Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Dec. 6, 2024, 9:34 a.m.	Dec. 6, 2024, 9:46 a.m.

Size	1.2MB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`42fdb45fcd954470c11adb6c97a214b3`
SHA256	`91e6da8192f644d48279423cd3d7460d1fe706afffef3c9e04d6b28b10299ca4`
CRC32	`C82FA5B5`
ssdeep	`12288:r0AVo361AC3ZEohiJFwEab7OFYZDhDnALoWxXruS7BqiY9bzJ5nDEUf03QHUunOZ:Xe1pxxVH0Xu`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\fff.ps1
2540

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey Dec. 6, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0055db38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 6, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0055db38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 6, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0055db38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 6, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0055db38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 6, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0055db38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 6, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0055db38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 6, 2024, 9:34 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (14 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Dec. 6, 2024, 9:34 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:34 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0272f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:34 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:34 a.m.	process_identifier: 2540 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05610000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:34 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05612000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:34 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05613000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:34 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05614000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:34 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:34 a.m.	process_identifier: 2540 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x086f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:34 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:34 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08891000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:34 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08892000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:34 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08893000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:34 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08894000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (3 events)

file	C:\ProgramData\WindowsHolographicDrivers\regid.1991-07com.microsoft\regid.1991-05com.microsoftVsEnhance.bat
file	C:\ProgramData\WindowsHolographicDrivers\regid.1991-07com.microsoft\regid.1991-05com.microsoftVsLabs.vbs
file	C:\ProgramData\WindowsHolographicDrivers\regid.1991-07com.microsoft\regid.1991-05com.microsoftVsLabsData.ps1

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Lionic	Trojan.Script.Generic.4!c
CTX	txt.trojan.generic
ALYac	Trojan.Generic.37081089
VIPRE	Trojan.Generic.37081089
Arcabit	Trojan.Generic.D235D001
Symantec	ISB.Heuristic!gen39
ESET-NOD32	PowerShell/Kryptik.BO
Avast	PwrSh:Iex-C [PUP]
Kaspersky	HEUR:Trojan.Script.Generic
BitDefender	Trojan.Generic.37081089
MicroWorld-eScan	Trojan.Generic.37081089
Emsisoft	Trojan.Generic.37081089 (B)
Sophos	Mal/PSDL-J
Ikarus	Trojan.PowerShell.Crypt
FireEye	Trojan.Generic.37081089
Google	Detected
Microsoft	Trojan:Script/Wacatac.B!ml
GData	Trojan.Generic.37081089
Tencent	Script.Trojan.Generic.Bkjl
huorong	VirTool/PS.Obfuscator.e
AVG	PwrSh:Iex-C [PUP]
alibabacloud	Trojan:Win/Generic.Gen

fff.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All