Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 31, 2021, 4:26 p.m.	Aug. 31, 2021, 4:28 p.m.

Size	16.3KB
Type	ASCII text, with very long lines
MD5	`015873296d262315f2583b1fb4fa6b94`
SHA256	`66a0a7c44c1728ca76a4c95483d8cddbc6bf7dd8eadd506123ce91dab3e2b445`
CRC32	`55BC079B`
ssdeep	`384:BTdY1qh388XOdVhnX4vRtz7/kPHy59mxfbV8J/k0LJJvDs+VxAJq+Kr:8e8iODFIZtJ9mdeJ/k0H4+wK`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\Final.txt.ps1
1800
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\WindowsStateRepositoryCore.vbs"
  2752
  - cmd.exe cmd /c ""C:\Users\Public\WindowsStateRepositoryCore.bat" "
    1612
    - powershell.exe powershell.exe -ExecutionPolicy Bypass C:\Users\Public\AMD.ps1
      2272

Name	Response	Post-Analysis Lookup
myownuniqueness.me	A 192.169.201.69	192.169.201.69

IP Address	Status	Action
164.124.101.2	Active	Moloch
192.169.201.69	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49166 -> 192.169.201.69:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49165 -> 192.169.201.69:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 31, 2021, 4:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2021, 4:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2021, 4:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2021, 4:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2021, 4:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 31, 2021, 4:26 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2021, 4:26 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 31, 2021, 4:26 p.m.			0	0

Command line console output was observed (13 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 31, 2021, 4:26 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 31, 2021, 4:26 p.m.	buffer: powershell.exe console_handle: 0x00000007	1	1
WriteConsoleW Aug. 31, 2021, 4:26 p.m.	buffer: -ExecutionPolicy Bypass C:\Users\Public\AMD.ps1 console_handle: 0x00000007	1	1
WriteConsoleW Aug. 31, 2021, 4:26 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 31, 2021, 4:26 p.m.	buffer: exit console_handle: 0x00000007	1	1
WriteConsoleW Aug. 31, 2021, 4:26 p.m.	buffer: The term 'C:\Users\Public\AMD.ps1' is not recognized as the name of a cmdlet, f console_handle: 0x00000023	1	1
WriteConsoleW Aug. 31, 2021, 4:26 p.m.	buffer: unction, script file, or operable program. Check the spelling of the name, or i console_handle: 0x0000002f	1	1
WriteConsoleW Aug. 31, 2021, 4:26 p.m.	buffer: f a path was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Aug. 31, 2021, 4:26 p.m.	buffer: At line:1 char:24 console_handle: 0x00000047	1	1
WriteConsoleW Aug. 31, 2021, 4:26 p.m.	buffer: + C:\Users\Public\AMD.ps1 <<<< console_handle: 0x00000053	1	1
WriteConsoleW Aug. 31, 2021, 4:26 p.m.	buffer: + CategoryInfo : ObjectNotFound: (C:\Users\Public\AMD.ps1:String) console_handle: 0x0000005f	1	1
WriteConsoleW Aug. 31, 2021, 4:26 p.m.	buffer: [], CommandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW Aug. 31, 2021, 4:26 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1

Uses Windows APIs to generate a cryptographic key (50 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054aba8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054aba8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054ad28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054ad28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb828 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb968 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb968 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb968 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbbe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbbe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbbe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbbe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbbe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbbe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb7a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb7a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb7a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006caf28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cbca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb868 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb868 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb868 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb868 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb868 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb868 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb868 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2021, 4:26 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006cb868 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 31, 2021, 4:26 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 195 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fbf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f89000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f96000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f9a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f97000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 1024 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05880400 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05880178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x058801a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x058801c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x058801f0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05880218 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x058812de process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x058812d2 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05880800 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x058812ec process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0588130c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05881314 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05881318 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05881320 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05881324 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05881328 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0588132c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05881334 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05881338 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05881340 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05881344 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05881348 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05881350 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05881354 process_handle: 0xffffffff		3221225550
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fb9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02882000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02883000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 31, 2021, 4:26 p.m.	process_identifier: 1800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05556000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0

Creates executable files on the filesystem (2 events)

file	C:\Users\Public\WindowsStateRepositoryCore.bat
file	C:\ProgramData\WindowsHost\WindowsStateRepositoryCore.vbs

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

powershell.exe -ExecutionPolicy Bypass C:\Users\Public\AMD.ps1

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 31, 2021, 4:26 p.m.	show_type: 0 filepath_r: C:\Users\Public\WindowsStateRepositoryCore.bat parameters: filepath: C:\Users\Public\WindowsStateRepositoryCore.bat	1	1	0

File has been identified by 9 AntiVirus engines on VirusTotal as malicious (9 events)

MicroWorld-eScan	Heur.BZC.PZQ.Pantera.14.BDF4FC0C
Sangfor	Malware.Generic-Script.Save.d1efc4f5
BitDefender	Heur.BZC.PZQ.Pantera.14.BDF4FC0C
Ad-Aware	Heur.BZC.PZQ.Pantera.14.BDF4FC0C
FireEye	Heur.BZC.PZQ.Pantera.14.BDF4FC0C
Emsisoft	Heur.BZC.PZQ.Pantera.14.BDF4FC0C (B)
MAX	malware (ai score=83)
GData	Heur.BZC.PZQ.Pantera.14.BDF4FC0C
ALYac	Heur.BZC.PZQ.Pantera.14.BDF4FC0C

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 31, 2021, 4:26 p.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (2 events)

Data received
Data received	F

Poweshell is sending data to a remote host (2 events)

Data sent	uqa-ÙÛ+õ }íþ^©ÿCT ¼º?×ë>!Cu:/5 ÀÀÀ À 280ÿmyownuniqueness.me
Data sent	uqa-Ùv3N[fmïuÐ$ÁC~u¶3o~I\Úð)/5 ÀÀÀ À 280ÿmyownuniqueness.me

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 31, 2021, 4:26 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

C:\Users\Public\WindowsStateRepositoryCore.bat

Attempts to identify installed AV products by installation directory (3 events)

file	C:\Program Files\Avast Software\Avast\AvastUI.exe
file	C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe
file	C:\Program Files\AVG\Antivirus\AVGUI.exe

Deletes executed files from disk (1 event)

file	C:\Users\Public\AMD.ps1

Drops a binary and executes it (2 events)

file	C:\ProgramData\WindowsHost\WindowsStateRepositoryCore.vbs
file	C:\Users\Public\WindowsStateRepositoryCore.bat

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
send Aug. 31, 2021, 4:26 p.m.	buffer: uqa-ÙÛ+õ }íþ^©ÿCT ¼º?×ë>!Cu:/5 ÀÀÀ À 280ÿmyownuniqueness.me socket: 1508 sent: 122	1	122	0
send Aug. 31, 2021, 4:26 p.m.	buffer: uqa-Ùv3N[fmïuÐ$ÁC~u¶3o~I\Úð)/5 ÀÀÀ À 280ÿmyownuniqueness.me socket: 1508 sent: 122	1	122	0

One or more non-whitelisted processes were created (4 events)

parent_process	wscript.exe	martian_process	"C:\Users\Public\WindowsStateRepositoryCore.bat"
parent_process	wscript.exe	martian_process	C:\Users\Public\WindowsStateRepositoryCore.bat
parent_process	powershell.exe	martian_process	"C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\WindowsStateRepositoryCore.vbs"
parent_process	powershell.exe	martian_process	C:\ProgramData\WindowsHost\WindowsStateRepositoryCore.vbs

Creates a suspicious Powershell process (1 event)

option

-executionpolicy bypass

value

Attempts to bypass execution policy

The process wscript.exe wrote an executable file to disk (1 event)

file	C:\Windows\SysWOW64\wscript.exe

Final.txt.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All