Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

r.png.ps1

Hide_EXE Generic Malware Antivirus Anti_VM

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 7, 2023, 9:15 a.m.	June 7, 2023, 9:17 a.m.

Size	201.6KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`e11a08cea05e73a3949fb5f54137bf06`
SHA256	`d1e0540349f026e3911458e9544110161d381c108d2a5498f29172cdb7284cc2`
CRC32	`62F3A2A5`
ssdeep	`1536:NSLNshbCbk/MhHBWHgaTlkImLbxNDo9U4hfyfE+QInqzRZo/6WhtVxFBXahLLsw6:KXf8gc+QIMpjsi315k3AptzM`
Yara	anti_vm_detect - Possibly employs anti-virtualization techniques hide_executable_file - Hide executable file

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\r.png.ps1
3016

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (6 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW June 7, 2023, 9:15 a.m.	buffer: Unexpected token '(' in expression or statement. console_handle: 0x00000023	1	1	0
WriteConsoleW June 7, 2023, 9:15 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\r.png.ps1:53 char:22 console_handle: 0x0000002f	1	1	0
WriteConsoleW June 7, 2023, 9:15 a.m.	buffer: + IEX([IO.File]::$jgfc( <<<< 'C:\ProgramData\qrhl\qrhl.ps1')) console_handle: 0x0000003b	1	1	0
WriteConsoleW June 7, 2023, 9:15 a.m.	buffer: + CategoryInfo : ParserError: ((:String) [], ParentContainsErrorR console_handle: 0x00000047	1	1	0
WriteConsoleW June 7, 2023, 9:15 a.m.	buffer: ecordException console_handle: 0x00000053	1	1	0
WriteConsoleW June 7, 2023, 9:15 a.m.	buffer: + FullyQualifiedErrorId : UnexpectedToken console_handle: 0x0000005f	1	1	0

Uses Windows APIs to generate a cryptographic key (4 events)

Time & API	Arguments	Status	Return	Repeated
CryptExportKey June 7, 2023, 9:15 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00365d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey June 7, 2023, 9:15 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00365d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey June 7, 2023, 9:15 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ecef8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey June 7, 2023, 9:15 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ecef8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 7, 2023, 9:15 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (19 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06310000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06340000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06341000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06342000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06343000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06344000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06345000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06346000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06347000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0634b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0635c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0635d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0635e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 7, 2023, 9:15 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

Symantec	Trojan.Gen.NPE.C
ESET-NOD32	PowerShell/Runner.BG
Avast	Script:SNH-gen [Trj]
Kaspersky	HEUR:Trojan.PowerShell.Kryptik.gen
Tencent	Win32.Trojan.Kryptik.Rimw
Ikarus	Trojan.PowerShell.Runner
Microsoft	Trojan:Win32/Casdet!rfn
Gridinsoft	Trojan.U.AsyncRAT.bot
ZoneAlarm	HEUR:Trojan.PowerShell.Kryptik.gen
GData	Script.Trojan.Agent.W1XLDJ
Rising	Trojan.Runner/PS!8.14176 (TOPIS:E0:ZsKddpYAZgG)
AVG	Script:SNH-gen [Trj]