Summary | ZeroBOX

Director.bat

Hide_EXE Downloader FTP Code injection DGA Escalate priviledges Socket ScreenShot Create Service KeyLogger P2P Internet API Sniff Audio DNS Http API HTTP Steal credential PWS AntiVM AntiDebug
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 12, 2024, 9:19 a.m. Aug. 12, 2024, 9:51 a.m.
Size 7.2KB
Type ASCII text, with very long lines, with CRLF, LF line terminators
MD5 641d4aab4f8fe4e9328dfc54dc158a99
SHA256 335cafecaaac22231062c775573f3c9d192ef5e430ba99cabdd411504a7b3d9d
CRC32 8CAC8BA8
ssdeep 96:KPk9Zgo5eSd80LHJ/g9jN/aVS52m2KpX+9AL7qPBOJJhKgXqxneuGIaPc03rsh3:lZgo5djHhgtHEHKpuAvXJ7JE5x
Yara
  • hide_executable_file - Hide executable file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: Function
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: nhnBxtsNb(fDCGJzHLbErbn)
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 'Function' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: VkPMfwODPcwSpi
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: = "<B64DECODE xmlns:dt="
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: Chr
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: "urn:schemas-microsoft-com:datatypes"
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: Chr
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 'VkPMfwODPcwSpi' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: 'Chr' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: The filename, directory name, or volume label syntax is incorrect.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: 'Chr' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: '" "' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: '_' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: "dt:dt="
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: Chr
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: "bin.base64"
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: Chr
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: The filename, directory name, or volume label syntax is incorrect.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: 'Chr' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: '"bin.base64"' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: 'Chr' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: '">"' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: '_' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: fDCGJzHLbErbn
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: "</B64DECODE>"
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 'fDCGJzHLbErbn' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: The filename, directory name, or volume label syntax is incorrect.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: Set
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: bOXGPqQfhio = CreateObject("MSXML2.DOMDocument.3.0")
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: bOXGPqQfhio.LoadXML
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: (VkPMfwODPcwSpi)
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 'bOXGPqQfhio.LoadXML' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: nhnBxtsNb
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: = bOXGPqQfhio.selectsinglenode("B64DECODE").nodeTypedValue
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 'nhnBxtsNb' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: set
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: bOXGPqQfhio = nothing
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: End
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: Function
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 'End' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0
description Create a windows service rule Create_Service
description Communications over RAW Socket rule Network_TCP_Socket
description Communication using DGA rule Network_DGA
description Match Windows Http API call rule Str_Win32_Http_API
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description Steal credential rule local_credential_Steal
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Communications over HTTP rule Network_HTTP
description Communications use DNS rule Network_DNS
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description File Downloader rule Network_Downloader
description Match Windows Inet API call rule Str_Win32_Internet_API
description Communications over FTP rule Network_FTP
description Run a KeyLogger rule KeyLogger
description Communications over P2P network rule Network_P2P_Win
file C:\Users\test22\AppData\Local\Temp\"dt:dt="
file C:\Users\test22\AppData\Local\Temp\"urn:schemas-microsoft-com:datatypes"
Lionic Trojan.Script.Generic.4!c
ClamAV Vbs.Backdoor.Msfvenom_Payload-9955777-0
CAT-QuickHeal Trojan.VBS.33100
McAfee VBS/MPreter
ALYac VB:Trojan.VBS.Dropper.AG
VIPRE VB:Trojan.VBS.Dropper.AG
Sangfor Malware.Generic-Script.Save.c5b409aa
Arcabit VB:Trojan.VBS.Dropper.AG
Baidu JS.Trojan-Downloader.Agent.xk
Cyren VBS/Agent.AJU!Eldorado
Symantec VBS.Heur.SNIC
ESET-NOD32 Win32/Rozena.ED
Avast BV:Dowloader-A [Trj]
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender VB:Trojan.VBS.Dropper.AG
NANO-Antivirus Trojan.Script.Agent.fosjzx
MicroWorld-eScan VB:Trojan.VBS.Dropper.AG
Rising Dropper.Ploty!8.EEC8 (TOPIS:E0:JqyfiJ1QMlQ)
Emsisoft VB:Trojan.VBS.Dropper.AG (B)
F-Secure Malware.HTML/ExpKit.Gen2
DrWeb JS.Muldrop.457
TrendMicro HEUR_VBS.O1
McAfee-GW-Edition VBS/MPreter
FireEye VB:Trojan.VBS.Dropper.AG
Sophos Troj/Swrort-AL
Ikarus Trojan.Win32.Swrort
Avira HTML/ExpKit.Gen2
Xcitium TrojWare.VBS.TrojanDropper.Agent.NJA@833icd
Microsoft TrojanDropper:VBS/Ploty.A
ZoneAlarm HEUR:Trojan.Win32.Generic
GData VB:Trojan.VBS.Dropper.AG
Google Detected
Tencent Win32.Trojan.Expkit.Bdhl
MAX malware (ai score=85)
Fortinet VBS/Rozena.ED!tr
AVG BV:Dowloader-A [Trj]