Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

x75eie.ps1

Hide_EXE Generic Malware Antivirus

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Dec. 6, 2024, 9:35 a.m.	Dec. 6, 2024, 9:48 a.m.

Size	5.1MB
Type	ASCII text, with very long lines, with no line terminators
MD5	`25e1952efb3a1a45146c028117fd923c`
SHA256	`74c3f8d065352120ccaa006d24e51bdd8508a4222e8e7ce30fd89c6e26b02480`
CRC32	`8A18F76A`
ssdeep	`49152:WY1wOeTfeinwRg0Yd0YtWdR2++BqkPiblNmBZOqsHtL3rdyW6JKHINYMpnkq/3+G:a`
Yara	hide_executable_file - Hide executable file

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\x75eie.ps1
300

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (8 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Dec. 6, 2024, 9:35 a.m.	buffer: GAC Version Location console_handle: 0x0000001b	1	1	0
WriteConsoleW Dec. 6, 2024, 9:35 a.m.	buffer: False v4.0.30319 console_handle: 0x00000023	1	1	0
WriteConsoleW Dec. 6, 2024, 9:35 a.m.	buffer: Exception calling "Main" with "0" argument(s): "The type initializer for 'QJAMs console_handle: 0x00000037	1	1	0
WriteConsoleW Dec. 6, 2024, 9:35 a.m.	buffer: rpfhk.HH' threw an exception." console_handle: 0x00000043	1	1	0
WriteConsoleW Dec. 6, 2024, 9:35 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\x75eie.ps1:4 char:22 console_handle: 0x0000004f	1	1	0
WriteConsoleW Dec. 6, 2024, 9:35 a.m.	buffer: + [QJAMsrpfhk.HH]::Main <<<< () console_handle: 0x0000005b	1	1	0
WriteConsoleW Dec. 6, 2024, 9:35 a.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x00000067	1	1	0
WriteConsoleW Dec. 6, 2024, 9:35 a.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x00000073	1	1	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return	Repeated
CryptExportKey Dec. 6, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003c4490 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Dec. 6, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003c4490 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Dec. 6, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003c4490 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Dec. 6, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003c4490 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Dec. 6, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003c4490 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Dec. 6, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003c4490 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 6, 2024, 9:35 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (17 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0254b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0255f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x14940000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x14ae0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x14ae1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x14ae2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x14ae3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x14ae4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05241000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 events)

Skyhigh	PS/Agent.gs
Symantec	Trojan.Gen.NPE
ESET-NOD32	PowerShell/RiskWare.Inject.A
McAfee	PS/Agent.gs
Avast	Other:Malware-gen [Trj]
Kaspersky	HEUR:Trojan-PSW.MSIL.Stealer.gen
DrWeb	PowerShell.MulDrop.199
Ikarus	Trojan.PS.Agent
Google	Detected
Kingsoft	Script.Ks.Malware.9344
Microsoft	Trojan:MSIL/SpyNoon.AMAA!MTB
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Stealer.gen
Tencent	Msil.Trojan-QQPass.QQRob.Mqil
AVG	Other:Malware-gen [Trj]
alibabacloud	Trojan:Win/Inject.A