Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Jan. 8, 2024, 9:35 a.m.	Jan. 8, 2024, 9:39 a.m.

Size	2.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`526a60e929f138a26e787599b03b11e3`
SHA256	`35f53c5cca6b39903694aff2fa966bce4165c79ea707c54200096d5756a3ef05`
CRC32	`536AAA94`
ssdeep	`49152:IBJCfMtUPyBZFPZm9Yc8B0TTBqYH0LSjUvX:yQUsyvVZm95BTB5q5X`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

ajajjajajaj.exe "C:\Users\test22\AppData\Local\Temp\ajajjajajaj.exe"
840
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\portBrowserWebFontwin\Wpqih7cz6fMRtU.vbe"
  1984
  - cmd.exe cmd /c ""C:\portBrowserWebFontwin\l1IRr8npYRL3m1TwDlV7BI8krChTb4.bat" "
    2600
    - componentwin.exe "C:\portBrowserWebFontwin/componentwin.exe"
      2660
      - powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\_Sandboxie\componentwin.exe'
        2896
      - powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\GPKI\componentwin.exe'
        2940
      - powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\lsass.exe'
        2984
      - powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\ab7d780a-0706-11e8-9512-b992fd7a33be\explorer.exe'
        3040
      - powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\util\TCPView\lsm.exe'
        2100

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (10 events)

Time & API	Arguments	Status	Return
GetComputerNameW Jan. 8, 2024, 9:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 8, 2024, 9:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 8, 2024, 9:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 8, 2024, 9:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 8, 2024, 9:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 8, 2024, 9:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 8, 2024, 9:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 8, 2024, 9:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 8, 2024, 9:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 8, 2024, 9:29 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 8, 2024, 9:28 a.m.			0	0
IsDebuggerPresent Jan. 8, 2024, 9:28 a.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Jan. 8, 2024, 9:35 a.m.	buffer: C:\portBrowserWebFontwin> console_handle: 0x00000007	1	1	0
WriteConsoleW Jan. 8, 2024, 9:35 a.m.	buffer: "C:\portBrowserWebFontwin/componentwin.exe" console_handle: 0x00000007	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 8, 2024, 9:28 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 329 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000930000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000980000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2491000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b2b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 2555904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000022e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000024d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2492000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2492000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2492000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2492000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2492000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2492000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2492000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2492000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2492000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2492000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2492000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2494000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2494000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2494000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2494000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92dbc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92de6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92dc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d1d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e62000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d0b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e63000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92eaf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ea0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e64000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d1a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d2b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d2d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e65000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000008e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 8, 2024, 9:28 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0eb6000 process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Jan. 8, 2024, 9:29 a.m.	total_number_of_free_bytes: 9929330688 free_bytes_available: 9929330688 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\PXK4YQJKrU.bat
file	C:\portBrowserWebFontwin\Wpqih7cz6fMRtU.vbe
file	C:\portBrowserWebFontwin\l1IRr8npYRL3m1TwDlV7BI8krChTb4.bat
file	C:\portBrowserWebFontwin\componentwin.exe

Creates a shortcut to an executable file (1 event)

file	C:\portBrowserWebFontwin\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (5 events)

cmdline	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\lsass.exe'
cmdline	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\GPKI\componentwin.exe'
cmdline	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\ab7d780a-0706-11e8-9512-b992fd7a33be\explorer.exe'
cmdline	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\_Sandboxie\componentwin.exe'
cmdline	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\util\TCPView\lsm.exe'

Drops a binary and executes it (2 events)

file	C:\portBrowserWebFontwin\Wpqih7cz6fMRtU.vbe
file	C:\portBrowserWebFontwin\componentwin.exe

A process created a hidden window (6 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Jan. 8, 2024, 9:35 a.m.	show_type: 0 filepath_r: C:/portBrowserWebFontwin//l1IRr8npYRL3m1TwDlV7BI8krChTb4.bat parameters: filepath: C:/portBrowserWebFontwin//l1IRr8npYRL3m1TwDlV7BI8krChTb4.bat	1	1
CreateProcessInternalW Jan. 8, 2024, 9:29 a.m.	thread_identifier: 2900 thread_handle: 0x0000000000000230 process_identifier: 2896 current_directory: C:\portBrowserWebFontwin filepath: track: 1 command_line: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\_Sandboxie\componentwin.exe' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000000000000022c	1	1
CreateProcessInternalW Jan. 8, 2024, 9:29 a.m.	thread_identifier: 2944 thread_handle: 0x0000000000000230 process_identifier: 2940 current_directory: C:\portBrowserWebFontwin filepath: track: 1 command_line: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\GPKI\componentwin.exe' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000300	1	1
CreateProcessInternalW Jan. 8, 2024, 9:29 a.m.	thread_identifier: 2988 thread_handle: 0x0000000000000230 process_identifier: 2984 current_directory: C:\portBrowserWebFontwin filepath: track: 1 command_line: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\lsass.exe' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000000000000030c	1	1
CreateProcessInternalW Jan. 8, 2024, 9:29 a.m.	thread_identifier: 3044 thread_handle: 0x0000000000000230 process_identifier: 3040 current_directory: C:\portBrowserWebFontwin filepath: track: 1 command_line: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\ab7d780a-0706-11e8-9512-b992fd7a33be\explorer.exe' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000310	1	1
CreateProcessInternalW Jan. 8, 2024, 9:29 a.m.	thread_identifier: 2092 thread_handle: 0x0000000000000230 process_identifier: 2100 current_directory: C:\portBrowserWebFontwin filepath: track: 1 command_line: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\util\TCPView\lsm.exe' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000314	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Jan. 8, 2024, 9:28 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	C:/portBrowserWebFontwin//l1IRr8npYRL3m1TwDlV7BI8krChTb4.bat
parent_process	wscript.exe				martian_process	"C:\portBrowserWebFontwin\l1IRr8npYRL3m1TwDlV7BI8krChTb4.bat"

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 840 resumed a thread in remote process 1984
NtResumeThread Jan. 8, 2024, 9:35 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 1984	1	0	0

The process wscript.exe wrote an executable file to disk (1 event)

file	C:\Windows\SysWOW64\wscript.exe

Uses Sysinternals tools in order to add additional command line functionality (1 event)

cmdline

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\util\TCPView\lsm.exe'

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Uztuby.4!c
MicroWorld-eScan	Trojan.Uztuby.19
CAT-QuickHeal	Trojan.Multi
Skyhigh	BehavesLike.Win32.Generic.vc
McAfee	Artemis!526A60E929F1
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Trojan.Uztuby.19
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005690671 )
Alibaba	Trojan:MSIL/Kryptik.f0b29e50
K7GW	Trojan ( 005690671 )
VirIT	Trojan.VBS.Agent.BEX
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	multiple detections
APEX	Malicious
ClamAV	Win.Packed.Uztuby-10009381-0
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.Uztuby.19
NANO-Antivirus	Trojan.Win32.Dnoper.kgqucd
Avast	Win32:Evo-gen [Trj]
Tencent	Msil.Trojan.Dnoper.Ddhl
Sophos	Mal/RarMal-R
F-Secure	Trojan.TR/Kryptik.uijsc
DrWeb	VBS.Starter.320
TrendMicro	TROJ_GEN.R002C0RA624
Emsisoft	Trojan.Uztuby.19 (B)
SentinelOne	Static AI - Malicious SFX
MAX	malware (ai score=89)
Webroot	W32.Trojan.Uztuby
Google	Detected
Avira	VBS/Runner.VPG
Varist	W32/S-1b09bef6!Eldorado
Antiy-AVL	Trojan/MSIL.Kryptik
Kingsoft	Win32.Troj.Unknown.a
Microsoft	Trojan:Win32/Znyonm
Gridinsoft	Ransom.Win32.Sabsik.sa
Arcabit	Trojan.Uztuby.19 [many]
ZoneAlarm	HEUR:Trojan.MSIL.Dnoper.gen
GData	Trojan.Zmutzy.Lscpt.1
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Uztuby.C5571149
BitDefenderTheta	Gen:NN.ZemsilF.36680.ao0@aql2TSj
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002C0RA624
Rising	Trojan.Dnoper!8.10CB3 (CLOUD)
Ikarus	Trojan.MSIL.Crypt
Fortinet	MSIL/Kryptik.AJQX!tr

ajajjajajaj.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All