Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 13, 2025, 9:44 a.m.	March 13, 2025, 9:47 a.m.

Size	67.5KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`f3848b1d0ad73445ff208123c109b3a3`
SHA256	`9cf1fdb10c69abf321636907171418f4ca79917c2a280fb1d7216fcb99fd2339`
CRC32	`DD7DC67A`
ssdeep	`1536:nRqPkug6bnczC/2OuzoUZ69eAw4i+RGhCvn9iIHFEecSK:c1GEuEUZIw4i+RGhCv9iIHFEe8`
Yara	Win_Trojan_Formbook_Zero - Used Formbook hide_executable_file - Hide executable file

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\MKBOY.ps1
1836
- JXCJKXCJHKJHXCJHKXCXCJHK.exe "C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe"
  2144
  - JXCJKXCJHKJHXCJHKXCXCJHK.exe "C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe"
    2288

Name	Response	Post-Analysis Lookup
geoplugin.net	A 178.237.33.50	178.237.33.50

IP Address	Status	Action
164.124.101.2	Active	Moloch
176.65.144.3	Active	Moloch
178.237.33.50	Active	Moloch
198.23.227.212	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49168 -> 198.23.227.212:32583	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 176.65.144.3:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 176.65.144.3:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 176.65.144.3:80 -> 192.168.56.103:49165	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 176.65.144.3:80 -> 192.168.56.103:49165	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 176.65.144.3:80 -> 192.168.56.103:49165	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.103:49168 198.23.227.212:32583	None	None	None

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 13, 2025, 9:44 a.m.			0	0
IsDebuggerPresent March 13, 2025, 9:44 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 13, 2025, 9:44 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://176.65.144.3/dev/muk.exe
suspicious_features	GET method with no useragent header				suspicious_request	GET http://geoplugin.net/json.gp

Performs some HTTP requests (2 events)

request	GET http://176.65.144.3/dev/muk.exe
request	GET http://geoplugin.net/json.gp

Allocates read-write-execute memory (usually to unpack itself) (31 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024df000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02469000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05430000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02190000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02360000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00322000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00640000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00641000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0032a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00642000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00643000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00644000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00346000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0034a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00347000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00645000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00646000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04472000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00647000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00648000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe
file	C:\Users\test22\AppData\Local\Temp\RUNPEE.dll

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe
file	C:\Users\test22\AppData\Local\Temp\RUNPEE.dll

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 13, 2025, 9:44 a.m.	flags: 15 family: 0		111	0

Yara rule detected in process memory (12 events)

description	Take ScreenShot	rule	ScreenShot
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 624e5f7f3fd08c05665129e52f8e735a2b2d4144

Communicates with host for which no DNS query was performed (2 events)

host	176.65.144.3
host	198.23.227.212

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2288 region_size: 561152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000404	1	0	0

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 13, 2025, 9:44 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2288 process_handle: 0x00000404	1	1	0

File has been identified by 17 AntiVirus engines on VirusTotal as malicious (17 events)

CTX	powershell.unknown.msilheracles
ALYac	Gen:Variant.MSILHeracles.214850
VIPRE	Gen:Variant.MSILHeracles.214850
Arcabit	Trojan.MSILHeracles.D34742 [many]
ESET-NOD32	a variant of MSIL/Injector.LOS
Kaspersky	UDS:Trojan.MSIL.Zapchast.gen
BitDefender	Gen:Variant.MSILHeracles.214850
MicroWorld-eScan	Gen:Variant.MSILHeracles.214850
Emsisoft	Gen:Variant.MSILHeracles.214850 (B)
Sophos	Troj/PSDrop-JU
Ikarus	Trojan.PS.Agent
FireEye	Gen:Variant.MSILHeracles.214850
Google	Detected
Microsoft	Trojan:Script/Wacatac.B!ml
ZoneAlarm	Troj/PSDrop-JU
GData	Gen:Variant.MSILHeracles.214850
huorong	Trojan/ShellLoader.op

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2144 called NtSetContextThread to modify thread in remote process 2288
NtSetContextThread March 13, 2025, 9:44 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4733920 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000040c process_identifier: 2288	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe"
parent_process	powershell.exe				martian_process	C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2144 resumed a thread in remote process 2288
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x0000040c suspend_count: 1 process_identifier: 2288	1	0	0

Executed a process and injected code into it, probably while unpacking (19 events)

Time & API	Arguments	Status	Return
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x000003d8 suspend_count: 1 process_identifier: 1836	1	0
CreateProcessInternalW March 13, 2025, 9:44 a.m.	thread_identifier: 2148 thread_handle: 0x000004d8 process_identifier: 2144 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004e0	1	1
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x00000500 suspend_count: 1 process_identifier: 1836	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2144	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2144	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 2144	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x000001ec suspend_count: 1 process_identifier: 2144	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x00000200 suspend_count: 1 process_identifier: 2144	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x00000228 suspend_count: 1 process_identifier: 2144	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x00000378 suspend_count: 1 process_identifier: 2144	1	0
CreateProcessInternalW March 13, 2025, 9:44 a.m.	thread_identifier: 2292 thread_handle: 0x0000040c process_identifier: 2288 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000404	1	1
NtGetContextThread March 13, 2025, 9:44 a.m.	thread_handle: 0x0000040c	1	0
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2288 region_size: 561152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000404	1	0
WriteProcessMemory March 13, 2025, 9:44 a.m.	buffer: base_address: 0x00400000 process_identifier: 2288 process_handle: 0x00000404	1	1
WriteProcessMemory March 13, 2025, 9:44 a.m.	buffer: base_address: 0x0044e000 process_identifier: 2288 process_handle: 0x00000404	1	1
WriteProcessMemory March 13, 2025, 9:44 a.m.	buffer: base_address: 0x00484000 process_identifier: 2288 process_handle: 0x00000404	1	1
WriteProcessMemory March 13, 2025, 9:44 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2288 process_handle: 0x00000404	1	1
NtSetContextThread March 13, 2025, 9:44 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4733920 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000040c process_identifier: 2288	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x0000040c suspend_count: 1 process_identifier: 2288	1	0

The process powershell.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe

MKBOY.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All