Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

Shtate.txt.ps1

Generic Malware Antivirus

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 16, 2021, 10:36 a.m.	Aug. 16, 2021, 10:38 a.m.

Size	3.5KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`af241c2ca6817d254292dd3e521470fc`
SHA256	`1740231c96d909b487589b17701a1b90e41895dbc17fef31c2c90a7f92d1cdc9`
CRC32	`2912070A`
ssdeep	`96:Su9/88Tj280+lrF9K/CsF+FuUUnV9D1ggYtJ+L:Su9/dhRF9K/CsFVVh19W4L`
Yara	Generic_Malware_Zero - Generic Malware

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\Shtate.txt.ps1
1936

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (6 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Aug. 16, 2021, 10:36 a.m.	buffer: Unexpected token '(' in expression or statement. console_handle: 0x00000023	1	1	0
WriteConsoleW Aug. 16, 2021, 10:36 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\Shtate.txt.ps1:3 char:50 console_handle: 0x0000002f	1	1	0
WriteConsoleW Aug. 16, 2021, 10:36 a.m.	buffer: + [system.io.directory]::$YGUYGNUHYGUYGYUGYGUYGYUG( <<<< $FVYTFYTFYFYFYFYFGY) console_handle: 0x0000003b	1	1	0
WriteConsoleW Aug. 16, 2021, 10:36 a.m.	buffer: + CategoryInfo : ParserError: ((:String) [], ParentContainsErrorR console_handle: 0x00000047	1	1	0
WriteConsoleW Aug. 16, 2021, 10:36 a.m.	buffer: ecordException console_handle: 0x00000053	1	1	0
WriteConsoleW Aug. 16, 2021, 10:36 a.m.	buffer: + FullyQualifiedErrorId : UnexpectedToken console_handle: 0x0000005f	1	1	0

Uses Windows APIs to generate a cryptographic key (4 events)

Time & API	Arguments	Status	Return	Repeated
CryptExportKey Aug. 16, 2021, 10:36 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05211460 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Aug. 16, 2021, 10:36 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05211460 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Aug. 16, 2021, 10:36 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003c29f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Aug. 16, 2021, 10:36 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003c29f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0

Allocates read-write-execute memory (usually to unpack itself) (16 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 16, 2021, 10:36 a.m.	process_identifier: 1936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 16, 2021, 10:36 a.m.	process_identifier: 1936 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 16, 2021, 10:36 a.m.	process_identifier: 1936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 16, 2021, 10:36 a.m.	process_identifier: 1936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 16, 2021, 10:36 a.m.	process_identifier: 1936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 16, 2021, 10:36 a.m.	process_identifier: 1936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 16, 2021, 10:36 a.m.	process_identifier: 1936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 16, 2021, 10:36 a.m.	process_identifier: 1936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 16, 2021, 10:36 a.m.	process_identifier: 1936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 16, 2021, 10:36 a.m.	process_identifier: 1936 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 16, 2021, 10:36 a.m.	process_identifier: 1936 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 16, 2021, 10:36 a.m.	process_identifier: 1936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023cf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 16, 2021, 10:36 a.m.	process_identifier: 1936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02399000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 16, 2021, 10:36 a.m.	process_identifier: 1936 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05520000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 16, 2021, 10:36 a.m.	process_identifier: 1936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05522000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 16, 2021, 10:36 a.m.	process_identifier: 1936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05523000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 events)

Cyren	VBS/Agent.AEC
ESET-NOD32	VBS/Agent.PIO
Avast	Script:SNH-gen [Trj]
DrWeb	PowerShell.DownLoader.1435
Ikarus	Trojan.VBS.Agent
Fortinet	VBS/Agent.EBM!tr
AVG	Script:SNH-gen [Trj]
Qihoo-360	virus.vbs.qexvmc.1065