Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 3, 2025, 4:37 p.m.	May 3, 2025, 4:42 p.m.

Size	2.6MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`117e92efaeb6e9ce06d12865a522e455`
SHA256	`b14707aaebb5aeda520e63a3b327f3a14cae0b477fc20e4f6906358bc3880a82`
CRC32	`92136D70`
ssdeep	`49152:9DDlpadsLPvNTpc8iYM9+SFBWFuLiCJ53aUHifaNshTPWl6wIl4:LpaAlTFMsFALiCrqUHzNshKl6u`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

random.exe "C:\Users\test22\AppData\Local\Temp\random.exe"
1572
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\34.bat" "
  2204
  - cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\34.bat" any_word
    2272
    - chcp.com chcp 65001
      2364
    - reg.exe reg query "HKU\S-1-5-19"
      2408
    - reg.exe reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
      2452
    - NSudoLG.exe NSudoLG -U:T -P:E -UseCurrentConsole C:\Users\test22\AppData\Local\Temp\34.bat
      2496
      - cmd.exe cmd /c C:\Users\test22\AppData\Local\Temp\34.bat
        2624
        
        cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\34.bat" any_word
        2712
        
        chcp.com chcp 65001
        2796
        
        reg.exe reg query "HKU\S-1-5-19"
        2840
        
        reg.exe reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
        2884
        
        mode.com Mode 79,49
        2940
        
        cmd.exe C:\Windows\system32\cmd.exe /c ver
        3040
        
        reg.exe reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
        1440
        
        find.exe find /i "0x0"
        2120
        
        cmd.exe C:\Windows\system32\cmd.exe /c tasklist
        2236
        
        tasklist.exe tasklist
        2288
        
        reg.exe reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
        2584
        
        reg.exe reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
        2812
        
        reg.exe reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
        2800
        
        reg.exe reg query "HKLM\System\CurrentControlSet\Services\Sense"
        2900
        
        reg.exe reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
        3012
        
        reg.exe reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
        1960
        
        reg.exe reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
        1156
        
        reg.exe reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
        2316
        
        reg.exe reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
        2172
        
        reg.exe reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
        1800
        
        reg.exe reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
        2708
        
        reg.exe reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
        2880
        
        reg.exe reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
        2968
        
        reg.exe reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
        2100
        
        reg.exe reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
        1820
        
        reg.exe reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
        2356
        
        reg.exe reg query HKLM\System\CurrentControlset\Services\WdFilter
        1044
        
        find.exe find /i "Windows 7"
        3020
        
        reg.exe reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
        2628

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.156.72.96	Active	Moloch
80.64.18.219	Active	Moloch
94.26.90.80	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 94.26.90.80:80 -> 192.168.56.103:49174	2400012	ET DROP Spamhaus DROP Listed Traffic Inbound group 13	Misc Attack
TCP 185.156.72.96:80 -> 192.168.56.103:49169	2400031	ET DROP Spamhaus DROP Listed Traffic Inbound group 32	Misc Attack

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (50 out of 641 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: if console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: "" /min "C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\34.bat" any_word console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: exit console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: /b console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: if console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: "any_word" == "" console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: "" /min "C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\34.bat" any_word console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: exit console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: /b console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: chcp console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: nul console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: Color console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: 0f console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: set console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: "Arch=" console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: set console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: "ArgNsudo=" console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: set console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: "MainFolder1=" console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: set console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: "MainFolder2=" console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: set console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: "ProcList=" console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: set console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: "NumberWin=" console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: SetLocal console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: EnableDelayedExpansion console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: cd console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: /d "C:\Users\test22\AppData\Local\Temp\Work" console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\Work> console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: set console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: "Arch=x64" console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: If console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: "x86" == "x86" console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: if console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: not console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: defined PROCESSOR_ARCHITEW6432 console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: set console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: Arch=x86 console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\Work> console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: reg console_handle: 0x00000007	1	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

One or more processes crashed (28 events)

Time & API	Arguments	Status
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1b9873 @ 0x1079873 random+0x1478dc @ 0x10078dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x1241d9 exception.instruction: div eax exception.module: random.exe exception.exception_code: 0xc0000094 exception.offset: 1196505 exception.address: 0xfe41d9 registers.esp: 3799928 registers.edi: 17252492 registers.eax: 0 registers.ebp: 3799956 registers.edx: 0 registers.ebx: 13185852 registers.esi: 6 registers.ecx: 13185852	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1b9873 @ 0x1079873 random+0x1478dc @ 0x10078dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x124204 exception.instruction: ud2 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 1196548 exception.address: 0xfe4204 registers.esp: 3799928 registers.edi: 3799928 registers.eax: 0 registers.ebp: 3799956 registers.edx: 2 registers.ebx: 16663023 registers.esi: 0 registers.ecx: 3800136	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1b9873 @ 0x1079873 random+0x1478dc @ 0x10078dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x124204 exception.instruction: ud2 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 1196548 exception.address: 0xfe4204 registers.esp: 3799928 registers.edi: 3799928 registers.eax: 0 registers.ebp: 3799956 registers.edx: 2 registers.ebx: 16663066 registers.esi: 0 registers.ecx: 3800136	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcc64 @ 0x107cc64 random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x1241d9 exception.instruction: div eax exception.module: random.exe exception.exception_code: 0xc0000094 exception.offset: 1196505 exception.address: 0xfe41d9 registers.esp: 3799880 registers.edi: 17252492 registers.eax: 0 registers.ebp: 3799908 registers.edx: 0 registers.ebx: 11722752 registers.esi: 15917056 registers.ecx: 15917056	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcc64 @ 0x107cc64 random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x124204 exception.instruction: ud2 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 1196548 exception.address: 0xfe4204 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 2 registers.ebx: 16663023 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcc64 @ 0x107cc64 random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x1241d9 exception.instruction: div eax exception.module: random.exe exception.exception_code: 0xc0000094 exception.offset: 1196505 exception.address: 0xfe41d9 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 0 registers.ebx: 16663066 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcc64 @ 0x107cc64 random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x124204 exception.instruction: ud2 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 1196548 exception.address: 0xfe4204 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 2 registers.ebx: 16663023 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcc64 @ 0x107cc64 random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x1241d9 exception.instruction: div eax exception.module: random.exe exception.exception_code: 0xc0000094 exception.offset: 1196505 exception.address: 0xfe41d9 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 0 registers.ebx: 16663066 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcc64 @ 0x107cc64 random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x124204 exception.instruction: ud2 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 1196548 exception.address: 0xfe4204 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 2 registers.ebx: 16663023 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcd40 @ 0x107cd40 random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x124204 exception.instruction: ud2 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 1196548 exception.address: 0xfe4204 registers.esp: 3799880 registers.edi: 17252492 registers.eax: 0 registers.ebp: 3799908 registers.edx: 2 registers.ebx: 11722752 registers.esi: 15917056 registers.ecx: 1337102558	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcd40 @ 0x107cd40 random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x124204 exception.instruction: ud2 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 1196548 exception.address: 0xfe4204 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 2 registers.ebx: 16663066 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcd40 @ 0x107cd40 random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x1241d9 exception.instruction: div eax exception.module: random.exe exception.exception_code: 0xc0000094 exception.offset: 1196505 exception.address: 0xfe41d9 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 0 registers.ebx: 16663066 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcd40 @ 0x107cd40 random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x1241d9 exception.instruction: div eax exception.module: random.exe exception.exception_code: 0xc0000094 exception.offset: 1196505 exception.address: 0xfe41d9 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 0 registers.ebx: 16663023 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bce12 @ 0x107ce12 random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x124204 exception.instruction: ud2 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 1196548 exception.address: 0xfe4204 registers.esp: 3799880 registers.edi: 17252492 registers.eax: 0 registers.ebp: 3799908 registers.edx: 2 registers.ebx: 11722752 registers.esi: 15917056 registers.ecx: 3799908	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bce12 @ 0x107ce12 random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x124204 exception.instruction: ud2 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 1196548 exception.address: 0xfe4204 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 2 registers.ebx: 16663066 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bce12 @ 0x107ce12 random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x1241d9 exception.instruction: div eax exception.module: random.exe exception.exception_code: 0xc0000094 exception.offset: 1196505 exception.address: 0xfe41d9 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 0 registers.ebx: 16663066 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcf0c @ 0x107cf0c random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x124204 exception.instruction: ud2 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 1196548 exception.address: 0xfe4204 registers.esp: 3799880 registers.edi: 17252492 registers.eax: 0 registers.ebp: 3799908 registers.edx: 2 registers.ebx: 11722752 registers.esi: 15917056 registers.ecx: 0	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcf0c @ 0x107cf0c random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x1241d9 exception.instruction: div eax exception.module: random.exe exception.exception_code: 0xc0000094 exception.offset: 1196505 exception.address: 0xfe41d9 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 0 registers.ebx: 16663066 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcf0c @ 0x107cf0c random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x124204 exception.instruction: ud2 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 1196548 exception.address: 0xfe4204 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 2 registers.ebx: 16663023 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcf0c @ 0x107cf0c random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x124204 exception.instruction: ud2 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 1196548 exception.address: 0xfe4204 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 2 registers.ebx: 16663066 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcf0c @ 0x107cf0c random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x124204 exception.instruction: ud2 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 1196548 exception.address: 0xfe4204 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 2 registers.ebx: 16663066 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcf0c @ 0x107cf0c random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x1241d9 exception.instruction: div eax exception.module: random.exe exception.exception_code: 0xc0000094 exception.offset: 1196505 exception.address: 0xfe41d9 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 0 registers.ebx: 16663066 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcf0c @ 0x107cf0c random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x1241d9 exception.instruction: div eax exception.module: random.exe exception.exception_code: 0xc0000094 exception.offset: 1196505 exception.address: 0xfe41d9 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 0 registers.ebx: 16663023 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcf0c @ 0x107cf0c random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x1241d9 exception.instruction: div eax exception.module: random.exe exception.exception_code: 0xc0000094 exception.offset: 1196505 exception.address: 0xfe41d9 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 0 registers.ebx: 16663023 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcf0c @ 0x107cf0c random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x1241d9 exception.instruction: div eax exception.module: random.exe exception.exception_code: 0xc0000094 exception.offset: 1196505 exception.address: 0xfe41d9 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 0 registers.ebx: 16663023 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcfa2 @ 0x107cfa2 random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x124204 exception.instruction: ud2 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 1196548 exception.address: 0xfe4204 registers.esp: 3799880 registers.edi: 17252492 registers.eax: 0 registers.ebp: 3799908 registers.edx: 2 registers.ebx: 11722752 registers.esi: 15917056 registers.ecx: 159	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcfa2 @ 0x107cfa2 random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x124204 exception.instruction: ud2 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 1196548 exception.address: 0xfe4204 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 2 registers.ebx: 16663066 registers.esi: 0 registers.ecx: 3799916	1
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: random+0x1bcfa2 @ 0x107cfa2 random+0x1c0029 @ 0x1080029 random+0x1478dc @ 0x10078dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: random+0x124204 exception.instruction: ud2 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 1196548 exception.address: 0xfe4204 registers.esp: 3799880 registers.edi: 3799880 registers.eax: 0 registers.ebp: 3799908 registers.edx: 2 registers.ebx: 16663066 registers.esi: 0 registers.ecx: 3799916	1

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 1572 region_size: 2936832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 1572 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 1572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00640000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 1572 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c74000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 1572 region_size: 147456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c74000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 1572 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c94000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 1572 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ca4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 1572 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ca4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 1572 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cb4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 1572 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cb8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 1572 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cb8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 1572 region_size: 114688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cb8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 1572 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cb8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 1572 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cb8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 1572 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cb8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (5 events)

file	C:\Users\test22\AppData\Local\Temp\Work\cecho.exe
file	C:\Users\test22\AppData\Local\Temp\Work\NSudoLG.exe
file	C:\Users\test22\AppData\Local\Temp\34.bat
file	C:\Users\test22\AppData\Local\Temp\Work\nircmd.exe
file	C:\Users\test22\AppData\Local\Temp\Work\7z.exe

Creates a suspicious process (3 events)

cmdline	"C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\34.bat" any_word
cmdline	C:\Windows\system32\cmd.exe /c tasklist
cmdline	C:\Windows\system32\cmd.exe /c ver

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\34.bat
file	C:\Users\test22\AppData\Local\Temp\Work\NSudoLG.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\Work\cecho.exe
file	C:\Users\test22\AppData\Local\Temp\Work\7z.exe

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

The binary likely contains encrypted or compressed data indicative of a packer (6 events)

section

{u'size_of_data': u'0x0001be00', u'virtual_address': u'0x00001000', u'entropy': 7.996554242812834, u'name': u'', u'virtual_size': u'0x00032000'}

entropy

7.99655424281

description