| Category | Package | Started | Completed | Duration | Options | Log(s) | MalScore |
|---|---|---|---|---|---|---|---|
| FILE | 2025-12-08 16:31:54 | 2025-12-08 16:35:19 | 205 seconds | Show Options | Show Analysis Log | 8.2 |
vnc_port=5900
2025-12-06 09:51:42,828 [root] INFO: Date set to: 20251208T08:30:47, timeout set to: 180 2025-12-08 08:30:47,000 [root] DEBUG: Starting analyzer from: C:\tmpb2bfyagv 2025-12-08 08:30:47,000 [root] DEBUG: Storing results at: C:\EXjNOxl 2025-12-08 08:30:47,000 [root] DEBUG: Pipe server name: \\.\PIPE\cMyZkyOx 2025-12-08 08:30:47,000 [root] DEBUG: Python path: C:\Python38 2025-12-08 08:30:47,000 [root] INFO: analysis running as an admin 2025-12-08 08:30:47,000 [root] DEBUG: no analysis package configured, picking one for you 2025-12-08 08:30:47,000 [root] INFO: analysis package selected: "zip" 2025-12-08 08:30:47,000 [root] DEBUG: importing analysis package module: "modules.packages.zip"... 2025-12-08 08:30:47,015 [root] DEBUG: imported analysis package "zip" 2025-12-08 08:30:47,015 [root] DEBUG: initializing analysis package "zip"... 2025-12-08 08:30:47,015 [lib.common.common] INFO: wrapping 2025-12-08 08:30:47,015 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation 2025-12-08 08:30:47,015 [root] DEBUG: New location of moved file: C:\Users\user\AppData\Local\Temp\db66fc3c896813280ef6.zip 2025-12-08 08:30:47,015 [root] INFO: Analyzer: Package modules.packages.zip does not specify a DLL option 2025-12-08 08:30:47,015 [root] INFO: Analyzer: Package modules.packages.zip does not specify a DLL_64 option 2025-12-08 08:30:47,015 [root] INFO: Analyzer: Package modules.packages.zip does not specify a loader option 2025-12-08 08:30:47,015 [root] INFO: Analyzer: Package modules.packages.zip does not specify a loader_64 option 2025-12-08 08:30:47,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser" 2025-12-08 08:30:47,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain" 2025-12-08 08:30:47,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise" 2025-12-08 08:30:47,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.during_script" 2025-12-08 08:30:47,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.end_noisy_tasks" 2025-12-08 08:30:47,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.evtx" 2025-12-08 08:30:47,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human" 2025-12-08 08:30:47,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.pre_script" 2025-12-08 08:30:47,062 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2025-12-08 08:30:47,156 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab' 2025-12-08 08:30:47,156 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw' 2025-12-08 08:30:47,171 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots" 2025-12-08 08:30:47,171 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon" 2025-12-08 08:30:47,171 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump" 2025-12-08 08:30:47,171 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage" 2025-12-08 08:30:47,171 [root] DEBUG: Initialized auxiliary module "Browser" 2025-12-08 08:30:47,171 [root] DEBUG: attempting to configure 'Browser' from data 2025-12-08 08:30:47,171 [root] DEBUG: module Browser does not support data configuration, ignoring 2025-12-08 08:30:47,171 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"... 2025-12-08 08:30:47,171 [root] DEBUG: Started auxiliary module modules.auxiliary.browser 2025-12-08 08:30:47,171 [root] DEBUG: Initialized auxiliary module "Curtain" 2025-12-08 08:30:47,171 [root] DEBUG: attempting to configure 'Curtain' from data 2025-12-08 08:30:47,171 [root] DEBUG: module Curtain does not support data configuration, ignoring 2025-12-08 08:30:47,171 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.curtain"... 2025-12-08 08:30:47,171 [root] DEBUG: Started auxiliary module modules.auxiliary.curtain 2025-12-08 08:30:47,171 [root] DEBUG: Initialized auxiliary module "Disguise" 2025-12-08 08:30:47,171 [root] DEBUG: attempting to configure 'Disguise' from data 2025-12-08 08:30:47,171 [root] DEBUG: module Disguise does not support data configuration, ignoring 2025-12-08 08:30:47,171 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"... 2025-12-08 08:30:47,187 [modules.auxiliary.disguise] INFO: Disguising GUID to adbb6299-1a91-4244-9a0a-36e7a809a014 2025-12-08 08:30:47,187 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise 2025-12-08 08:30:47,187 [root] DEBUG: Initialized auxiliary module "End_noisy_tasks" 2025-12-08 08:30:47,187 [root] DEBUG: attempting to configure 'End_noisy_tasks' from data 2025-12-08 08:30:47,187 [root] DEBUG: module End_noisy_tasks does not support data configuration, ignoring 2025-12-08 08:30:47,187 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.end_noisy_tasks"... 2025-12-08 08:30:47,187 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wuauclt.exe 2025-12-08 08:30:47,187 [root] DEBUG: Started auxiliary module modules.auxiliary.end_noisy_tasks 2025-12-08 08:30:47,187 [root] DEBUG: Initialized auxiliary module "Evtx" 2025-12-08 08:30:47,187 [root] DEBUG: attempting to configure 'Evtx' from data 2025-12-08 08:30:47,187 [root] DEBUG: module Evtx does not support data configuration, ignoring 2025-12-08 08:30:47,187 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.evtx"... 2025-12-08 08:30:47,187 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable 2025-12-08 08:30:47,187 [root] DEBUG: Started auxiliary module modules.auxiliary.evtx 2025-12-08 08:30:47,187 [root] DEBUG: Initialized auxiliary module "Human" 2025-12-08 08:30:47,187 [root] DEBUG: attempting to configure 'Human' from data 2025-12-08 08:30:47,187 [root] DEBUG: module Human does not support data configuration, ignoring 2025-12-08 08:30:47,187 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"... 2025-12-08 08:30:47,187 [root] DEBUG: Started auxiliary module modules.auxiliary.human 2025-12-08 08:30:47,187 [root] DEBUG: Initialized auxiliary module "Pre_script" 2025-12-08 08:30:47,187 [root] DEBUG: attempting to configure 'Pre_script' from data 2025-12-08 08:30:47,187 [root] DEBUG: module Pre_script does not support data configuration, ignoring 2025-12-08 08:30:47,187 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.pre_script"... 2025-12-08 08:30:47,187 [root] DEBUG: Started auxiliary module modules.auxiliary.pre_script 2025-12-08 08:30:47,187 [root] DEBUG: Initialized auxiliary module "Screenshots" 2025-12-08 08:30:47,187 [root] DEBUG: attempting to configure 'Screenshots' from data 2025-12-08 08:30:47,187 [root] DEBUG: module Screenshots does not support data configuration, ignoring 2025-12-08 08:30:47,187 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"... 2025-12-08 08:30:47,187 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots 2025-12-08 08:30:47,187 [root] DEBUG: Initialized auxiliary module "Sysmon" 2025-12-08 08:30:47,187 [root] DEBUG: attempting to configure 'Sysmon' from data 2025-12-08 08:30:47,187 [root] DEBUG: module Sysmon does not support data configuration, ignoring 2025-12-08 08:30:47,187 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.sysmon"... 2025-12-08 08:30:47,249 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable 2025-12-08 08:30:47,296 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable 2025-12-08 08:30:47,312 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.sysmon: In order to use the Sysmon functionality, it is required to have the SMaster(64|32).exe file and sysmonconfig-export.xml file in the bin path. Note that the SMaster(64|32).exe files are just the standard Sysmon binaries renamed to avoid anti-analysis detection techniques. 2025-12-08 08:30:47,312 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets" 2025-12-08 08:30:47,312 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data 2025-12-08 08:30:47,312 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring 2025-12-08 08:30:47,312 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"... 2025-12-08 08:30:47,312 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 448 2025-12-08 08:30:47,312 [lib.api.process] INFO: Monitor config for <Process 448 lsass.exe>: C:\tmpb2bfyagv\dll\448.ini 2025-12-08 08:30:47,312 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor 2025-12-08 08:30:47,312 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpb2bfyagv\dll\qUPdUYyV.dll, loader C:\tmpb2bfyagv\bin\VAkRERmI.exe 2025-12-08 08:30:47,328 [root] DEBUG: Loader: Injecting process 448 with C:\tmpb2bfyagv\dll\qUPdUYyV.dll. 2025-12-08 08:30:47,343 [root] DEBUG: 448: Python path set to 'C:\Python38'. 2025-12-08 08:30:47,343 [root] INFO: Disabling sleep skipping. 2025-12-08 08:30:47,359 [root] DEBUG: 448: TLS secret dump mode enabled. 2025-12-08 08:30:47,359 [root] DEBUG: 448: Monitor initialised: 64-bit capemon loaded in process 448 at 0x000007FEF30B0000, thread 492, image base 0x00000000FF3B0000, stack from 0x0000000000CD4000-0x0000000000CE0000 2025-12-08 08:30:47,359 [root] DEBUG: 448: Commandline: C:\Windows\system32\lsass.exe 2025-12-08 08:30:47,359 [root] DEBUG: 448: Hooked 5 out of 5 functions 2025-12-08 08:30:47,359 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-12-08 08:30:47,359 [root] DEBUG: Successfully injected DLL C:\tmpb2bfyagv\dll\qUPdUYyV.dll. 2025-12-08 08:30:47,359 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable 2025-12-08 08:30:47,375 [lib.api.process] INFO: Injected into 64-bit <Process 448 lsass.exe> 2025-12-08 08:30:47,375 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump 2025-12-08 08:30:47,375 [root] DEBUG: Initialized auxiliary module "Usage" 2025-12-08 08:30:47,375 [root] DEBUG: attempting to configure 'Usage' from data 2025-12-08 08:30:47,375 [root] DEBUG: module Usage does not support data configuration, ignoring 2025-12-08 08:30:47,375 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.usage"... 2025-12-08 08:30:47,375 [root] DEBUG: Started auxiliary module modules.auxiliary.usage 2025-12-08 08:30:47,375 [root] DEBUG: Initialized auxiliary module "During_script" 2025-12-08 08:30:47,375 [root] DEBUG: attempting to configure 'During_script' from data 2025-12-08 08:30:47,375 [root] DEBUG: module During_script does not support data configuration, ignoring 2025-12-08 08:30:47,375 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.during_script"... 2025-12-08 08:30:47,375 [root] DEBUG: Started auxiliary module modules.auxiliary.during_script 2025-12-08 08:30:47,421 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wusa.exe 2025-12-08 08:30:47,421 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other System Events" /success:disable /failure:enable 2025-12-08 08:30:47,468 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logon" /success:enable /failure:enable 2025-12-08 08:30:47,500 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM WindowsUpdate.exe 2025-12-08 08:30:47,500 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logoff" /success:enable /failure:enable 2025-12-08 08:30:47,546 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable 2025-12-08 08:30:47,562 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM GoogleUpdate.exe 2025-12-08 08:30:47,593 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable 2025-12-08 08:30:47,625 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable 2025-12-08 08:30:47,640 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM MicrosoftEdgeUpdate.exe 2025-12-08 08:30:47,656 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable 2025-12-08 08:30:47,671 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable 2025-12-08 08:30:47,687 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable 2025-12-08 08:30:47,703 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f 2025-12-08 08:30:47,718 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable 2025-12-08 08:30:47,718 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f 2025-12-08 08:30:47,750 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File System" /success:enable /failure:enable 2025-12-08 08:30:47,750 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 0 /f 2025-12-08 08:30:47,765 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Registry" /success:enable /failure:enable 2025-12-08 08:30:47,781 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable 2025-12-08 08:30:47,796 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"SAM" /success:disable /failure:disable 2025-12-08 08:30:47,812 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable 2025-12-08 08:30:47,828 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable 2025-12-08 08:30:47,843 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable 2025-12-08 08:30:47,859 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File Share" /success:enable /failure:enable 2025-12-08 08:30:47,875 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable 2025-12-08 08:30:47,890 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable 2025-12-08 08:30:47,906 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable 2025-12-08 08:30:47,906 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable 2025-12-08 08:30:47,921 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable 2025-12-08 08:30:47,937 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable 2025-12-08 08:30:47,953 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable 2025-12-08 08:30:47,968 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable 2025-12-08 08:30:47,984 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable 2025-12-08 08:30:48,000 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable 2025-12-08 08:30:48,015 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable 2025-12-08 08:30:48,031 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable 2025-12-08 08:30:48,046 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable 2025-12-08 08:30:48,062 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable 2025-12-08 08:30:48,078 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable 2025-12-08 08:30:48,093 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable 2025-12-08 08:30:48,109 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable 2025-12-08 08:30:48,109 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable 2025-12-08 08:30:48,125 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable 2025-12-08 08:30:48,140 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable 2025-12-08 08:30:48,156 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:enable 2025-12-08 08:30:48,171 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable 2025-12-08 08:30:48,187 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable 2025-12-08 08:30:48,203 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable 2025-12-08 08:30:48,218 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable 2025-12-08 08:30:48,234 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable 2025-12-08 08:30:48,249 [modules.auxiliary.evtx] DEBUG: Wiping Application 2025-12-08 08:30:48,265 [modules.auxiliary.evtx] DEBUG: Wiping HardwareEvents 2025-12-08 08:30:48,296 [modules.auxiliary.evtx] DEBUG: Wiping Internet Explorer 2025-12-08 08:30:48,296 [modules.auxiliary.evtx] DEBUG: Wiping Key Management Service 2025-12-08 08:30:48,312 [modules.auxiliary.evtx] DEBUG: Wiping OAlerts 2025-12-08 08:30:48,328 [modules.auxiliary.evtx] DEBUG: Wiping Security 2025-12-08 08:30:48,359 [modules.auxiliary.evtx] DEBUG: Wiping Setup 2025-12-08 08:30:48,375 [modules.auxiliary.evtx] DEBUG: Wiping System 2025-12-08 08:30:48,390 [modules.auxiliary.evtx] DEBUG: Wiping Windows PowerShell 2025-12-08 08:30:48,406 [modules.auxiliary.evtx] DEBUG: Wiping Microsoft-Windows-Sysmon/Operational 2025-12-08 08:30:52,437 [root] INFO: Restarting WMI Service 2025-12-08 08:30:54,468 [root] DEBUG: package modules.packages.zip does not support configure, ignoring 2025-12-08 08:30:54,468 [root] WARNING: configuration error for package modules.packages.zip: error importing data.packages.zip: No module named 'data.packages' 2025-12-08 08:30:54,468 [lib.common.zip_utils] DEBUG: Archive is encrypted, using default password value: infected 2025-12-08 08:30:54,468 [lib.common.zip_utils] DEBUG: ['C:\\Program Files (x86)\\7-Zip\\7z.exe', 'l', 'C:\\Users\\user\\AppData\\Local\\Temp\\db66fc3c896813280ef6.zip'] 2025-12-08 08:30:54,500 [lib.common.zip_utils] DEBUG: ['C:\\Program Files (x86)\\7-Zip\\7z.exe', 'x', '-p', '-y', '-oC:\\Users\\user\\AppData\\Local\\Temp', 'C:\\Users\\user\\AppData\\Local\\Temp\\db66fc3c896813280ef6.zip'] 2025-12-08 08:30:54,515 [lib.common.zip_utils] DEBUG: b'\r\n7-Zip 21.07 (x86) : Copyright (c) 1999-2021 Igor Pavlov : 2021-12-26\r\n\r\nScanning the drive for archives:\r\n1 file, 44626 bytes (44 KiB)\r\n\r\nExtracting archive: C:\\Users\\user\\AppData\\Local\\Temp\\db66fc3c896813280ef6.zip\r\n--\r\nPath = C:\\Users\\user\\AppData\\Local\\Temp\\db66fc3c896813280ef6.zip\r\nType = zip\r\nPhysical Size = 44626\r\n\r\n\r\nSub items Errors: 1\r\n\r\nArchives with Errors: 1\r\n\r\nSub items Errors: 1\r\n' b'ERROR: Wrong password : db66fc3c896813280ef60ba06dd03d7a7ba5b554ae4f18472168e868a4a6ccb3.rar\r\n' 2025-12-08 08:30:54,515 [lib.common.zip_utils] DEBUG: ['C:\\Program Files (x86)\\7-Zip\\7z.exe', 'x', '-pinfected', '-y', '-oC:\\Users\\user\\AppData\\Local\\Temp', 'C:\\Users\\user\\AppData\\Local\\Temp\\db66fc3c896813280ef6.zip'] 2025-12-08 08:30:54,531 [lib.common.zip_utils] DEBUG: b'\r\n7-Zip 21.07 (x86) : Copyright (c) 1999-2021 Igor Pavlov : 2021-12-26\r\n\r\nScanning the drive for archives:\r\n1 file, 44626 bytes (44 KiB)\r\n\r\nExtracting archive: C:\\Users\\user\\AppData\\Local\\Temp\\db66fc3c896813280ef6.zip\r\n--\r\nPath = C:\\Users\\user\\AppData\\Local\\Temp\\db66fc3c896813280ef6.zip\r\nType = zip\r\nPhysical Size = 44626\r\n\r\nEverything is Ok\r\n\r\nSize: 44340\r\nCompressed: 44626\r\n' b'' 2025-12-08 08:30:54,531 [lib.common.zip_utils] INFO: Uploading C:\Users\user\AppData\Local\Temp\db66fc3c896813280ef60ba06dd03d7a7ba5b554ae4f18472168e868a4a6ccb3.rar to host 2025-12-08 08:30:54,531 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\db66fc3c896813280ef60ba06dd03d7a7ba5b554ae4f18472168e868a4a6ccb3.rar to files/db66fc3c896813280ef60ba06dd03d7a7ba5b554ae4f18472168e868a4a6ccb3; Size is 44340; Max size: 100000000 2025-12-08 08:30:54,546 [modules.packages.zip] DEBUG: No interesting files found, auto executing the first file: db66fc3c896813280ef60ba06dd03d7a7ba5b554ae4f18472168e868a4a6ccb3.rar 2025-12-08 08:30:54,546 [modules.packages.zip] DEBUG: Missing file option, auto executing: ['db66fc3c896813280ef60ba06dd03d7a7ba5b554ae4f18472168e868a4a6ccb3.rar'] 2025-12-08 08:30:54,546 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation 2025-12-08 08:30:54,546 [lib.api.process] INFO: Successfully executed process from path "C:\Windows\system32\cmd.exe" with arguments "/c "cd ^"C:\Users\user\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\user\AppData\Local\Temp\db66fc3c896813280ef60ba06dd03d7a7ba5b554ae4f18472168e868a4a6ccb3.rar^"" with pid 2468 2025-12-08 08:30:54,546 [lib.api.process] INFO: Monitor config for <Process 2468 cmd.exe>: C:\tmpb2bfyagv\dll\2468.ini 2025-12-08 08:30:54,546 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpb2bfyagv\dll\ReZqGJsE.dll, loader C:\tmpb2bfyagv\bin\DhIKcJa.exe 2025-12-08 08:30:54,546 [root] DEBUG: Loader: Injecting process 2468 (thread 2424) with C:\tmpb2bfyagv\dll\ReZqGJsE.dll. 2025-12-08 08:30:54,546 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT. 2025-12-08 08:30:54,546 [root] DEBUG: Successfully injected DLL C:\tmpb2bfyagv\dll\ReZqGJsE.dll. 2025-12-08 08:30:54,546 [lib.api.process] INFO: Injected into 32-bit <Process 2468 cmd.exe> 2025-12-08 08:30:56,546 [lib.api.process] INFO: Successfully resumed <Process 2468 cmd.exe> 2025-12-08 08:30:56,562 [root] DEBUG: 2468: Python path set to 'C:\Python38'. 2025-12-08 08:30:56,562 [root] INFO: Disabling sleep skipping. 2025-12-08 08:30:56,562 [root] DEBUG: 2468: Dropped file limit defaulting to 100. 2025-12-08 08:30:56,562 [root] DEBUG: 2468: YaraInit: Compiled 41 rule files 2025-12-08 08:30:56,562 [root] DEBUG: 2468: YaraInit: Compiled rules saved to file C:\tmpb2bfyagv\data\yara\capemon.yac 2025-12-08 08:30:56,562 [root] DEBUG: 2468: YaraScan: Scanning 0x4A350000, size 0x4bb2e 2025-12-08 08:30:56,578 [root] DEBUG: 2468: Monitor initialised: 32-bit capemon loaded in process 2468 at 0x742e0000, thread 2424, image base 0x4a350000, stack from 0x333000-0x430000 2025-12-08 08:30:56,578 [root] DEBUG: 2468: Commandline: "C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\user\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\user\AppData\Local\Temp\db66fc3c896813280ef60ba06dd03d7a7ba5b554ae4f18472168e868a4a6ccb3.rar^" 2025-12-08 08:30:56,578 [root] DEBUG: 2468: GetAddressByYara: ModuleBase 0x77920000 FunctionName LdrpCallInitRoutine 2025-12-08 08:30:56,578 [root] DEBUG: 2468: hook_api: Warning - CreateRemoteThreadEx export address 0x7744A337 differs from GetProcAddress -> 0x75A8403A (KERNELBASE.dll::0x1403a) 2025-12-08 08:30:56,578 [root] DEBUG: 2468: hook_api: Warning - UpdateProcThreadAttribute export address 0x7744ABB7 differs from GetProcAddress -> 0x75A7FA26 (KERNELBASE.dll::0xfa26) 2025-12-08 08:30:56,578 [root] WARNING: b'Unable to place hook on GetCommandLineA' 2025-12-08 08:30:56,578 [root] DEBUG: 2468: set_hooks: Unable to hook GetCommandLineA 2025-12-08 08:30:56,578 [root] WARNING: b'Unable to place hook on GetCommandLineW' 2025-12-08 08:30:56,578 [root] DEBUG: 2468: set_hooks: Unable to hook GetCommandLineW 2025-12-08 08:30:56,578 [root] DEBUG: 2468: Hooked 611 out of 613 functions 2025-12-08 08:30:56,578 [root] DEBUG: 2468: WoW64 detected: 64-bit ntdll base: 0x77760000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x777cb510, Wow64PrepareForException: 0x0 2025-12-08 08:30:56,578 [root] DEBUG: 2468: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x190000 2025-12-08 08:30:56,578 [root] INFO: Loaded monitor into process with pid 2468 2025-12-08 08:30:56,578 [root] DEBUG: 2468: caller_dispatch: Added region at 0x4A350000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x4A357CBD, thread 2424). 2025-12-08 08:30:56,593 [root] DEBUG: 2468: YaraScan: Scanning 0x4A350000, size 0x4bb2e 2025-12-08 08:30:56,593 [root] DEBUG: 2468: ProcessImageBase: Main module image at 0x4A350000 unmodified (entropy change 0.000000e+00) 2025-12-08 08:30:56,593 [root] DEBUG: 2468: DLL loaded at 0x76640000: C:\Windows\syswow64\SHELL32 (0xc4c000 bytes). 2025-12-08 08:30:56,593 [root] DEBUG: 2468: DLL loaded at 0x74140000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32 (0x19e000 bytes). 2025-12-08 08:30:56,593 [root] DEBUG: 2468: DLL loaded at 0x74AC0000: C:\Windows\system32\uxtheme (0x80000 bytes). 2025-12-08 08:30:56,593 [root] DEBUG: 2468: DLL loaded at 0x74040000: C:\Windows\SysWOW64\PROPSYS (0xf5000 bytes). 2025-12-08 08:30:56,593 [root] DEBUG: 2468: DLL loaded at 0x75E10000: C:\Windows\syswow64\OLEAUT32 (0x92000 bytes). 2025-12-08 08:30:56,609 [root] DEBUG: 2468: DLL loaded at 0x756F0000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes). 2025-12-08 08:30:56,609 [root] DEBUG: 2468: DLL loaded at 0x74640000: C:\Windows\SysWOW64\ntmarta (0x21000 bytes). 2025-12-08 08:30:56,609 [root] DEBUG: 2468: DLL loaded at 0x765E0000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes). 2025-12-08 08:30:56,625 [root] DEBUG: 2468: DLL loaded at 0x75AC0000: C:\Windows\syswow64\profapi (0xb000 bytes). 2025-12-08 08:30:56,640 [root] DEBUG: 2468: api-rate-cap: RegQueryValueExW hook disabled due to rate 2025-12-08 08:30:56,640 [root] DEBUG: 2468: api-rate-cap: NtQueryValueKey hook disabled due to rate 2025-12-08 08:30:56,640 [root] DEBUG: 2468: api-rate-cap: RegOpenKeyExW hook disabled due to rate 2025-12-08 08:30:56,640 [root] DEBUG: 2468: api-rate-cap: memcpy hook disabled due to rate 2025-12-08 08:30:56,656 [root] DEBUG: 2468: DLL loaded at 0x73910000: C:\Windows\SysWOW64\apphelp (0x4c000 bytes). 2025-12-08 08:30:56,656 [root] DEBUG: 2468: api-rate-cap: memcpy hook disabled due to rate 2025-12-08 08:30:56,656 [root] DEBUG: 2468: api-rate-cap: FindNextFileW hook disabled due to rate 2025-12-08 08:30:56,671 [root] DEBUG: 2468: DLL loaded at 0x745E0000: C:\Windows\System32\shdocvw (0x2f000 bytes). 2025-12-08 08:30:56,703 [root] DEBUG: 2468: DLL loaded at 0x75780000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes). 2025-12-08 08:30:56,703 [root] DEBUG: 2468: DLL loaded at 0x76590000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2025-12-08 08:30:56,703 [root] DEBUG: 2468: DLL loaded at 0x774F0000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2025-12-08 08:30:56,703 [root] DEBUG: 2468: api-rate-cap: NtQueryKey hook disabled due to rate 2025-12-08 08:30:56,703 [root] DEBUG: 2468: api-rate-cap: NtOpenKeyEx hook disabled due to rate 2025-12-08 08:30:56,718 [root] DEBUG: 2468: CreateProcessHandler: Injection info set for new process 1756: C:\Program Files\WinRAR\WinRAR.exe, ImageBase: 0x3F260000 2025-12-08 08:30:56,718 [root] INFO: Announced 64-bit process name: WinRAR.exe pid: 1756 2025-12-08 08:30:56,718 [lib.api.process] INFO: Monitor config for <Process 1756 WinRAR.exe>: C:\tmpb2bfyagv\dll\1756.ini 2025-12-08 08:30:56,718 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpb2bfyagv\dll\qUPdUYyV.dll, loader C:\tmpb2bfyagv\bin\VAkRERmI.exe 2025-12-08 08:30:56,718 [root] DEBUG: Loader: Injecting process 1756 (thread 1120) with C:\tmpb2bfyagv\dll\qUPdUYyV.dll. 2025-12-08 08:30:56,734 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT. 2025-12-08 08:30:56,734 [root] DEBUG: Successfully injected DLL C:\tmpb2bfyagv\dll\qUPdUYyV.dll. 2025-12-08 08:30:56,734 [lib.api.process] INFO: Injected into 64-bit <Process 1756 WinRAR.exe> 2025-12-08 08:30:56,734 [root] INFO: Announced 64-bit process name: WinRAR.exe pid: 1756 2025-12-08 08:30:56,734 [lib.api.process] INFO: Monitor config for <Process 1756 WinRAR.exe>: C:\tmpb2bfyagv\dll\1756.ini 2025-12-08 08:30:56,734 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpb2bfyagv\dll\qUPdUYyV.dll, loader C:\tmpb2bfyagv\bin\VAkRERmI.exe 2025-12-08 08:30:56,734 [root] DEBUG: Loader: Injecting process 1756 (thread 1120) with C:\tmpb2bfyagv\dll\qUPdUYyV.dll. 2025-12-08 08:30:56,734 [root] DEBUG: InjectDllViaIAT: This image has already been patched. 2025-12-08 08:30:56,734 [root] DEBUG: Successfully injected DLL C:\tmpb2bfyagv\dll\qUPdUYyV.dll. 2025-12-08 08:30:56,734 [lib.api.process] INFO: Injected into 64-bit <Process 1756 WinRAR.exe> 2025-12-08 08:30:56,734 [root] DEBUG: 2468: DLL loaded at 0x74630000: C:\Windows\system32\sfc (0x3000 bytes). 2025-12-08 08:30:56,734 [root] DEBUG: 2468: DLL loaded at 0x74620000: C:\Windows\system32\sfc_os (0xd000 bytes). 2025-12-08 08:30:56,750 [root] DEBUG: 2468: DLL loaded at 0x74610000: C:\Windows\SysWOW64\DEVRTL (0xe000 bytes). 2025-12-08 08:30:56,765 [root] DEBUG: 1756: Python path set to 'C:\Python38'. 2025-12-08 08:30:56,765 [root] DEBUG: 1756: Dropped file limit defaulting to 100. 2025-12-08 08:30:56,765 [root] INFO: Disabling sleep skipping. 2025-12-08 08:30:56,765 [root] DEBUG: 1756: YaraInit: Compiled rules loaded from existing file C:\tmpb2bfyagv\data\yara\capemon.yac 2025-12-08 08:30:56,765 [root] DEBUG: 1756: YaraScan: Scanning 0x000000013F260000, size 0x2ffc9e 2025-12-08 08:30:56,781 [root] DEBUG: 1756: Monitor initialised: 64-bit capemon loaded in process 1756 at 0x000007FEF30B0000, thread 1120, image base 0x000000013F260000, stack from 0x0000000000125000-0x0000000000130000 2025-12-08 08:30:56,781 [root] DEBUG: 1756: Commandline: "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\user\AppData\Local\Temp\db66fc3c896813280ef60ba06dd03d7a7ba5b554ae4f18472168e868a4a6ccb3.rar" 2025-12-08 08:30:56,781 [root] DEBUG: 1756: GetAddressByYara: ModuleBase 0x0000000077760000 FunctionName LdrpCallInitRoutine 2025-12-08 08:30:56,796 [root] WARNING: b'Unable to place hook on LockResource' 2025-12-08 08:30:56,796 [root] DEBUG: 1756: set_hooks: Unable to hook LockResource 2025-12-08 08:30:56,796 [root] DEBUG: 1756: Hooked 605 out of 606 functions 2025-12-08 08:30:56,812 [root] INFO: Loaded monitor into process with pid 1756 2025-12-08 08:30:56,812 [root] DEBUG: 1756: caller_dispatch: Added region at 0x000000013F260000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x000000013F366ABE, thread 1120). 2025-12-08 08:30:56,812 [root] DEBUG: 1756: YaraScan: Scanning 0x000000013F260000, size 0x2ffc9e 2025-12-08 08:30:56,828 [root] DEBUG: 1756: ProcessImageBase: Main module image at 0x000000013F260000 unmodified (entropy change 0.000000e+00) 2025-12-08 08:30:56,828 [root] DEBUG: 1756: DLL loaded at 0x000007FEFD110000: C:\Windows\system32\CRYPTBASE (0xf000 bytes). 2025-12-08 08:30:56,828 [root] DEBUG: 1756: DLL loaded at 0x000007FEFE7F0000: C:\Windows\system32\CLBCatQ (0x99000 bytes). 2025-12-08 08:30:56,843 [root] DEBUG: 1756: DLL loaded at 0x000007FEFBAA0000: C:\Windows\system32\propsys (0x12c000 bytes). 2025-12-08 08:30:56,843 [root] DEBUG: 1756: DLL loaded at 0x000007FEFB120000: C:\Windows\system32\ntmarta (0x2d000 bytes). 2025-12-08 08:30:56,843 [root] DEBUG: 1756: DLL loaded at 0x000007FEFE460000: C:\Windows\system32\WLDAP32 (0x52000 bytes). 2025-12-08 08:30:56,859 [root] DEBUG: 1756: DLL loaded at 0x000007FEF7140000: C:\Windows\system32\riched20 (0x9e000 bytes). 2025-12-08 08:30:56,890 [root] DEBUG: 1756: api-rate-cap: RegCloseKey hook disabled due to rate 2025-12-08 08:30:56,906 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Roaming\WinRAR\version.dat 2025-12-08 08:30:56,906 [root] DEBUG: 1756: DLL loaded at 0x000007FEFB4D0000: C:\Windows\system32\dwmapi (0x18000 bytes). 2025-12-08 08:30:56,937 [root] DEBUG: 1756: DLL loaded at 0x000007FEF6BF0000: C:\Program Files\Common Files\microsoft shared\ink\tiptsf (0x7f000 bytes). 2025-12-08 08:30:56,953 [root] DEBUG: 1756: DLL loaded at 0x000007FEFB320000: C:\Windows\system32\WindowsCodecs (0x161000 bytes). 2025-12-08 08:30:56,953 [root] DEBUG: 1756: DLL loaded at 0x000007FEFD0B0000: C:\Windows\system32\apphelp (0x57000 bytes). 2025-12-08 08:30:56,953 [root] DEBUG: 1756: DLL loaded at 0x000007FEF9C30000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\amd64\FileSyncShell64 (0x212000 bytes). 2025-12-08 08:30:56,984 [root] DEBUG: 1756: DLL loaded at 0x000007FEFDC70000: C:\Windows\system32\WININET (0x4ac000 bytes). 2025-12-08 08:30:56,984 [root] DEBUG: 1756: DLL loaded at 0x000007FEFD650000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes). 2025-12-08 08:30:56,984 [root] DEBUG: 1756: DLL loaded at 0x000007FEFD2E0000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes). 2025-12-08 08:30:56,984 [root] DEBUG: 1756: DLL loaded at 0x000007FEFD660000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes). 2025-12-08 08:30:56,984 [root] DEBUG: 1756: DLL loaded at 0x000007FEFC390000: C:\Windows\system32\version (0xc000 bytes). 2025-12-08 08:30:56,984 [root] DEBUG: 1756: DLL loaded at 0x000007FEFD2D0000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes). 2025-12-08 08:30:56,984 [root] DEBUG: 1756: DLL loaded at 0x0000000077900000: C:\Windows\system32\normaliz (0x3000 bytes). 2025-12-08 08:30:57,000 [root] DEBUG: 1756: DLL loaded at 0x000007FEFE190000: C:\Windows\system32\iertutil (0x2cc000 bytes). 2025-12-08 08:30:57,000 [root] DEBUG: 1756: DLL loaded at 0x000007FEFD360000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes). 2025-12-08 08:30:57,000 [root] DEBUG: 1756: DLL loaded at 0x000007FEFD410000: C:\Windows\system32\USERENV (0x1f000 bytes). 2025-12-08 08:30:57,000 [root] DEBUG: 1756: DLL loaded at 0x000007FEFD2B0000: C:\Windows\system32\profapi (0xf000 bytes). 2025-12-08 08:30:57,000 [root] DEBUG: 1756: DLL loaded at 0x000007FEF9B20000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\amd64\MSVCP120 (0xa6000 bytes). 2025-12-08 08:30:57,015 [root] DEBUG: 1756: DLL loaded at 0x000007FEF9A30000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\amd64\MSVCR120 (0xef000 bytes). 2025-12-08 08:30:57,015 [root] DEBUG: 1756: DLL loaded at 0x000007FEF9A00000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\amd64\LoggingPlatform64 (0x1f000 bytes). 2025-12-08 08:30:57,015 [root] DEBUG: 1756: DLL loaded at 0x000007FEF99F0000: C:\Windows\system32\WSOCK32 (0x9000 bytes). 2025-12-08 08:30:57,031 [root] DEBUG: 1756: set_hooks_by_export_directory: Hooked 0 out of 606 functions 2025-12-08 08:30:57,031 [root] DEBUG: 1756: DLL loaded at 0x000007FEF9730000: C:\Windows\system32\EhStorShell (0x35000 bytes). 2025-12-08 08:30:57,031 [root] DEBUG: 1756: DLL loaded at 0x000007FEF96B0000: C:\Windows\System32\cscui (0x7e000 bytes). 2025-12-08 08:30:57,031 [root] DEBUG: 1756: DLL loaded at 0x000007FEF96A0000: C:\Windows\System32\CSCDLL (0xc000 bytes). 2025-12-08 08:30:57,031 [root] DEBUG: 1756: DLL loaded at 0x000007FEF9690000: C:\Windows\system32\CSCAPI (0xf000 bytes). 2025-12-08 08:30:57,031 [root] DEBUG: 1756: DLL loaded at 0x000007FEF9610000: C:\Windows\system32\ntshrui (0x80000 bytes). 2025-12-08 08:30:57,046 [root] DEBUG: 1756: DLL loaded at 0x000007FEFCE10000: C:\Windows\system32\srvcli (0x23000 bytes). 2025-12-08 08:30:57,046 [root] DEBUG: 1756: DLL loaded at 0x000007FEFAA20000: C:\Windows\system32\slc (0xb000 bytes). 2025-12-08 08:30:57,125 [root] DEBUG: 1756: DLL loaded at 0x000007FEFA700000: C:\Windows\system32\MPR (0x18000 bytes). 2025-12-08 08:30:57,125 [root] DEBUG: 1756: DLL loaded at 0x000007FEFB300000: C:\Windows\System32\drprov (0xa000 bytes). 2025-12-08 08:30:57,125 [root] DEBUG: 1756: DLL loaded at 0x000007FEFD1C0000: C:\Windows\System32\WINSTA (0x3d000 bytes). 2025-12-08 08:30:57,125 [root] DEBUG: 1756: DLL loaded at 0x000007FEFB220000: C:\Windows\System32\ntlanman (0x22000 bytes). 2025-12-08 08:30:57,125 [root] DEBUG: 1756: DLL loaded at 0x000007FEFB200000: C:\Windows\System32\davclnt (0x1e000 bytes). 2025-12-08 08:30:57,125 [root] DEBUG: 1756: DLL loaded at 0x000007FEF7130000: C:\Windows\System32\DAVHLPR (0xa000 bytes). 2025-12-08 08:30:57,140 [root] DEBUG: 1756: DLL loaded at 0x000007FEFB170000: C:\Windows\system32\wkscli (0x15000 bytes). 2025-12-08 08:30:57,140 [root] DEBUG: 1756: DLL loaded at 0x000007FEFB190000: C:\Windows\system32\netutils (0xc000 bytes). 2025-12-08 08:30:57,156 [root] DEBUG: 1756: DLL loaded at 0x000007FEF6140000: C:\Windows\system32\wpdshext (0x271000 bytes). 2025-12-08 08:30:57,156 [root] DEBUG: 1756: DLL loaded at 0x000007FEFA140000: C:\Windows\system32\WINMM (0x3b000 bytes). 2025-12-08 08:30:57,171 [root] DEBUG: 1756: DLL loaded at 0x000007FEF5FE0000: C:\Windows\system32\PortableDeviceApi (0xbd000 bytes). 2025-12-08 08:30:57,171 [root] DEBUG: 1756: DLL loaded at 0x000007FEFD2F0000: C:\Windows\system32\WINTRUST (0x3b000 bytes). 2025-12-08 08:30:57,171 [root] DEBUG: 1756: DLL loaded at 0x000007FEF7100000: C:\Windows\system32\EhStorAPI (0x27000 bytes). 2025-12-08 08:30:57,187 [root] DEBUG: 1756: DLL loaded at 0x000007FEF8D80000: C:\Windows\System32\shdocvw (0x34000 bytes). 2025-12-08 08:30:57,187 [root] DEBUG: 1756: DLL loaded at 0x000007FEFCEC0000: C:\Windows\system32\Secur32 (0xb000 bytes). 2025-12-08 08:30:57,203 [root] DEBUG: 448: DLL loaded at 0x000007FEFE460000: C:\Windows\system32\WLDAP32 (0x52000 bytes). 2025-12-08 08:30:57,203 [root] DEBUG: 1756: api-rate-cap: RegQueryValueExW hook disabled due to rate 2025-12-08 08:30:57,249 [root] DEBUG: 1756: api-rate-cap: memcpy hook disabled due to rate 2025-12-08 08:30:57,281 [root] DEBUG: 1756: DLL loaded at 0x000007FEFCA50000: C:\Windows\system32\CRYPTSP (0x18000 bytes). 2025-12-08 08:30:57,281 [root] DEBUG: 1756: DLL loaded at 0x000007FEFC750000: C:\Windows\system32\rsaenh (0x47000 bytes). 2025-12-08 08:30:57,296 [root] DEBUG: 1756: DLL loaded at 0x000007FEF9EA0000: C:\Windows\system32\explorerframe (0x1cb000 bytes). 2025-12-08 08:30:57,296 [root] DEBUG: 1756: DLL loaded at 0x000007FEFB540000: C:\Windows\system32\DUser (0x43000 bytes). 2025-12-08 08:30:57,312 [root] DEBUG: 1756: DLL loaded at 0x000007FEFB590000: C:\Windows\system32\DUI70 (0xf2000 bytes). 2025-12-08 08:30:57,312 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied. 2025-12-08 08:30:57,312 [root] DEBUG: 1756: OpenProcessHandler: Injection info created for process 1212, handle 0x3a8: Error obtaining target process name 2025-12-08 08:30:57,359 [root] DEBUG: 1756: DLL loaded at 0x000007FEF1D20000: C:\Windows\System32\ieframe (0xec2000 bytes). 2025-12-08 08:30:57,359 [root] DEBUG: 1756: DLL loaded at 0x000007FEF3CE0000: C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0 (0x4000 bytes). 2025-12-08 08:30:57,359 [root] DEBUG: 1756: DLL loaded at 0x000007FEF85C0000: C:\Windows\System32\WINHTTP (0x71000 bytes). 2025-12-08 08:30:57,359 [root] DEBUG: 1756: DLL loaded at 0x000007FEF8550000: C:\Windows\System32\webio (0x65000 bytes). 2025-12-08 08:30:57,375 [root] DEBUG: 1756: DLL loaded at 0x000007FEF3460000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0 (0x4000 bytes). 2025-12-08 08:30:57,375 [root] DEBUG: 1756: DLL loaded at 0x000007FEF9A20000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0 (0x4000 bytes). 2025-12-08 08:30:57,375 [root] DEBUG: 1756: DLL loaded at 0x000007FEFE660000: C:\Windows\system32\urlmon (0x18a000 bytes). 2025-12-08 08:30:57,375 [root] DEBUG: 1756: DLL loaded at 0x000007FEFD330000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes). 2025-12-08 08:30:57,406 [root] DEBUG: 1756: DLL loaded at 0x000007FEFC9F0000: C:\Windows\system32\mswsock (0x55000 bytes). 2025-12-08 08:30:57,421 [root] DEBUG: 1756: DLL loaded at 0x000007FEFAB40000: C:\Windows\system32\IPHLPAPI (0x27000 bytes). 2025-12-08 08:30:57,421 [root] DEBUG: 1756: DLL loaded at 0x000007FEFABE0000: C:\Windows\system32\WINNSI (0xb000 bytes). 2025-12-08 08:30:57,421 [root] DEBUG: 1756: DLL loaded at 0x000007FEFC9E0000: C:\Windows\System32\wship6 (0x7000 bytes). 2025-12-08 08:30:57,437 [root] DEBUG: 1756: DLL loaded at 0x000007FEFC870000: C:\Windows\system32\DNSAPI (0x5b000 bytes). 2025-12-08 08:30:57,437 [root] DEBUG: 1756: DLL loaded at 0x000007FEF7FF0000: C:\Windows\System32\netprofm (0x74000 bytes). 2025-12-08 08:30:57,437 [root] DEBUG: 1756: DLL loaded at 0x000007FEF7FD0000: C:\Windows\System32\nlaapi (0x15000 bytes). 2025-12-08 08:30:57,453 [root] DEBUG: 1756: DLL loaded at 0x000007FEFC460000: C:\Windows\System32\wshtcpip (0x7000 bytes). 2025-12-08 08:30:57,453 [root] DEBUG: 1756: DLL loaded at 0x000007FEFAA50000: C:\Windows\system32\dhcpcsvc6 (0x11000 bytes). 2025-12-08 08:30:57,453 [root] DEBUG: 1756: DLL loaded at 0x000007FEFAA30000: C:\Windows\system32\dhcpcsvc (0x18000 bytes). 2025-12-08 08:30:57,453 [root] DEBUG: 1756: DLL loaded at 0x000007FEFD200000: C:\Windows\system32\RpcRtRemote (0x14000 bytes). 2025-12-08 08:30:57,453 [root] DEBUG: 1756: DLL loaded at 0x000007FEF7FC0000: C:\Windows\system32\rasadhlp (0x8000 bytes). 2025-12-08 08:30:57,468 [root] DEBUG: 1756: DLL loaded at 0x000007FEF8180000: C:\Windows\System32\npmproxy (0xc000 bytes). 2025-12-08 08:30:57,609 [root] DEBUG: 1756: DLL loaded at 0x000007FEF0480000: C:\Windows\system32\MSHTML (0x189a000 bytes). 2025-12-08 08:30:57,671 [root] DEBUG: 1756: DLL loaded at 0x000007FEFAAE0000: C:\Windows\System32\fwpuclnt (0x53000 bytes). 2025-12-08 08:30:58,312 [modules.auxiliary.human] INFO: Found button "ok", clicking it 2025-12-08 08:33:57,546 [root] INFO: Analysis timeout hit, terminating analysis 2025-12-08 08:33:57,546 [lib.api.process] INFO: Terminate event set for <Process 2468 cmd.exe> 2025-12-08 08:33:57,546 [root] DEBUG: 2468: Terminate Event: Attempting to dump process 2468 2025-12-08 08:33:57,546 [root] DEBUG: 2468: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-08 08:33:57,546 [root] DEBUG: 2468: Terminate Event: Current region empty 2025-12-08 08:33:57,546 [lib.api.process] INFO: Termination confirmed for <Process 2468 cmd.exe> 2025-12-08 08:33:57,546 [root] INFO: Terminate event set for process 2468 2025-12-08 08:33:57,546 [root] DEBUG: 2468: Terminate Event: CAPE shutdown complete for process 2468 2025-12-08 08:33:57,546 [lib.api.process] INFO: Terminate event set for <Process 1756 WinRAR.exe> 2025-12-08 08:33:57,546 [root] DEBUG: 1756: Terminate Event: Attempting to dump process 1756 2025-12-08 08:33:57,546 [root] DEBUG: 1756: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-08 08:33:57,546 [root] DEBUG: 1756: Terminate Event: Current region empty 2025-12-08 08:33:57,546 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 2025-12-08 08:33:57,546 [lib.api.process] INFO: Termination confirmed for <Process 1756 WinRAR.exe> 2025-12-08 08:33:57,546 [root] INFO: Terminate event set for process 1756 2025-12-08 08:33:57,546 [root] DEBUG: 1756: Terminate Event: CAPE shutdown complete for process 1756 2025-12-08 08:33:57,546 [root] INFO: Created shutdown mutex 2025-12-08 08:33:58,546 [root] INFO: Shutting down package 2025-12-08 08:33:58,546 [root] INFO: Stopping auxiliary modules 2025-12-08 08:33:58,546 [root] INFO: Stopping auxiliary module: Browser 2025-12-08 08:33:58,546 [root] INFO: Stopping auxiliary module: Curtain 2025-12-08 08:33:58,593 [lib.common.results] INFO: Uploading file C:\curtain.log to curtain/1765154038.59375.curtain.log; Size is 36; Max size: 100000000 2025-12-08 08:33:58,609 [root] INFO: Stopping auxiliary module: End_noisy_tasks 2025-12-08 08:33:58,609 [root] INFO: Stopping auxiliary module: Evtx 2025-12-08 08:33:58,609 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Application.evtx to zip dump 2025-12-08 08:33:58,609 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\HardwareEvents.evtx to zip dump 2025-12-08 08:33:58,609 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Internet Explorer.evtx to zip dump 2025-12-08 08:33:58,609 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Key Management Service.evtx to zip dump 2025-12-08 08:33:58,609 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Microsoft-Windows-Sysmon%4Operational.evtx to zip dump 2025-12-08 08:33:58,609 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\OAlerts.evtx to zip dump 2025-12-08 08:33:58,625 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Security.evtx to zip dump 2025-12-08 08:33:58,625 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Setup.evtx to zip dump 2025-12-08 08:33:58,625 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\System.evtx to zip dump 2025-12-08 08:33:58,625 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Windows PowerShell.evtx to zip dump 2025-12-08 08:33:58,625 [modules.auxiliary.evtx] DEBUG: Uploading evtx.zip to host 2025-12-08 08:33:58,625 [lib.common.results] INFO: Uploading file evtx.zip to evtx/evtx.zip; Size is 95060; Max size: 100000000 2025-12-08 08:33:58,640 [root] INFO: Stopping auxiliary module: Human 2025-12-08 08:33:58,750 [root] INFO: Stopping auxiliary module: Pre_script 2025-12-08 08:33:58,750 [root] INFO: Stopping auxiliary module: Screenshots 2025-12-08 08:34:02,249 [root] INFO: Stopping auxiliary module: Usage 2025-12-08 08:34:03,390 [root] INFO: Stopping auxiliary module: During_script 2025-12-08 08:34:03,390 [root] INFO: Finishing auxiliary modules 2025-12-08 08:34:03,390 [root] INFO: Shutting down pipe server and dumping dropped files 2025-12-08 08:34:03,390 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Roaming\WinRAR\version.dat to files\1fff60304cb1c454393a6d04dbabd59e4c554e59935e44dda10adfc7d8d5c8b4; Size is 12; Max size: 100000000 2025-12-08 08:34:03,390 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat to files\76583c27a362f61dfb9ae5b76b869851fab55c2c67559ac0534ebe82b390c072; Size is 128; Max size: 100000000 2025-12-08 08:34:03,406 [root] WARNING: Folder at path "C:\EXjNOxl\debugger" does not exist, skipping 2025-12-08 08:34:03,406 [root] WARNING: Folder at path "C:\EXjNOxl\tlsdump" does not exist, skipping 2025-12-08 08:34:03,406 [root] INFO: Analysis completed
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win7-64bit-1 | win7-64bit-1 | KVM | 2025-12-08 16:31:54 | 2025-12-08 16:35:19 | inetsim |
| File Name |
db66fc3c896813280ef6.zip
|
|---|---|
| File Type | Zip archive data, at least v5.1 to extract, compression method=AES Encrypted |
| File Size | 44626 bytes |
| MD5 | 6db1f56c22d52951d27944f71d1aa609 |
| SHA1 | 0d30850317d72c84057ddb80f67f12e9ad2d826b |
| SHA256 | 36bd07d2c97eebab9773e3c75153fc37dd68ca6ced043c10dad2ba5b9b439ab8 [VT] [MWDB] [Bazaar] |
| SHA3-384 | f4c356723b18750e46c72307d2a0b418e05cad82bc029ea1e777ccac27579d430e33c082ce896aafb7fe0db2c64ea78e |
| CRC32 | 9B5FF42E |
| TLSH | T1081302B40505CBE7B1740693B7908894C274AEA245C3BA0F7F17E7F03D94A736797A46 |
| Ssdeep | 768:8mTLQMFb6Wycp7eIuGELmWb41NJyKSdXLQ9ywxESP0TaP7xN+YMgEo/:5TLQMFb1ppuGcmULKSdXLQ4wxHPSgN+m |
| File Strings BinGraph Vba2Graph |
| Discovery | Command and Control | Execution | Defense Evasion | Privilege Escalation |
|
|
|
|---|
No hosts contacted.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
No HTTP(s) requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP