Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

2.txt.ps1

Generic Malware Antivirus

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 24, 2023, 9:34 a.m.	Oct. 24, 2023, 9:36 a.m.

Size	867.0B
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`aadf28a8133c1568c175e89318d94c7c`
SHA256	`a3b92aca9c26e8e65cfcfd7f29a434736768b77129c9fbb7486c6bd6b55df791`
CRC32	`7DB74E82`
ssdeep	`24:Kqf+SJ6vvV7vgfpYKYwAHLYt6h4Y9zAx1:103V4SCOzhltAb`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\2.txt.ps1
2552

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (7 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Oct. 24, 2023, 9:34 a.m.	buffer: Ampersand not allowed. The & operator is reserved for future use; use "&" to pa console_handle: 0x00000023	1	1	0
WriteConsoleW Oct. 24, 2023, 9:34 a.m.	buffer: ss ampersand as a string. console_handle: 0x0000002f	1	1	0
WriteConsoleW Oct. 24, 2023, 9:34 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\2.txt.ps1:2 char:23 console_handle: 0x0000003b	1	1	0
WriteConsoleW Oct. 24, 2023, 9:34 a.m.	buffer: + strXML = "<command>" & <<<< _ console_handle: 0x00000047	1	1	0
WriteConsoleW Oct. 24, 2023, 9:34 a.m.	buffer: + CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordEx console_handle: 0x00000053	1	1	0
WriteConsoleW Oct. 24, 2023, 9:34 a.m.	buffer: ception console_handle: 0x0000005f	1	1	0
WriteConsoleW Oct. 24, 2023, 9:34 a.m.	buffer: + FullyQualifiedErrorId : AmpersandNotAllowed console_handle: 0x0000006b	1	1	0

Uses Windows APIs to generate a cryptographic key (4 events)

Time & API	Arguments	Status	Return	Repeated
CryptExportKey Oct. 24, 2023, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05564458 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Oct. 24, 2023, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05564458 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Oct. 24, 2023, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00759ed0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Oct. 24, 2023, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00759ed0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0269b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06520000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066dd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026af000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02679000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05820000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05822000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:34 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05823000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

File has been identified by 6 AntiVirus engines on VirusTotal as malicious (6 events)

Symantec	ISB.Downloader!gen48
Avast	Script:SNH-gen [Trj]
Kaspersky	HEUR:Trojan.Script.Agent.gen
Microsoft	Trojan:HTML/Casdet!rfn
ZoneAlarm	HEUR:Trojan.Script.Agent.gen
AVG	Script:SNH-gen [Trj]