Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Feb. 19, 2025, 10:42 a.m.	Feb. 19, 2025, 10:45 a.m.

Size	14.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`39c2f63970a0b2b1942e7072a6c648dc`
SHA256	`dc6ac7c9a0ee76114089b9d56ebeea20a6b23fe4b39b8114191f149031105d36`
CRC32	`135944A7`
ssdeep	`196608:9KwhcG+w6nD9shodiR5gfX/kPbhLbi4g9Rz1tF8JTU/bo7I8CRRRV24E8RwfBB8Y:9PawqkodizgPyhLG7Rz1tWJ4e4DVwfnf`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Antivirus - Contains references to security software Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet IsPE32 - (no description) Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check mzp_file_format - MZP(Delphi) file format UPX_Zero - UPX packed file

TestLAB.exe "C:\Users\test22\AppData\Local\Temp\TestLAB.exe"
800
- TestLAB.tmp "C:\Users\test22\AppData\Local\Temp\is-9L5T6.tmp\TestLAB.tmp" /SL5="$30028,13626613,119296,C:\Users\test22\AppData\Local\Temp\TestLAB.exe"
  2076
  - TestLAB.exe "C:\Users\test22\AppData\Local\Temp\TestLAB.exe" /VERYSILENT
    2216
    - TestLAB.tmp "C:\Users\test22\AppData\Local\Temp\is-PFNS0.tmp\TestLAB.tmp" /SL5="$40028,13626613,119296,C:\Users\test22\AppData\Local\Temp\TestLAB.exe" /VERYSILENT
      2260
      - OperaAirSetup.exe "C:\Users\test22\AppData\Roaming\{EA11343B-B7FA-4762-9963-C343D36A91DA}\OperaAirSetup.exe"
        2664
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW Feb. 19, 2025, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Feb. 19, 2025, 10:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2025, 10:43 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 19, 2025, 10:42 a.m.			0	0
IsDebuggerPresent Feb. 19, 2025, 10:42 a.m.			0	0
IsDebuggerPresent Feb. 19, 2025, 10:43 a.m.			0	0
IsDebuggerPresent Feb. 19, 2025, 10:43 a.m.			0	0
IsDebuggerPresent Feb. 19, 2025, 10:43 a.m.			0	0
IsDebuggerPresent Feb. 19, 2025, 10:43 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (10 events)

Time & API	Arguments	Status	Return
CryptExportKey Feb. 19, 2025, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00304d68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2025, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00304d68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2025, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00304e28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2025, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00304e28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1
CryptExportKey Feb. 19, 2025, 10:43 a.m.	buffer: f ùVÚª\'óoRcNK'ÓÑÌPÓA"?$ crypto_handle: 0x00304e28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1
CryptExportKey Feb. 19, 2025, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00304ca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2025, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00304ca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2025, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00304a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2025, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00304a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1
CryptExportKey Feb. 19, 2025, 10:43 a.m.	buffer: f ùVÚª\'óoRcNK'ÓÑÌPÓA"?$ crypto_handle: 0x00304a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 19, 2025, 10:43 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Feb. 19, 2025, 10:42 a.m.	stacktrace: testlab+0xe2bed @ 0x4e2bed testlab+0x1000fa @ 0x5000fa BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1637828 registers.edi: 4891672 registers.eax: 1637828 registers.ebp: 1637908 registers.edx: 0 registers.ebx: 5123053 registers.esi: 2 registers.ecx: 7	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 136 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Feb. 19, 2025, 10:42 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2025, 10:42 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 69632 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2025, 10:42 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 53248 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041b000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:42 a.m.	process_identifier: 2076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00630000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:35 a.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004d20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2025, 10:42 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2025, 10:42 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 69632 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2025, 10:42 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 53248 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041b000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:42 a.m.	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00390000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02340000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77900000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02340000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02390000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02570000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02670000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02322000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02391000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02392000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0232a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0232c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02393000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0234c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0236b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02367000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02394000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02356000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02365000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0235a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02357000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0234d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0234e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0234f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d33000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d34000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c7d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c7e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0234a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c7f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74834000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 10:43 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (6 events)

file	C:\Users\test22\AppData\Local\Temp\is-5T67G.tmp\_isetup\_isdecmp.dll
file	C:\Users\test22\AppData\Local\Temp\is-BMSRI.tmp\_isetup\_isdecmp.dll
file	C:\Users\test22\AppData\Local\Temp\is-5T67G.tmp\_isetup\_shfoldr.dll
file	C:\Users\test22\AppData\Local\Temp\is-BMSRI.tmp\_isetup\_iscrypt.dll
file	C:\Users\test22\AppData\Local\Temp\is-BMSRI.tmp\_isetup\_shfoldr.dll
file	C:\Users\test22\AppData\Local\Temp\is-5T67G.tmp\_isetup\_iscrypt.dll

Drops an executable to the user AppData folder (4 events)

file	C:\Users\test22\AppData\Local\Temp\is-5T67G.tmp\_isetup\_isdecmp.dll
file	C:\Users\test22\AppData\Local\Temp\is-9L5T6.tmp\TestLAB.tmp
file	C:\Users\test22\AppData\Local\Temp\is-5T67G.tmp\_isetup\_shfoldr.dll
file	C:\Users\test22\AppData\Local\Temp\is-5T67G.tmp\_isetup\_iscrypt.dll

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Feb. 19, 2025, 10:42 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\TestLAB.exe parameters: /VERYSILENT filepath: C:\Users\test22\AppData\Local\Temp\TestLAB.exe	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (32 events)

Time & API	Arguments	Status	Return
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: smss.exe process_identifier: 232	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: csrss.exe process_identifier: 308	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: wininit.exe process_identifier: 344	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: csrss.exe process_identifier: 356	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: winlogon.exe process_identifier: 392	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: services.exe process_identifier: 436	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 560	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 636	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 716	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 780	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 824	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: audiodg.exe process_identifier: 896	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 984	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 340	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: spoolsv.exe process_identifier: 1060	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: taskhost.exe process_identifier: 1112	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 1120	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: dwm.exe process_identifier: 1192	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: explorer.exe process_identifier: 1236	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 1744	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: pw.exe process_identifier: 1888	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: SearchIndexer.exe process_identifier: 1652	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: mobsync.exe process_identifier: 2032	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: pw.exe process_identifier: 1700	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: taskhost.exe process_identifier: 296	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: cmd.exe process_identifier: 508	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: SearchProtocolHost.exe process_identifier: 1156	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: conhost.exe process_identifier: 1880	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: SearchFilterHost.exe process_identifier: 1132	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: pw.exe process_identifier: 1792	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: TestLAB.exe process_identifier: 2216	1	1
Process32NextW Feb. 19, 2025, 10:43 a.m.	snapshot_handle: 0x000001f4 process_name: TestLAB.tmp process_identifier: 2260	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Feb. 19, 2025, 10:43 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Feb. 19, 2025, 10:43 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Queries for potentially installed applications (2 events)

Time & API	Arguments	Status	Return	Repeated
RegOpenKeyExW Feb. 19, 2025, 10:42 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Artist_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Artist_is1		2	0
RegOpenKeyExW Feb. 19, 2025, 10:42 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Artist_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Artist_is1		2	0

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 1cbda383bf66f25032f99148ee900b8a88a37a40

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-9L5T6.tmp\TestLAB.tmp

TestLAB.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All