Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 12, 2023, 9:46 a.m.	Sept. 12, 2023, 9:48 a.m.

Size	966.6KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`306cf48dd8c776f68b0f37b1570283c9`
SHA256	`f3629b01405fb61bbad12144a8c41608738cc7299c998b5c9f791ef5968e715b`
CRC32	`CE05DA44`
ssdeep	`24576:ywWsc+ccuQ7coCu+Z0nv9xEp6EsyK3u95PR3NWCFeYwotqFnB3X4J5Wfm8:z`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\.rree.txt.ps1
2596
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\run.vbs"
  1216
  - cmd.exe cmd /c ""C:\ProgramData\wa.bat" "
    2120
    - powershell.exe PowerShell -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\updata.ps1
      152
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windo 1 -noexit -exec bypass -file C:\ProgramData\inst.ps1
  2776
  - schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc minute /mo 5 /tn updatarunom /tr C:\ProgramData\run.vbs
    1456

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (13 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 12, 2023, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2023, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2023, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2023, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 12, 2023, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2023, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2023, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2023, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2023, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2023, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 12, 2023, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2023, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2023, 9:47 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 12, 2023, 9:47 a.m.			0	0
IsDebuggerPresent Sept. 12, 2023, 9:47 a.m.			0	0

Command line console output was observed (12 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 12, 2023, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 12, 2023, 9:47 a.m.	buffer: PowerShell console_handle: 0x00000007	1	1
WriteConsoleW Sept. 12, 2023, 9:47 a.m.	buffer: -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\updata.ps1 console_handle: 0x00000007	1	1
WriteConsoleW Sept. 12, 2023, 9:47 a.m.	buffer: Exception calling "Invoke" with "2" argument(s): "The type initializer for '<Mo console_handle: 0x00000023	1	1
WriteConsoleW Sept. 12, 2023, 9:47 a.m.	buffer: dule>' threw an exception." console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 12, 2023, 9:47 a.m.	buffer: At C:\ProgramData\updata.ps1:18 char:20 console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 12, 2023, 9:47 a.m.	buffer: + $IUWS = $IRW.Invoke <<<< ( console_handle: 0x00000047	1	1
WriteConsoleW Sept. 12, 2023, 9:47 a.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x00000053	1	1
WriteConsoleW Sept. 12, 2023, 9:47 a.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x0000005f	1	1
WriteConsoleW Sept. 12, 2023, 9:47 a.m.	buffer: Windows PowerShell Copyright (C) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000017	1	1
WriteConsoleW Sept. 12, 2023, 9:47 a.m.	buffer: PS C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000f	1	1
WriteConsoleW Sept. 12, 2023, 9:47 a.m.	buffer: SUCCESS: The scheduled task "updatarunom" has successfully been created. console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 91 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 12, 2023, 9:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007cea70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007cea70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007cea70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007cea70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:46 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007cea70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff5d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ffcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ffcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ffcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003fff90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003fff90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003fff90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003fff90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003fff90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003fff90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ffcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ffcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ffcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff9d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ffcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ffcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ffcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ffcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ffcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ffcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ffcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ff810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 12, 2023, 9:46 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 292 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 12, 2023, 9:46 a.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:46 a.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0226f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:46 a.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02239000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:46 a.m.	process_identifier: 2596 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 1216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f422000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02740000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02790000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0277a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02772000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02782000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02791000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02792000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02783000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02784000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0277b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02785000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02786000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050f8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050f9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050fe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:47 a.m.	process_identifier: 152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050ff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (4 events)

file	C:\ProgramData\wa.bat
file	C:\ProgramData\inst.ps1
file	C:\ProgramData\updata.ps1
file	C:\ProgramData\run.vbs

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	"C:\Windows\system32\schtasks.exe" /create /sc minute /mo 5 /tn updatarunom /tr C:\ProgramData\run.vbs
cmdline	PowerShell -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\updata.ps1
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windo 1 -noexit -exec bypass -file C:\ProgramData\inst.ps1

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 12, 2023, 9:47 a.m.	show_type: 0 filepath_r: C:\ProgramData\wa.bat parameters: filepath: C:\ProgramData\wa.bat	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 12, 2023, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 12, 2023, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Windows\system32\schtasks.exe" /create /sc minute /mo 5 /tn updatarunom /tr C:\ProgramData\run.vbs

Installs itself for autorun at Windows startup (1 event)

cmdline

"C:\Windows\system32\schtasks.exe" /create /sc minute /mo 5 /tn updatarunom /tr C:\ProgramData\run.vbs

Drops a binary and executes it (2 events)

file	C:\ProgramData\run.vbs
file	C:\ProgramData\wa.bat

Creates a slightly modified copy of itself (1 event)

description

Possibly a polymorphic version of itself

file

{u'yara': [], u'sha1': u'c604d0233072c8814094423229d4fa44b726325b', u'name': u'8bee65bfbcb5f72f_updata.ps1', u'filepath': u'C:\\ProgramData\\updata.ps1', u'sha512': u'81da9eb8716fd6528a7e0147088eaba5de3d0d8cb20c4b0b2dcbfc54d20891d01fb261b359f9b28ef2c9e3a0545967d4cd5adda29ca4796c8cbeae5fc0cfdc78', u'urls': [], u'crc32': u'C8660DD6', u'path': u'/home/cuckoo/.cuckoo/storage/analyses/44675/files/8bee65bfbcb5f72f_updata.ps1', u'ssdeep': u'24576:vwWsc+ccuQ7coCu+Z0nv9xEp6EsyK3u95PR3NWCFeYwotqFnB3X4J5WfmV:l', u'sha256': u'8bee65bfbcb5f72fca701bf40e7db3259082b3f7c2c0a9e247125dcab05d1be0', u'type': u'ASCII text, with very long lines, with CRLF line terminators', u'pids': [2596], u'md5': u'dd42f656aa886654d80ff9381bf23018', u'size': 988844}

One or more non-whitelisted processes were created (6 events)

parent_process	wscript.exe	martian_process	C:\ProgramData\wa.bat
parent_process	wscript.exe	martian_process	"C:\ProgramData\wa.bat"
parent_process	powershell.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windo 1 -noexit -exec bypass -file C:\ProgramData\inst.ps1
parent_process	powershell.exe	martian_process	"C:\Windows\System32\WScript.exe" "C:\ProgramData\run.vbs"
parent_process	powershell.exe	martian_process	C:\ProgramData\run.vbs
parent_process	powershell.exe	martian_process	"C:\Windows\system32\schtasks.exe" /create /sc minute /mo 5 /tn updatarunom /tr C:\ProgramData\run.vbs

Creates a suspicious Powershell process (3 events)

option	-executionpolicy bypass	value	Attempts to bypass execution policy
option	-noprofile	value	Does not load current user profile
option	-exec bypass	value	Attempts to bypass execution policy

The processes powershell.exe, wscript.exe wrote an executable file to disk (3 events)

file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\schtasks.exe

.rree.txt.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All