Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 8, 2024, 6:28 p.m.	July 8, 2024, 6:30 p.m.

Size	9.5KB
Type	HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5	`82a46c36da6b5ae4bd7794eb6fd9f029`
SHA256	`840226ee14837fd6a2033c9696eabf5e488fa14c2149899560d9666bbb39ad4c`
CRC32	`BFA84FDD`
ssdeep	`96:wBlppWGQCVN2WtRDOwSMMvN1t3NuRSlqTT2kXhFHHWN0WU5VWUvfnHLHKVlpWzKF:wLtCvMMV1Du8o7+shSDVpB`
Yara	None matched

mshta.exe "C:\Windows\System32\mshta.exe" C:\Users\test22\AppData\Local\Temp\xplayd.hta
2548
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -File C:\Users\Public\RoLg.ps1
  2648
  - cmstp.exe "cmstp.exe" C:\Users\Public\user.inf /au
    2828
  - csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\itkkqgnw.cmdline"
    2876
    - cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RESFB0A.tmp" "c:\Users\test22\AppData\Local\Temp\CSCFAFA.tmp"
      2924

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 8, 2024, 6:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2024, 6:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2024, 6:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2024, 6:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 8, 2024, 6:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2024, 6:28 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 8, 2024, 6:28 p.m.			0	0

Command line console output was observed (4 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 8, 2024, 6:28 p.m.	buffer: Handles NPM(K) PM(K) WS(K) VM(M) CPU(s) Id ProcessName console_handle: 0x0000001b	1	1
WriteConsoleW July 8, 2024, 6:28 p.m.	buffer: 40 7 2464 3316 55 0.00 2828 cmstp console_handle: 0x00000023	1	1
WriteConsoleW July 8, 2024, 6:28 p.m.	buffer: True console_handle: 0x00000013	1	1
WriteConsoleW July 8, 2024, 6:28 p.m.	buffer: True console_handle: 0x00000017	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 84 events)

Time & API	Arguments	Status	Return
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623080 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623600 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623600 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623600 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00622c40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00622c40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00622c40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00622c40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00622c40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00622c40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00622c40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00622c40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00622c40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00622c40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00622c40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00622c40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00622c40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00623980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006238c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006238c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088e7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088e7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0089a840 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0089a880 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0089a8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0089a800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0089a800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0089a800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0089a800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2024, 6:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0089a800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 8, 2024, 6:28 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 8, 2024, 6:28 p.m.	stacktrace: system+0x9139e1 @ 0x6f0139e1 system+0x9138de @ 0x6f0138de system+0x1318d0 @ 0x707e18d0 system+0x13136d @ 0x707e136d system+0x131277 @ 0x707e1277 system+0x130fda @ 0x707e0fda system+0x130f91 @ 0x707e0f91 system+0x130a6f @ 0x707e0a6f system+0x13091e @ 0x707e091e system+0x1a3237 @ 0x70853237 system+0x19a884 @ 0x7084a884 system+0x19a79e @ 0x7084a79e system+0x19a6b1 @ 0x7084a6b1 system+0x19a4bf @ 0x7084a4bf system+0x198a79 @ 0x70848a79 system+0x19861c @ 0x7084861c system+0x18d1fe @ 0x7083d1fe system+0x193c2f @ 0x70843c2f system+0x19ac03 @ 0x7084ac03 system+0x19a884 @ 0x7084a884 system+0x19a79e @ 0x7084a79e system+0x19a6b1 @ 0x7084a6b1 system+0x19a4bf @ 0x7084a4bf system+0x198a79 @ 0x70848a79 system+0x19861c @ 0x7084861c system+0x18d1fe @ 0x7083d1fe system+0x193c2f @ 0x70843c2f system+0x193b12 @ 0x70843b12 system+0x18fe09 @ 0x7083fe09 system+0x18f8c7 @ 0x7083f8c7 mscorlib+0x216e76 @ 0x71436e76 mscorlib+0x2202ff @ 0x714402ff mscorlib+0x216df4 @ 0x71436df4 CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x72891b4c CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x728a8dde CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x728b6a2c CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x728b6a5f CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x728b6a7d DllRegisterServerInternal+0x4cf2b GetPrivateContextsPerfCounters-0xa76e mscorwks+0xa3191 @ 0x72933191 CreateAssemblyNameObject+0xb7ec DllRegisterServerInternal-0x4937 mscorwks+0x5192f @ 0x728e192f CreateAssemblyNameObject+0xb788 DllRegisterServerInternal-0x499b mscorwks+0x518cb @ 0x728e18cb CreateAssemblyNameObject+0xb6ae DllRegisterServerInternal-0x4a75 mscorwks+0x517f1 @ 0x728e17f1 CreateAssemblyNameObject+0xb83a DllRegisterServerInternal-0x48e9 mscorwks+0x5197d @ 0x728e197d DllRegisterServerInternal+0x4ccfc GetPrivateContextsPerfCounters-0xa99d mscorwks+0xa2f62 @ 0x72932f62 DllRegisterServerInternal+0x4cdd6 GetPrivateContextsPerfCounters-0xa8c3 mscorwks+0xa303c @ 0x7293303c GetMetaDataInternalInterface+0xcf27 _CorDllMain-0x9ae mscorwks+0x16805a @ 0x729f805a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 e8 f4 44 86 ff 85 c0 74 21 c7 45 d4 02 00 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: system+0x911edd exception.address: 0x6f011edd registers.esp: 103148044 registers.edi: 0 registers.eax: 63341380 registers.ebp: 103148096 registers.edx: 49440728 registers.ebx: 47988356 registers.esi: 66104620 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

July 8, 2024, 6:28 p.m.

stacktrace:

system+0x9139e1 @ 0x6f0139e1
system+0x9138de @ 0x6f0138de
system+0x1318d0 @ 0x707e18d0
system+0x13136d @ 0x707e136d
system+0x131277 @ 0x707e1277
system+0x130fda @ 0x707e0fda
system+0x130f91 @ 0x707e0f91
system+0x130a6f @ 0x707e0a6f
system+0x13091e @ 0x707e091e
system+0x1a3237 @ 0x70853237
system+0x19a884 @ 0x7084a884
system+0x19a79e @ 0x7084a79e
system+0x19a6b1 @ 0x7084a6b1
system+0x19a4bf @ 0x7084a4bf
system+0x198a79 @ 0x70848a79
system+0x19861c @ 0x7084861c
system+0x18d1fe @ 0x7083d1fe
system+0x193c2f @ 0x70843c2f
system+0x19ac03 @ 0x7084ac03
system+0x19a884 @ 0x7084a884
system+0x19a79e @ 0x7084a79e
system+0x19a6b1 @ 0x7084a6b1
system+0x19a4bf @ 0x7084a4bf
system+0x198a79 @ 0x70848a79
system+0x19861c @ 0x7084861c
system+0x18d1fe @ 0x7083d1fe
system+0x193c2f @ 0x70843c2f
system+0x193b12 @ 0x70843b12
system+0x18fe09 @ 0x7083fe09
system+0x18f8c7 @ 0x7083f8c7
mscorlib+0x216e76 @ 0x71436e76
mscorlib+0x2202ff @ 0x714402ff
mscorlib+0x216df4 @ 0x71436df4
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x72891b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x728a8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x728b6a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x728b6a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x728b6a7d
DllRegisterServerInternal+0x4cf2b GetPrivateContextsPerfCounters-0xa76e mscorwks+0xa3191 @ 0x72933191
CreateAssemblyNameObject+0xb7ec DllRegisterServerInternal-0x4937 mscorwks+0x5192f @ 0x728e192f
CreateAssemblyNameObject+0xb788 DllRegisterServerInternal-0x499b mscorwks+0x518cb @ 0x728e18cb
CreateAssemblyNameObject+0xb6ae DllRegisterServerInternal-0x4a75 mscorwks+0x517f1 @ 0x728e17f1
CreateAssemblyNameObject+0xb83a DllRegisterServerInternal-0x48e9 mscorwks+0x5197d @ 0x728e197d
DllRegisterServerInternal+0x4ccfc GetPrivateContextsPerfCounters-0xa99d mscorwks+0xa2f62 @ 0x72932f62
DllRegisterServerInternal+0x4cdd6 GetPrivateContextsPerfCounters-0xa8c3 mscorwks+0xa303c @ 0x7293303c
GetMetaDataInternalInterface+0xcf27 _CorDllMain-0x9ae mscorwks+0x16805a @ 0x729f805a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: 39 09 e8 f4 44 86 ff 85 c0 74 21 c7 45 d4 02 00
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol: system+0x911edd
exception.address: 0x6f011edd
registers.esp: 103148044
registers.edi: 0
registers.eax: 63341380
registers.ebp: 103148096
registers.edx: 49440728
registers.ebx: 47988356
registers.esi: 66104620
registers.ecx: 0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 178 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02850000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0275a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0276b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02767000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02752000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02765000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0275c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0276c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02753000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02754000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02755000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02756000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02757000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02758000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02759000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05030000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05031000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05032000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05033000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05034000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05035000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05036000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05037000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05038000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05039000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05040000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05041000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2024, 6:28 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	c:\Users\test22\AppData\Local\Temp\itkkqgnw.dll
file	C:\Users\Public\RoLg.ps1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell.exe -ExecutionPolicy UnRestricted -File C:\Users\Public\RoLg.ps1
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -File C:\Users\Public\RoLg.ps1

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\itkkqgnw.dll

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 8, 2024, 6:28 p.m.	show_type: 0 filepath_r: powershell.exe parameters: -ExecutionPolicy UnRestricted -File C:\Users\Public\RoLg.ps1 filepath: powershell.exe	1	1	0

File has been identified by 6 AntiVirus engines on VirusTotal as malicious (6 events)

Avast	Script:SNH-gen [Trj]
Kaspersky	HEUR:Trojan.Script.Generic
NANO-Antivirus	Trojan.Script.Vbs-heuristic.druvzi
Jiangmin	Trojan.Script.amhb
ZoneAlarm	HEUR:Trojan.HTA.SAgent.gen
AVG	Script:SNH-gen [Trj]

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 8, 2024, 6:28 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\itkkqgnw.cmdline"

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"cmstp.exe" C:\Users\Public\user.inf /au
parent_process	powershell.exe				martian_process	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\itkkqgnw.cmdline"

Creates a suspicious Powershell process (2 events)

option	-executionpolicy unrestricted				value	Attempts to bypass execution policy
option	-executionpolicy unrestricted				value	Attempts to bypass execution policy

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

xplayd.hta

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All