Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 10, 2023, 10:34 a.m.	Oct. 10, 2023, 10:37 a.m.

Size	221.0KB
Type	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5	`afaec0cb0efc79d3c2effd5ea7c43cf9`
SHA256	`94d7c6641c880897bf7f57748a298e2cc5a77aa549ba9be0605d7a80d0d5b729`
CRC32	`80CDA6FB`
ssdeep	`3072:PzE4koyAWy4WYiBiHEMadxawPp4wVTwjQdMhvSWm8+B0RjcGd1F9h/IleqxEAY5d:rE4k+WPWYiIkMadxaIp4uwjQdMhvFuC`
Yara	Antivirus - Contains references to security software

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\xxx.jpg.ps1
3064

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Oct. 10, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (50 out of 63 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: Name : ElliotEZ console_handle: 0x0000001f	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: Path : \ElliotEZ console_handle: 0x00000023	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: State : 3 console_handle: 0x00000027	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: Enabled : True console_handle: 0x0000002b	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: LastRunTime : 1899-12-30 오전 12:00:00 console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: LastTaskResult : 1 console_handle: 0x00000033	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: NumberOfMissedRuns : 0 console_handle: 0x00000037	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: NextRunTime : 2023-10-10 오전 11:36:50 console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: Definition : System.__ComObject console_handle: 0x0000003f	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: Xml : <?xml version="1.0" encoding="UTF-16"?> console_handle: 0x00000043	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <Task version="1.2" xmlns="http://schemas.microsoft.com/wi console_handle: 0x00000047	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: ndows/2004/02/mit/task"> console_handle: 0x0000004b	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <RegistrationInfo> console_handle: 0x0000004f	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <Description>Runs a script every 2 minutes</Descriptio console_handle: 0x00000053	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: n> console_handle: 0x00000057	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: </RegistrationInfo> console_handle: 0x0000005b	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <Triggers> console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <TimeTrigger> console_handle: 0x00000063	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <Repetition> console_handle: 0x00000067	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <Interval>PT2M</Interval> console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <StopAtDurationEnd>false</StopAtDurationEnd> console_handle: 0x0000006f	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: </Repetition> console_handle: 0x00000073	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <StartBoundary>2023-10-10T11:34:50</StartBoundary> console_handle: 0x00000077	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <Enabled>true</Enabled> console_handle: 0x0000007b	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: </TimeTrigger> console_handle: 0x0000007f	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: </Triggers> console_handle: 0x00000083	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <Settings> console_handle: 0x00000087	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesP console_handle: 0x0000008b	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: olicy> console_handle: 0x0000008f	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <DisallowStartIfOnBatteries>false</DisallowStartIfOnBa console_handle: 0x00000093	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: tteries> console_handle: 0x00000097	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> console_handle: 0x0000009b	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <AllowHardTerminate>true</AllowHardTerminate> console_handle: 0x0000009f	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <StartWhenAvailable>false</StartWhenAvailable> console_handle: 0x000000a3	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvai console_handle: 0x000000a7	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: lable> console_handle: 0x000000ab	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <IdleSettings> console_handle: 0x000000af	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <Duration>PT10M</Duration> console_handle: 0x000000b3	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <WaitTimeout>PT1H</WaitTimeout> console_handle: 0x000000b7	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <StopOnIdleEnd>true</StopOnIdleEnd> console_handle: 0x000000bb	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <RestartOnIdle>false</RestartOnIdle> console_handle: 0x000000bf	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: </IdleSettings> console_handle: 0x000000c3	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <AllowStartOnDemand>true</AllowStartOnDemand> console_handle: 0x000000c7	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <Enabled>true</Enabled> console_handle: 0x000000cb	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <Hidden>false</Hidden> console_handle: 0x000000cf	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <RunOnlyIfIdle>false</RunOnlyIfIdle> console_handle: 0x000000d3	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <WakeToRun>false</WakeToRun> console_handle: 0x000000d7	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <ExecutionTimeLimit>PT72H</ExecutionTimeLimit> console_handle: 0x000000db	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: <Priority>7</Priority> console_handle: 0x000000df	1	1
WriteConsoleW Oct. 10, 2023, 10:34 a.m.	buffer: </Settings> console_handle: 0x000000e3	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 10, 2023, 10:34 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 10, 2023, 10:34 a.m.	process_identifier: 3064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 10:34 a.m.	process_identifier: 3064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026bf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 10:34 a.m.	process_identifier: 3064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02689000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 10:34 a.m.	process_identifier: 3064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 10:34 a.m.	process_identifier: 3064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 10:34 a.m.	process_identifier: 3064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (3 events)

file	C:\Users\Public\ElliotEZ.ps1
file	C:\Users\Public\ElliotEZ.bat
file	C:\Users\Public\ElliotEZ.vbs

File has been identified by 13 AntiVirus engines on VirusTotal as malicious (13 events)

Arcabit	Heur.BZC.PZQ.Pantera.147.A5ECEB12
Symantec	Backdoor.ASync!gm
Kaspersky	HEUR:Trojan.PowerShell.Generic
BitDefender	Heur.BZC.PZQ.Pantera.147.A5ECEB12
MicroWorld-eScan	Heur.BZC.PZQ.Pantera.147.A5ECEB12
Emsisoft	Heur.BZC.PZQ.Pantera.147.A5ECEB12 (B)
VIPRE	Heur.BZC.PZQ.Pantera.147.A5ECEB12
FireEye	Heur.BZC.PZQ.Pantera.147.A5ECEB12
MAX	malware (ai score=88)
ZoneAlarm	HEUR:Trojan.PowerShell.Generic
GData	Heur.BZC.PZQ.Pantera.147.A5ECEB12
ALYac	Heur.BZC.PZQ.Pantera.147.A5ECEB12
Ikarus	Trojan.MSIL.Agent

xxx.jpg.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All