Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 20, 2024, 9:08 a.m.	Oct. 20, 2024, 9:16 a.m.

Size	3.5KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`8b5569d5eade5245351fe555ea35463d`
SHA256	`9664717f5d5aea7a7be8547894b94fad6cb76fecb39e556ca196a2d6070418df`
CRC32	`0BD817E7`
ssdeep	`96:shRGTpcIpmTHIhfSd8nJVPGbIzPk91BOwI6B7aT:shCKIpmTsio16haT`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\shell.ps1
2560
- csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\vm8aajwx.cmdline"
  2676
  - cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RESF722.tmp" "c:\Users\test22\AppData\Local\Temp\CSCF712.tmp"
    2720

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Uses Windows APIs to generate a cryptographic key (44 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c07b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c07b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7dc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7e00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 20, 2024, 9:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d7d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Allocates read-write-execute memory (usually to unpack itself) (13 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 20, 2024, 9:08 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 20, 2024, 9:08 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0262f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 20, 2024, 9:08 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02239000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 20, 2024, 9:08 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 20, 2024, 9:08 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05476000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 20, 2024, 9:08 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05477000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 20, 2024, 9:08 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05478000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 20, 2024, 9:08 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0223a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 20, 2024, 9:08 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05610000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 20, 2024, 9:08 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 20, 2024, 9:08 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 20, 2024, 9:08 a.m.	process_identifier: 2676 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 20, 2024, 9:08 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	c:\Users\test22\AppData\Local\Temp\vm8aajwx.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\vm8aajwx.dll

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\vm8aajwx.cmdline"

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\vm8aajwx.cmdline

One or more non-whitelisted processes were created (1 event)

parent_process

powershell.exe

martian_process

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\vm8aajwx.cmdline"

File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 events)

Lionic	Trojan.Script.Powershell.4!c
MicroWorld-eScan	Generic.Powershell.Injector.B.F427E818
CTX	powershell.trojan.rozena
CAT-QuickHeal	PS1.Trojan.48671
Skyhigh	PS/MPreter
ALYac	Generic.Powershell.Injector.B.F427E818
VIPRE	Generic.Powershell.Injector.B.F427E818
Sangfor	Trojan.Generic-PS.Save.f269422b
Symantec	Hacktool.Rexershell
ESET-NOD32	PowerShell/Rozena.AH
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.PowerShell.Generic
BitDefender	Generic.Powershell.Injector.B.F427E818
Emsisoft	Generic.Powershell.Injector.B.F427E818 (B)
F-Secure	Trojan.TR/PShell.Agent.PRC
DrWeb	PowerShell.Shellcode.24
Sophos	ATK/Venom-A
Ikarus	Trojan.PowerShell.Rozena
FireEye	Generic.Powershell.Injector.B.F427E818
Google	Detected
Avira	TR/PShell.Agent.PRC
Arcabit	Generic.Powershell.Injector.B.F427E818
ZoneAlarm	HEUR:Trojan.PowerShell.Generic
Microsoft	Trojan:PowerShell/Rozena.HNAB!MTB
Varist	PSH/Rozena.B.gen!Camelot
Tencent	Win32.Trojan.Generic.Gkjl
huorong	Backdoor/Meterpreter.as
alibabacloud	Trojan:Win/Rozena.AJ

shell.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All