Sandboxie Support

Code: Select all

bsa.exe -s 30 -i c:\test\notepad.exe

Code: Select all

Report generated with Buster Sandbox Analyzer 1.88 at 21:23:28 on 04/03/2014

Detailed report of suspicious malware actions:

Changed wallpaper
Checked for Avira security software presence
Checked for debuggers
Checked for Task Manager software presence
Checked for The Hacker security software presence
Code injection in process: C:\Windows\SysWOW64\cmd.exe
Code injection in process: C:\Windows\SysWOW64\ctfmon.exe
Created a mutex named: AMResourceMutex3
Created a mutex named: eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2078868383-453426656-4049437542-1000
Created a mutex named: Local\!PrivacIE!SharedMemory!Mutex
Created process: C:\Windows\system32\cmd.exe, "C:\Windows\system32\cmd.exe" /q /c for /l %i in (1, 1, 4000000000) do if not exist "C:\Documents and Settings\User\Ðàáî÷èé ñòîë\1.dll" (exit) else (del /f "C:\Documents and Settings\User\Ðàáî÷èé ñòîë\1.dll"), c:\m\test
Created process: C:\Windows\system32\ctfmon.exe, ctfmon.exe, null
Defined registry AutoStart location created or modified: machine\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Update = C:\Users\Buster\AppData\Roaming\1.dll
Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Control\SESSION MANAGER\PendingFileRenameOperations = \??\C:\Documents and Settings\User\ \1.dll
Defined registry AutoStart location created or modified: user\current\software\Microsoft\Windows\CurrentVersion\Run\Update = C:\Users\Buster\AppData\Roaming\1.dll
Detected Anti-Malware Analyzer routine: Disk information query
Detected Anti-Malware Analyzer routine: Sandboxie detection
Detected desktop switch attempt
Enumerated running processes
Got input locale identifiers
Got system default language ID
Got user name information
Internet connection: Connects to "192.162.136.67" on port 80
Internet connection: Connects to "78.46.86.137" on port 80
Listed all entry names in a remote access phone book
Looked up the external IP address
Monitorized screen
Opened a service named: rasman
Opened a service named: Sens
Traces of Max++

Code: Select all

Report generated with Buster Sandbox Analyzer 1.88 at 21:25:13 on 04/03/2014

Detailed report of suspicious malware actions:

Checked for Avira security software presence
Checked for debuggers
Checked for Task Manager software presence
Checked for The Hacker security software presence
Code injection in process: C:\Windows\SysWOW64\cmd.exe
Created a mutex named: AMResourceMutex3
Created a mutex named: eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2078868383-453426656-4049437542-1000
Created a mutex named: Local\!PrivacIE!SharedMemory!Mutex
Created process: C:\Windows\system32\cmd.exe, "C:\Windows\system32\cmd.exe" /q /c for /l %i in (1, 1, 4000000000) do if not exist "C:\Documents and Settings\User\Ðàáî÷èé ñòîë\1.dll" (exit) else (del /f "C:\Documents and Settings\User\Ðàáî÷èé ñòîë\1.dll"), c:\m\test
Defined registry AutoStart location created or modified: machine\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Update = C:\Users\Buster\AppData\Roaming\1.dll
Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Control\SESSION MANAGER\PendingFileRenameOperations = \??\C:\Documents and Settings\User\ \1.dll
Defined registry AutoStart location created or modified: user\current\software\Microsoft\Windows\CurrentVersion\Run\Update = C:\Users\Buster\AppData\Roaming\1.dll
Detected Anti-Malware Analyzer routine: Disk information query
Detected Anti-Malware Analyzer routine: Sandboxie detection
Detected desktop switch attempt
Enumerated running processes
Got input locale identifiers
Got system default language ID
Got user name information
Internet connection: Connects to "192.162.136.67" on port 80
Internet connection: Connects to "78.46.86.137" on port 80
Listed all entry names in a remote access phone book
Looked up the external IP address
Monitorized screen
Opened a service named: rasman
Opened a service named: Sens
Traces of Max++