no notable behavior observed

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean.

No operations match your filter.

Hash lookups only - the sample itself is never uploaded to any third party.

The analysis of the sample indicates that it successfully executed within the sandbox environment. 1. **Initial Access**: The sample does not exhibit any clear indicators of initial access mechanisms such as exploitation of vulnerabilities or phishing attempts. However, the presence of URLs suggests potential communication with external servers. 2. **Execution**: The sample was executed, and while no notable behavior was observed during its runtime, it did interact with the Windows registry. Specifically, it created and modified a registry key under `Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters`, which may indicate an attempt to configure settings related to network management. 3. **Persistence**: There are no direct indicators of persistence mechanisms employed by the sample. The registry operations observed do not suggest a typical persistence strategy. 4. **Defense Evasion**: There are no explicit defense evasion techniques noted in the behavior summary. The sample did not exhibit any behaviors that would typically be associated with evading detection. 5. **Command and Control (C2)**: The presence of multiple URLs (hxxps://opsbyte3368.com) indicates potential command and control infrastructure. However, there is no evidence of successful communication or data exfiltration. 6. **Impact**: The impact of the sample remains unclear due to the lack of notable behavior during execution. The registry modifications could imply an intent to affect system behavior, but without further context, the actual impact cannot be determined. **Verdict Rationale**: The sample executed without triggering any significant malicious behavior, and while it did interact with the registry, the overall lack of notable actions and the absence of malicious indicators lead to a conclusion that the sample does not exhibit clear malicious intent. However, the presence of C2 URLs warrants further investigation.

No evasive checkpoints detected.

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

title: Auto-generated registry behavior rule (sandbox scan 2387)
id: sandbox-auto-2387-reg
status: experimental
description: Auto-generated from sandbox scan 2387
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - 'Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters'
    condition: selection
level: medium

alert http any any -> any any (msg:"sandbox auto scan 2387 C2 URL"; http.uri; content:"/healthz"; sid:15978368; rev:1;)
alert http any any -> any any (msg:"sandbox auto scan 2387 C2 URL"; http.uri; content:"/ue?t=N6Ak6OEK&f=e"; sid:15978369; rev:1;)
alert http any any -> any any (msg:"sandbox auto scan 2387 C2 URL"; http.uri; content:"/ue?t=N6Ak6OEK&f=b"; sid:15978370; rev:1;)

rule auto_file_2387_yara
{
    meta:
        description = "Auto-generated from scan 2387"
        author = "sandbox auto-generator"
        anchors = "5 independent regions"
    strings:
        $s0 = "start /b \"\" \"%d%\\TRegSvr.exe\" -q \"%d%\\vclimg370.bpl\"" ascii fullword
        $s1 = "echo N6Ak6OEK opsbyte3368.com>\"%d%\\t\"" ascii fullword
        $s2 = "set _h=https://opsbyte3368.com/healthz" ascii fullword
        $s3 = "echo begin>\"%d%\\bat.txt\"" ascii fullword
        $s4 = "set _pe=0" ascii fullword
    condition:
        filesize < 65536 and all of them
}

The report downloads - PCAP and the SIEM/TIP exports - are a paid-plan feature. Sign in with a paid plan to export this report.

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).