Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 13, 2025, 9:44 a.m.	March 13, 2025, 10:02 a.m.

Size	67.5KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`50955e71d07cd14cee26f5d7d8d35fbc`
SHA256	`99638548506568949f57638461b2835b203149456ebd6c1cf383cf3d9c0bd358`
CRC32	`A0B6993B`
ssdeep	`1536:WLebwaNKvtq/TAokXiW2QbEtvKjCcaI+itoGmBR:hwa9M2QbEtvKjCcaI+itoGK`
Yara	hide_executable_file - Hide executable file

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\MUK.ps1
2540
- JXCJKXCJHKJHXCJHKXCXCJHK.exe "C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe"
  2668
  - JXCJKXCJHKJHXCJHKXCXCJHK.exe "C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe"
    2820

Name	Response	Post-Analysis Lookup
geoplugin.net	A 178.237.33.50	178.237.33.50

IP Address	Status	Action
164.124.101.2	Active	Moloch
176.65.144.3	Active	Moloch
178.237.33.50	Active	Moloch
198.23.227.212	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49167 -> 198.23.227.212:32583	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	Malware Command and Control Activity Detected
TCP 192.168.56.101:49164 -> 176.65.144.3:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 192.168.56.101:49164 -> 176.65.144.3:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 176.65.144.3:80 -> 192.168.56.101:49164	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 176.65.144.3:80 -> 192.168.56.101:49164	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 176.65.144.3:80 -> 192.168.56.101:49164	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.101:49167 198.23.227.212:32583	None	None	None

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 13, 2025, 9:44 a.m.			0	0
IsDebuggerPresent March 13, 2025, 9:44 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 13, 2025, 9:44 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://176.65.144.3/dev/muk.exe
suspicious_features	GET method with no useragent header				suspicious_request	GET http://geoplugin.net/json.gp

Performs some HTTP requests (2 events)

request	GET http://176.65.144.3/dev/muk.exe
request	GET http://geoplugin.net/json.gp

Allocates read-write-execute memory (usually to unpack itself) (31 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0275b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0276f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05750000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00670000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00780000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00542000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00730000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00731000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00062000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00732000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00733000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00734000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00585000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00577000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00735000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00736000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x073b2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00737000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00738000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2820 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe
file	C:\Users\test22\AppData\Local\Temp\RUNPEE.dll

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\RUNPEE.dll
file	C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 13, 2025, 9:44 a.m.	flags: 15 family: 0		111	0

Yara rule detected in process memory (12 events)

description	Take ScreenShot	rule	ScreenShot
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 624e5f7f3fd08c05665129e52f8e735a2b2d4144

Communicates with host for which no DNS query was performed (2 events)

host	176.65.144.3
host	198.23.227.212

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2820 region_size: 561152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000408	1	0	0

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 13, 2025, 9:44 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2820 process_handle: 0x00000408	1	1	0

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

ClamAV	Win.Countermeasure.DotNetToJScript-9804890-0
VIPRE	Gen:Heur.MSIL.Krypt.6
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Injector.LOS
Kaspersky	UDS:Trojan.MSIL.Zapchast.gen
MicroWorld-eScan	Gen:Heur.MSIL.Krypt.6
Sophos	Troj/PSDrop-JU
Ikarus	Trojan.PS.Agent
Google	Detected
Microsoft	Trojan:Script/Wacatac.B!ml
ZoneAlarm	Troj/PSDrop-JU
huorong	Trojan/PS.Encpe.a

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2668 called NtSetContextThread to modify thread in remote process 2820
NtSetContextThread March 13, 2025, 9:44 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4733920 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000410 process_identifier: 2820	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe"
parent_process	powershell.exe				martian_process	C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2668 resumed a thread in remote process 2820
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x00000410 suspend_count: 1 process_identifier: 2820	1	0	0

Executed a process and injected code into it, probably while unpacking (25 events)

Time & API	Arguments	Status	Return
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x000003d4 suspend_count: 1 process_identifier: 2540	1	0
CreateProcessInternalW March 13, 2025, 9:44 a.m.	thread_identifier: 2672 thread_handle: 0x000004d4 process_identifier: 2668 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004dc	1	1
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x000004f4 suspend_count: 1 process_identifier: 2540	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2668	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2668	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x00000180 suspend_count: 1 process_identifier: 2668	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x000001e4 suspend_count: 1 process_identifier: 2668	1	0
NtGetContextThread March 13, 2025, 9:44 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread March 13, 2025, 9:44 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2668	1	0
NtGetContextThread March 13, 2025, 9:44 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread March 13, 2025, 9:44 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2668	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x000001f8 suspend_count: 1 process_identifier: 2668	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x00000220 suspend_count: 1 process_identifier: 2668	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x0000037c suspend_count: 1 process_identifier: 2668	1	0
CreateProcessInternalW March 13, 2025, 9:44 a.m.	thread_identifier: 2824 thread_handle: 0x00000410 process_identifier: 2820 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000408	1	1
NtGetContextThread March 13, 2025, 9:44 a.m.	thread_handle: 0x00000410	1	0
NtAllocateVirtualMemory March 13, 2025, 9:44 a.m.	process_identifier: 2820 region_size: 561152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000408	1	0
WriteProcessMemory March 13, 2025, 9:44 a.m.	buffer: base_address: 0x00400000 process_identifier: 2820 process_handle: 0x00000408	1	1
WriteProcessMemory March 13, 2025, 9:44 a.m.	buffer: base_address: 0x0044e000 process_identifier: 2820 process_handle: 0x00000408	1	1
WriteProcessMemory March 13, 2025, 9:44 a.m.	buffer: base_address: 0x00484000 process_identifier: 2820 process_handle: 0x00000408	1	1
WriteProcessMemory March 13, 2025, 9:44 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2820 process_handle: 0x00000408	1	1
NtSetContextThread March 13, 2025, 9:44 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4733920 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000410 process_identifier: 2820	1	0
NtResumeThread March 13, 2025, 9:44 a.m.	thread_handle: 0x00000410 suspend_count: 1 process_identifier: 2820	1	0

The process powershell.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe

MUK.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All