Summary

Category	Machine	Started	Completed
ARCHIVE	s1_win7_x6401	June 8, 2024, 2:47 a.m.	June 8, 2024, 2:59 a.m.

Archive Open-Audit-Classic-master/apache/oa-importcert.cmd @ Open-Audit-Classic-master.zip

Size	354.0B
Type	DOS batch file, ASCII text
MD5	`4d3f949bda6999f920d5338e785f75f2`
SHA1	`28c706277d5cf62ac2ddabac85c688e909899c08`
SHA256	`a53af748d50dc73f90e978644a058096d2f7f418018bd7569fd5b18eff2bcc9f`
SHA512	`811b4c3ddc8e87cbf1ba139f2deb8bd22d9f7dfa7b240dff887daddef27cdc8255d6ca3bc3803d0fe8d969fe56270141e05a6ca55347c0911ed7827db4e1353f`
CRC32	`1AD02C0B`
ssdeep	`6:h4idI2KWztncQB8wPyfY/YTXFTyHMlYB8wXsOI5JZFsz/dKdH6FjCBY9n:eEXX5zB8wPFAUE08wXsOI5NciHajC4n`
Yara	None matched

cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Open-Audit-Classic-master/apache/oa-importcert.cmd
2836
- net.exe net session
  2924
  - net1.exe C:\Windows\system32\net1 session
    2976
- powershell.exe powershell -EP Bypass -C "Import-Certificate -FilePath C:\Progra~2\xampplite\apache\conf\ssl.crt\openaudit.crt -CertStoreLocation Cert:\LocalMachine\Root"
  1520

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 8, 2024, 2:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 8, 2024, 2:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 8, 2024, 2:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 8, 2024, 2:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 8, 2024, 2:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 8, 2024, 2:57 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 8, 2024, 2:57 a.m.			0	0

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 8, 2024, 2:57 a.m.	buffer: The term 'Import-Certificate' is not recognized as the name of a cmdlet, functi console_handle: 0x00000023	1	1
WriteConsoleW June 8, 2024, 2:57 a.m.	buffer: on, script file, or operable program. Check the spelling of the name, or if a p console_handle: 0x0000002f	1	1
WriteConsoleW June 8, 2024, 2:57 a.m.	buffer: ath was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW June 8, 2024, 2:57 a.m.	buffer: At line:1 char:19 console_handle: 0x00000047	1	1
WriteConsoleW June 8, 2024, 2:57 a.m.	buffer: + Import-Certificate <<<< -FilePath C:\Progra~2\xampplite\apache\conf\ssl.crt\ console_handle: 0x00000053	1	1
WriteConsoleW June 8, 2024, 2:57 a.m.	buffer: openaudit.crt -CertStoreLocation Cert:\LocalMachine\Root console_handle: 0x0000005f	1	1
WriteConsoleW June 8, 2024, 2:57 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Import-Certificate:String) [], console_handle: 0x0000006b	1	1
WriteConsoleW June 8, 2024, 2:57 a.m.	buffer: CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW June 8, 2024, 2:57 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f7f70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8870 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8870 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8870 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8870 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8870 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8870 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f83f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f83f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f83f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f7bf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f7bf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f7bf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f7bf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f7bf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f7bf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f7bf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f7bf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f7bf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f7bf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f7bf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f7bf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f7bf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f7bf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 8, 2024, 2:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f8830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 7, 2024, 11:46 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 137 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02960000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eda000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01edb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02820000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f03000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f04000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f05000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f07000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f08000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f09000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a62000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a63000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a64000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a65000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a66000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a67000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a68000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a69000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a6a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a6d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a6e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a6f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b53000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 8, 2024, 2:57 a.m.	process_identifier: 1520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

powershell -EP Bypass -C "Import-Certificate -FilePath C:\Progra~2\xampplite\apache\conf\ssl.crt\openaudit.crt -CertStoreLocation Cert:\LocalMachine\Root"

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 8, 2024, 2:57 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (4 events)

url	http://www.microsoft.com/pki/certs/CSPCA.crt0
url	http://www.xmlspy.com
url	http://www.microsoft.com/pki/certs/tspca.crt0
url	http://microsoft.com0

Yara rule detected in process memory (50 out of 132 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Communications smtp	rule	Network_SMTP_dotNet
description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerHiding__Thread
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win
description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

net session

Creates a suspicious Powershell process (1 event)

option

-ep bypass

value

Attempts to bypass execution policy

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Archive Open-Audit-Classic-master/apache/oa-importcert.cmd @ Open-Audit-Classic-master.zip

Summary

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All