Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Feb. 19, 2025, 11:23 a.m.	Feb. 19, 2025, 11:39 a.m.

Size	439.5KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`7a20a5ebf46ab756a3781ce55fc8bb63`
SHA256	`d343ca0971d9ca37ec451059253d1dc990a2dc31c2b8b24bdc4b0fa29cc21ca7`
CRC32	`25DEF4D3`
ssdeep	`12288:PrxcdpqSwXDoBbL5sQ7eBUXE6c3DtOA/icYi:PcembL5sQ7US1YTik`
Yara	hide_executable_file - Hide executable file

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\ed.ps1
2644
- x.exe "C:\Users\test22\AppData\Local\Temp\x.exe"
  2772
  - RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    2892
runonce.exe "C:\Windows\SysWOW64\runonce.exe"
2672
- firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
  2400
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
www.vivamente.shop	A 84.32.84.32 CNAME vivamente.shop
www.childhealth.pro	CNAME childhealth.pro A 162.213.251.166
www.partflix.net	A 66.33.60.194 A 66.33.60.67
www.sqlite.org	A 45.33.6.223

IP Address	Status	Action
162.213.251.166	Active	Moloch
164.124.101.2	Active	Moloch
45.33.6.223	Active	Moloch
66.33.60.194	Active	Moloch
84.32.84.32	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49169 -> 162.213.251.166:80	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 66.33.60.194:80	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 84.32.84.32:80	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 19, 2025, 11:23 a.m.			0	0
IsDebuggerPresent Feb. 19, 2025, 11:23 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 19, 2025, 11:23 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (7 events)

request	POST http://www.childhealth.pro/b0vh/
request	GET http://www.childhealth.pro/b0vh/?Gy99=QUBVmFKdBNxds9OiApRhVsAj+ScDRPHeUPya3YpvxKMFpoL0UXIizO+2Knd5vz9rSJ99vd1oMGbpKodYFcGso7ng1PXq6kPJUf/keZz2BFmCSPb1BPLSFhWLkB5VTYfkmDPjYsE=&A97DD=dIkYLZ1GahSa
request	GET http://www.sqlite.org/2017/sqlite-dll-win32-x86-3200000.zip
request	POST http://www.vivamente.shop/p4iy/
request	GET http://www.vivamente.shop/p4iy/?Gy99=SRywWHlJneqGbgnZMnkP75yQY1jNoV+uUvrvQ9vwHOg3gIy7AYQSo7rFsMjmhZA0ylqE+AAlROwVtLWgpormrByiUeawEdhj2T0RPVxTjD2FTpAWFNeIi4haYWVZYJq3iwiPjnM=&A97DD=dIkYLZ1GahSa
request	POST http://www.partflix.net/t94t/
request	GET http://www.partflix.net/t94t/?Gy99=6wcCudhLkH0VejVFRrMKOuT81SneVTs21TOXThNHeftxWAPzww3VNZ/fA4UNu8KULkzvL+qpdGK+6ln1YlZUcKuT272xiEUSQXi3WiUcrBFdZosaj7GWSIfDKBhRZwCKqwkunqw=&A97DD=dIkYLZ1GahSa

Sends data using the HTTP POST Method (3 events)

request	POST http://www.childhealth.pro/b0vh/
request	POST http://www.vivamente.shop/p4iy/
request	POST http://www.partflix.net/t94t/

Allocates read-write-execute memory (usually to unpack itself) (30 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fa9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00620000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00512000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00700000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00701000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0051a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 303104 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f52000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00702000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00703000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00704000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00545000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00536000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00705000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00537000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00706000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:24 a.m.	process_identifier: 2892 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02890000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:24 a.m.	process_identifier: 2892 region_size: 139264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00680000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 19, 2025, 11:38 a.m.	process_identifier: 2672 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02020000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file	C:\Users\test22\AppData\Local\Chromium\User Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\x.exe
file	C:\Users\test22\AppData\Local\Temp\sqlite3.dll

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file	C:\Users\test22\AppData\Local\Temp\x.exe

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: c9c525849e2778c95fff4e0cda996871038450d4

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2892 region_size: 286720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000258	1	0	0

Attempts to identify installed AV products by installation directory (2 events)

file	C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file	C:\Users\test22\AppData\Local\AVG\Browser\User Data

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\x.exe

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2892 manipulating memory of non-child process 988
NtMapViewOfSection Feb. 19, 2025, 11:24 a.m.	section_handle: 0x00000108 process_identifier: 988 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: base_address: 0x04530000 allocation_type: 0 () section_offset: 0 view_size: 14036992 process_handle: 0x0000010c	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Feb. 19, 2025, 11:23 a.m.	buffer: MZÿÿ¸@¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELÚ³B[àP°`@`@.textôOP ` base_address: 0x00400000 process_identifier: 2892 process_handle: 0x00000258	1	1	0
WriteProcessMemory Feb. 19, 2025, 11:23 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2892 process_handle: 0x00000258	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Feb. 19, 2025, 11:23 a.m.	buffer: MZÿÿ¸@¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELÚ³B[àP°`@`@.textôOP ` base_address: 0x00400000 process_identifier: 2892 process_handle: 0x00000258	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2772 called NtSetContextThread to modify thread in remote process 2892
Process injection	Process 2892 called NtSetContextThread to modify thread in remote process 2672
NtSetContextThread Feb. 19, 2025, 11:23 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4199600 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000254 process_identifier: 2892	1	0	0
NtSetContextThread Feb. 19, 2025, 11:24 a.m.	registers.eip: 1995571652 registers.esp: 2881864 registers.edi: 0 registers.eax: 630448 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000110 process_identifier: 2672	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\Users\test22\AppData\Local\Temp\x.exe"
parent_process	powershell.exe				martian_process	C:\Users\test22\AppData\Local\Temp\x.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2772 resumed a thread in remote process 2892
NtResumeThread Feb. 19, 2025, 11:23 a.m.	thread_handle: 0x00000254 suspend_count: 1 process_identifier: 2892	1	0	0

Executed a process and injected code into it, probably while unpacking (25 events)

Time & API	Arguments	Status	Return
NtResumeThread Feb. 19, 2025, 11:23 a.m.	thread_handle: 0x000003d0 suspend_count: 1 process_identifier: 2644	1	0
CreateProcessInternalW Feb. 19, 2025, 11:23 a.m.	thread_identifier: 2776 thread_handle: 0x000004d4 process_identifier: 2772 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\x.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\x.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\x.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004dc	1	1
NtResumeThread Feb. 19, 2025, 11:23 a.m.	thread_handle: 0x000004f4 suspend_count: 1 process_identifier: 2644	1	0
NtResumeThread Feb. 19, 2025, 11:23 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2772	1	0
NtResumeThread Feb. 19, 2025, 11:23 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2772	1	0
NtResumeThread Feb. 19, 2025, 11:23 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2772	1	0
NtResumeThread Feb. 19, 2025, 11:23 a.m.	thread_handle: 0x000001e8 suspend_count: 1 process_identifier: 2772	1	0
NtGetContextThread Feb. 19, 2025, 11:23 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Feb. 19, 2025, 11:23 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Feb. 19, 2025, 11:23 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2772	1	0
NtResumeThread Feb. 19, 2025, 11:23 a.m.	thread_handle: 0x000001fc suspend_count: 1 process_identifier: 2772	1	0
NtResumeThread Feb. 19, 2025, 11:23 a.m.	thread_handle: 0x00000210 suspend_count: 1 process_identifier: 2772	1	0
CreateProcessInternalW Feb. 19, 2025, 11:23 a.m.	thread_identifier: 2896 thread_handle: 0x00000254 process_identifier: 2892 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000258	1	1
NtGetContextThread Feb. 19, 2025, 11:23 a.m.	thread_handle: 0x00000254	1	0
NtAllocateVirtualMemory Feb. 19, 2025, 11:23 a.m.	process_identifier: 2892 region_size: 286720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000258	1	0
WriteProcessMemory Feb. 19, 2025, 11:23 a.m.	buffer: base_address: 0x00401000 process_identifier: 2892 process_handle: 0x00000258	1	1
WriteProcessMemory Feb. 19, 2025, 11:23 a.m.	buffer: MZÿÿ¸@¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELÚ³B[àP°`@`@.textôOP ` base_address: 0x00400000 process_identifier: 2892 process_handle: 0x00000258	1	1
WriteProcessMemory Feb. 19, 2025, 11:23 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2892 process_handle: 0x00000258	1	1
NtSetContextThread Feb. 19, 2025, 11:23 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4199600 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000254 process_identifier: 2892	1	0
NtResumeThread Feb. 19, 2025, 11:23 a.m.	thread_handle: 0x00000254 suspend_count: 1 process_identifier: 2892	1	0
NtMapViewOfSection Feb. 19, 2025, 11:24 a.m.	section_handle: 0x00000108 process_identifier: 988 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: base_address: 0x04530000 allocation_type: 0 () section_offset: 0 view_size: 14036992 process_handle: 0x0000010c	1	0
NtGetContextThread Feb. 19, 2025, 11:24 a.m.	thread_handle: 0x00000110	1	0
NtSetContextThread Feb. 19, 2025, 11:24 a.m.	registers.eip: 1995571652 registers.esp: 2881864 registers.edi: 0 registers.eax: 630448 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000110 process_identifier: 2672	1	0
NtResumeThread Feb. 19, 2025, 11:38 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 2672	1	0
CreateProcessInternalW Feb. 19, 2025, 11:39 a.m.	thread_identifier: 2976 thread_handle: 0x0000040c process_identifier: 2400 current_directory: filepath: C:\Program Files\Mozilla Firefox\firefox.exe track: 1 command_line: filepath_r: C:\Program Files\Mozilla Firefox\Firefox.exe stack_pivoted: 0 creation_flags: 12 (CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x00000410	1	1

The process powershell.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Users\test22\AppData\Local\Temp\x.exe

ed.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All