Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

2.trf.ps1

Generic Malware Antivirus

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 3, 2021, 10:07 a.m.	Oct. 3, 2021, 10:09 a.m.

Size	125.5KB
Type	ASCII text, with very long lines
MD5	`35e8723ab0414fa2f1d4db45d52e2254`
SHA256	`502267c55b05ea3ab651a776028ab40f3b91a0340df2dcdf8728b366cc621e6a`
CRC32	`20A628F9`
ssdeep	`1536:EUAcKVmFyjZEVUT32pHgt013uN6Q5tsFJSsbKTMw7kDMYJiuI/xIaVPQdu4koosU:NxG`
Yara	Generic_Malware_Zero - Generic Malware

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\2.trf.ps1
2272

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (7 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Oct. 3, 2021, 10:07 a.m.	buffer: The "=" operator is missing after a named argument. console_handle: 0x0000001f	1	1	0
WriteConsoleW Oct. 3, 2021, 10:07 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\2.trf.ps1:13 char:24 console_handle: 0x0000002b	1	1	0
WriteConsoleW Oct. 3, 2021, 10:07 a.m.	buffer: + [Parameter(Mandatory, <<<< ValueFromPipeline,ValueFromPipelineByPrope console_handle: 0x00000037	1	1	0
WriteConsoleW Oct. 3, 2021, 10:07 a.m.	buffer: rtyName)] console_handle: 0x00000043	1	1	0
WriteConsoleW Oct. 3, 2021, 10:07 a.m.	buffer: + CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordEx console_handle: 0x0000004f	1	1	0
WriteConsoleW Oct. 3, 2021, 10:07 a.m.	buffer: ception console_handle: 0x0000005b	1	1	0
WriteConsoleW Oct. 3, 2021, 10:07 a.m.	buffer: + FullyQualifiedErrorId : MissingEqualsInNamedArgument console_handle: 0x00000067	1	1	0

Uses Windows APIs to generate a cryptographic key (4 events)

Time & API	Arguments	Status	Return	Repeated
CryptExportKey Oct. 3, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x04d78b98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Oct. 3, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x04d78b98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Oct. 3, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00539678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Oct. 3, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00539678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 3, 2021, 10:07 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (19 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05480000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05490000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05491000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05492000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05493000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05494000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05495000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05496000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05497000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05498000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0549c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x054ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x054ae000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0240f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e79000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 3, 2021, 10:07 a.m.	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

ESET-NOD32	PowerShell/TrojanDropper.Agent.NO
Avast	Script:SNH-gen [Trj]
Kaspersky	HEUR:Trojan.PowerShell.Invoker.gen
DrWeb	PowerShell.Packed.50
McAfee-GW-Edition	PS/Agent.eo
Avira	VBS/Agent.PRG
ZoneAlarm	HEUR:Trojan.PowerShell.Invoker.gen
Cynet	Malicious (score: 99)
McAfee	PS/Agent.eo
Ikarus	Trojan-Dropper.PowerShell.Agent
Fortinet	PowerShell/Agent.NO!tr
AVG	Script:SNH-gen [Trj]