32 process(es) observed; malicious behavior: dropped_executable, process_injection, registry_persistence, timestomping; 10 dropped executable(s)

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

Seen from inside the calling process, so it names which process reached into which - something a dump of the result cannot show. Only calls whose target is another process are listed.

Captured in the calling process, so the values are the ones the sample asked for rather than what the file ended up with. Setting file times is ordinary - installers and archivers do it - so only a write that moves a file's history backwards is marked as timestomping.

Runtime evidence means the mechanism was established during detonation. A static hint means the sample only references the technique.

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean.

No operations match your filter.

Threat intelligence enrichment is a paid-plan layer. On a paid plan every extracted indicator - hashes, addresses, hostnames - is checked against the reputation services and the ingested feeds this platform refreshes on a schedule, and what is already known is flagged as known instead of being rediscovered by hand.

Nothing is being withheld from this report. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the evasion read from them. The sample itself is never given to it.

Nothing is being withheld from this report. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

title: Auto-generated registry behavior rule (sandbox scan 2393)
id: sandbox-auto-2393-reg
status: experimental
description: Auto-generated from sandbox scan 2393
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - 'Software\Microsoft\WBEM\CIMOM'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts'
    condition: selection
level: medium

alert ip any any -> 1.0.0.0 any (msg:"sandbox auto scan 2393 C2 IP 1.0.0.0"; sid:16124352; rev:1;)
alert ip any any -> 9.0.0.0 any (msg:"sandbox auto scan 2393 C2 IP 9.0.0.0"; sid:16124353; rev:1;)
alert dns any any -> any any (msg:"sandbox auto scan 2393 C2 domain aka.ms"; dns.query; content:"aka.ms"; sid:16124354; rev:1;)
alert dns any any -> any any (msg:"sandbox auto scan 2393 C2 domain google.com"; dns.query; content:"google.com"; sid:16124355; rev:1;)
alert http any any -> any any (msg:"sandbox auto scan 2393 C2 URL"; http.uri; content:"/naudio/NAudio"; sid:16124356; rev:1;)

rule auto_file_2393_yara
{
    meta:
        description = "Auto-generated from scan 2393"
        author = "sandbox auto-generator"
        imphash = "53e4e12437621212a425d294842d0a96"
        anchors = "5 independent regions"
    strings:
        $s0 = "603DD5FDF129D8F53A7DFF06440AE9CDA3280F19741C65E4C3BACE80C455BC0B" ascii fullword
        $s1 = "19ff3e9c3602ae8e841925bb461a0adb064a1f1903667a5e0d87e8f608f425ac" ascii fullword
        $s2 = "8350305011C9B785C1A83CA5C9D603530906E4E4EEAB7F76EE8261BD21F6E20D" ascii fullword
        $s3 = "076AC0E933CD9ED695BB621B83F0B1B06EE5374B2AD46B0A2FC0F05FA6F8DE47" ascii fullword
        $s4 = "07DB995E8ED2CFB0AB71EBA69F3A3EC07D5C6AC10C0C64F33E94ED2949B348AA" ascii fullword
    condition:
        uint16(0) == 0x5a4d and filesize < 94594924 and all of them
}

The report downloads - PCAP and the SIEM/TIP exports - are a paid-plan feature. Sign in with a paid plan to export this report.

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).