogger

Created a process named as a common system process (3 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 2900 thread_handle: 0x00000448 process_identifier: 2896 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\svchost.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\svchost.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\svchost.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000450	1	1
ShellExecuteExW Sept. 25, 2023, 5 p.m.	show_type: 1 filepath_r: C:\Users\test22\AppData\Local\Temp\\svchost.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\svchost.exe	1	1
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 2736 thread_handle: 0x00000278 process_identifier: 1380 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\svchost.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\svchost.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\svchost.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000027c	1	1

Uses Windows utilities for basic Windows functionality (6 events)

cmdline	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
cmdline	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
cmdline	"cmd" /c mkdir "C:\Users\test22\AppData\Roaming\svchost"
cmdline	"cmd" /c mkdir "C:\Users\test22\AppData\Roaming\avast"
cmdline	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\avast\avast.exe'" /f
cmdline	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\avast\avast.exe'" /f

Makes SMTP requests, possibly sending spam (1 event)

receiver

[]

sender

[]

server

179.43.183.46

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 417792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000027c	1	0	0
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 1380 region_size: 98304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000027c	1	0	0

Attempts to identify installed AV products by installation directory (1 event)

file	C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data\Default\Login Data

A process attempted to delay the analysis task. (2 events)

description	rw22.exe tried to sleep 2728223 seconds, actually delayed analysis time by 2728223 seconds
description	rw22s.exe tried to sleep 143 seconds, actually delayed analysis time by 143 seconds

Installs itself for autorun at Windows startup (4 events)

cmdline	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
cmdline	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
cmdline	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\avast\avast.exe'" /f
cmdline	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\avast\avast.exe'" /f

Harvests credentials from local FTP client softwares (5 events)

file	C:\Users\test22\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect
file	C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
registry	HKEY_CURRENT_USER\SOFTWARE\FTPWare\COREFTP\Sites

Harvests information related to installed instant messenger clients (1 event)

file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml

Potential code injection by writing to the memory of another process (7 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELT£eàú> @ `@èS 0@ H.textDù ú `.rsrc0 ü@@.reloc@@B base_address: 0x00400000 process_identifier: 2820 process_handle: 0x0000027c	1	1
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: 0HX ØØ4VS_VERSION_INFO½ïþ-Y-Y?DVarFileInfo$Translation°8StringFileInfo000004b00CompanyNamecommonHFileDescriptiondrenchdownward4 FileVersion4.7.89.450InternalNamerw.exeHLegalCopyrightpresent © drunken8OriginalFilenamerw.exe,ProductNamebelly8 ProductVersion4.7.89.45< Assembly Version4.7.89.45 base_address: 0x00462000 process_identifier: 2820 process_handle: 0x0000027c	1	1
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: @9 base_address: 0x00464000 process_identifier: 2820 process_handle: 0x0000027c	1	1
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2820 process_handle: 0x0000027c	1	1
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²X`à þ= @@ .@¤=W@¸ ` H.text `.rsrc¸ @"@@.reloc`0@B base_address: 0x00400000 process_identifier: 1380 process_handle: 0x0000027c	1	1
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: 0> base_address: 0x00416000 process_identifier: 1380 process_handle: 0x0000027c	1	1
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1380 process_handle: 0x0000027c	1	1

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELT£eàú> @ `@èS 0@ H.textDù ú `.rsrc0 ü@@.reloc@@B base_address: 0x00400000 process_identifier: 2820 process_handle: 0x0000027c	1	1	0
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²X`à þ= @@ .@¤=W@¸ ` H.text `.rsrc¸ @"@@.reloc`0@B base_address: 0x00400000 process_identifier: 1380 process_handle: 0x0000027c	1	1	0

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExA Sept. 25, 2023, 5 p.m.	thread_identifier: 0 callback_function: 0x003c08ca hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00270000	1	524659	0

Harvests credentials from local email clients (6 events)

file	C:\Users\test22\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect
file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\RimArts\B2\Settings
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2552 called NtSetContextThread to modify thread in remote process 2820
Process injection	Process 2896 called NtSetContextThread to modify thread in remote process 1380
NtSetContextThread Sept. 25, 2023, 5 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4593982 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000278 process_identifier: 2820	1	0	0
NtSetContextThread Sept. 25, 2023, 5 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4210174 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000278 process_identifier: 1380	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2552 resumed a thread in remote process 2820
Process injection	Process 2896 resumed a thread in remote process 1380
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x00000278 suspend_count: 1 process_identifier: 2820	1	0	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x00000278 suspend_count: 1 process_identifier: 1380	1	0	0

Executed a process and injected code into it, probably while unpacking (50 out of 61 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 25, 2023, 4:59 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2552	1	0
NtResumeThread Sept. 25, 2023, 4:59 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2552	1	0
NtResumeThread Sept. 25, 2023, 4:59 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2552	1	0
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 2824 thread_handle: 0x00000278 process_identifier: 2820 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\docrw20230925.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\docrw20230925.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\docrw20230925.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000027c	1	1
NtGetContextThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x00000278	1	0
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 2820 region_size: 417792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000027c	1	0
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELT£eàú> @ `@èS 0@ H.textDù ú `.rsrc0 ü@@.reloc@@B base_address: 0x00400000 process_identifier: 2820 process_handle: 0x0000027c	1	1
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: base_address: 0x00402000 process_identifier: 2820 process_handle: 0x0000027c	1	1
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: 0HX ØØ4VS_VERSION_INFO½ïþ-Y-Y?DVarFileInfo$Translation°8StringFileInfo000004b00CompanyNamecommonHFileDescriptiondrenchdownward4 FileVersion4.7.89.450InternalNamerw.exeHLegalCopyrightpresent © drunken8OriginalFilenamerw.exe,ProductNamebelly8 ProductVersion4.7.89.45< Assembly Version4.7.89.45 base_address: 0x00462000 process_identifier: 2820 process_handle: 0x0000027c	1	1
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: @9 base_address: 0x00464000 process_identifier: 2820 process_handle: 0x0000027c	1	1
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2820 process_handle: 0x0000027c	1	1
NtSetContextThread Sept. 25, 2023, 5 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4593982 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000278 process_identifier: 2820	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x00000278 suspend_count: 1 process_identifier: 2820	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x000002ac suspend_count: 1 process_identifier: 2552	1	0
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 2900 thread_handle: 0x00000448 process_identifier: 2896 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\svchost.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\svchost.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\svchost.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000450	1	1
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 2944 thread_handle: 0x00000420 process_identifier: 2940 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd" /c mkdir "C:\Users\test22\AppData\Roaming\svchost" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003e0	1	1
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 3000 thread_handle: 0x00000420 process_identifier: 2996 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000448	1	1
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 2072 thread_handle: 0x00000420 process_identifier: 908 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd" /c copy "C:\Users\test22\AppData\Local\Temp\docrw20230925.exe" "C:\Users\test22\AppData\Roaming\svchost\svchost.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000450	1	1
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2820	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2820	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x000001c0 suspend_count: 1 process_identifier: 2820	1	0
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 3032 thread_handle: 0x00000350 process_identifier: 3028 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\rw22.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\rw22.exe" filepath_r: C:\Users\test22\AppData\Roaming\rw22.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000358	1	1
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 1964 thread_handle: 0x000002ec process_identifier: 940 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\rw22s.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\rw22s.exe" filepath_r: C:\Users\test22\AppData\Roaming\rw22s.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000380	1	1
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2896	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2896	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x000001d0 suspend_count: 1 process_identifier: 2896	1	0
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 2736 thread_handle: 0x00000278 process_identifier: 1380 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\svchost.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\svchost.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\svchost.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000027c	1	1
NtGetContextThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x00000278	1	0
NtAllocateVirtualMemory Sept. 25, 2023, 5 p.m.	process_identifier: 1380 region_size: 98304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000027c	1	0
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²X`à þ= @@ .@¤=W@¸ ` H.text `.rsrc¸ @"@@.reloc`0@B base_address: 0x00400000 process_identifier: 1380 process_handle: 0x0000027c	1	1
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: base_address: 0x00402000 process_identifier: 1380 process_handle: 0x0000027c	1	1
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: base_address: 0x00404000 process_identifier: 1380 process_handle: 0x0000027c	1	1
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: 0> base_address: 0x00416000 process_identifier: 1380 process_handle: 0x0000027c	1	1
WriteProcessMemory Sept. 25, 2023, 5 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1380 process_handle: 0x0000027c	1	1
NtSetContextThread Sept. 25, 2023, 5 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4210174 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000278 process_identifier: 1380	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x00000278 suspend_count: 1 process_identifier: 1380	1	0
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 1156 thread_handle: 0x00000298 process_identifier: 2764 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd" /c mkdir "C:\Users\test22\AppData\Roaming\avast" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002ac	1	1
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 2840 thread_handle: 0x00000298 process_identifier: 2836 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\avast\avast.exe'" /f filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002b8	1	1
CreateProcessInternalW Sept. 25, 2023, 5 p.m.	thread_identifier: 2964 thread_handle: 0x00000298 process_identifier: 2924 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd" /c copy "C:\Users\test22\AppData\Local\Temp\svchost.exe" "C:\Users\test22\AppData\Roaming\avast\avast.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002bc	1	1
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 3028	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 3028	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x000001cc suspend_count: 1 process_identifier: 3028	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x0000027c suspend_count: 1 process_identifier: 3028	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x000002f0 suspend_count: 1 process_identifier: 3028	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x00000368 suspend_count: 1 process_identifier: 3028	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x000003a0 suspend_count: 1 process_identifier: 3028	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x000004e4 suspend_count: 1 process_identifier: 3028	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x00000634 suspend_count: 1 process_identifier: 3028	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x000003a0 suspend_count: 1 process_identifier: 3028	1	0
NtResumeThread Sept. 25, 2023, 5 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 940	1	0

docrw20230925.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All