Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 23, 2021, 5:38 p.m.	May 23, 2021, 5:40 p.m.

Size	2.6KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`a140c5bb18fc4adb4a2f5d2a907de048`
SHA256	`1a745b44a0ca52b87ddd0d767b830474a8d95d1447ded8b27dc37a8a7a8fe20b`
CRC32	`8E7F7034`
ssdeep	`48:MAkN+lk6BKfU/X5tAo3XwPC+7ULtZVvlkphGBXpLV9WfbwKW7T/Rz0lT76la/W01:1Qc/JtD3OCbaGgzRWvR4lTP1`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\ALL.txt.ps1
8024

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (8 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 23, 2021, 5:38 p.m.	buffer: Missing ')' in method call. console_handle: 0x00000023	1	1
WriteConsoleW May 23, 2021, 5:38 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\ALL.txt.ps1:4 char:121 console_handle: 0x0000002f	1	1
WriteConsoleW May 23, 2021, 5:38 p.m.	buffer: + $D4FD5C5B9266824C4EEFC83E0C69FD3FAAG = [Text.Encoding]::Utf8.GetString([Con console_handle: 0x0000003b	1	1
WriteConsoleW May 23, 2021, 5:38 p.m.	buffer: vert]::$D4FD5C5B9266824C4EEFC83E0C69FD3FAAx <<<< ($D4FD5C5B9266824C4EEFC83E0C69 console_handle: 0x00000047	1	1
WriteConsoleW May 23, 2021, 5:38 p.m.	buffer: FD3FAAE)) console_handle: 0x00000053	1	1
WriteConsoleW May 23, 2021, 5:38 p.m.	buffer: + CategoryInfo : ParserError: (CloseParenToken:TokenId) [], Paren console_handle: 0x0000005f	1	1
WriteConsoleW May 23, 2021, 5:38 p.m.	buffer: tContainsErrorRecordException console_handle: 0x0000006b	1	1
WriteConsoleW May 23, 2021, 5:38 p.m.	buffer: + FullyQualifiedErrorId : MissingEndParenthesisInMethodCall console_handle: 0x00000077	1	1

Uses Windows APIs to generate a cryptographic key (4 events)

Time & API	Arguments	Status	Return
CryptExportKey May 23, 2021, 5:38 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x050828e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 23, 2021, 5:38 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x050828e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 23, 2021, 5:38 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0027dbb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 23, 2021, 5:38 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0027dbb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06620000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066be000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066bf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026df000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02699000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2021, 5:38 p.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

File has been identified by one AntiVirus engine on VirusTotal as malicious (1 event)

ESET-NOD32

VBS/TrojanDownloader.Agent.VMJ

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

ALL.txt

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All