Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

b.jpg.ps1

Hide_EXE Generic Malware Antivirus

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 13, 2023, 1:16 p.m.	July 13, 2023, 1:18 p.m.

Size	155.6KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`92589da336f8a80a34a764cb763c7e01`
SHA256	`4060c26b29e027bae9a3932df65e21d619d235fe6988bef53fe22ce5d2926513`
CRC32	`7E7258E7`
ssdeep	`3072:0lpNVyYnJt0WOUkX6U1O315T3Apmf+QIQJ:IpmYnz03Uk2315T3Apmf+QIA`
Yara	hide_executable_file - Hide executable file

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\b.jpg.ps1
2564

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (6 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW July 13, 2023, 1:16 p.m.	buffer: Unexpected token '(' in expression or statement. console_handle: 0x00000023	1	1	0
WriteConsoleW July 13, 2023, 1:16 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\b.jpg.ps1:64 char:22 console_handle: 0x0000002f	1	1	0
WriteConsoleW July 13, 2023, 1:16 p.m.	buffer: + IEX([IO.File]::$ocam( <<<< 'C:\ProgramData\dqjg\dqjg.ps1')) console_handle: 0x0000003b	1	1	0
WriteConsoleW July 13, 2023, 1:16 p.m.	buffer: + CategoryInfo : ParserError: ((:String) [], ParentContainsErrorR console_handle: 0x00000047	1	1	0
WriteConsoleW July 13, 2023, 1:16 p.m.	buffer: ecordException console_handle: 0x00000053	1	1	0
WriteConsoleW July 13, 2023, 1:16 p.m.	buffer: + FullyQualifiedErrorId : UnexpectedToken console_handle: 0x0000005f	1	1	0

Uses Windows APIs to generate a cryptographic key (4 events)

Time & API	Arguments	Status	Return	Repeated
CryptExportKey July 13, 2023, 1:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00516f80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey July 13, 2023, 1:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00516f80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey July 13, 2023, 1:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004811e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey July 13, 2023, 1:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004811e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 13, 2023, 1:16 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (19 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0269b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06290000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0630c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0630d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0630e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026af000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02239000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05712000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 13, 2023, 1:16 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05713000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

File has been identified by 11 AntiVirus engines on VirusTotal as malicious (11 events)

Sangfor	Malware.Generic-HTML.Save.61eb41a5
ESET-NOD32	PowerShell/Runner.BG
Avast	Script:SNH-gen [Drp]
Kaspersky	HEUR:Trojan.PowerShell.Kryptik.gen
Tencent	Win32.Trojan.Kryptik.Umhl
Emsisoft	Trojan.GenericKD.68116438 (B)
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	HEUR:Trojan.PowerShell.Kryptik.gen
GData	Script.Trojan.Agent.Z3IBSD
Rising	Trojan.Runner/PS!8.14176 (TOPIS:E0:zyVglk3iKlG)
AVG	Script:SNH-gen [Drp]