Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Dec. 6, 2024, 9:35 a.m.	Dec. 6, 2024, 9:50 a.m.

Size	2.9MB
Type	ASCII text, with very long lines, with no line terminators
MD5	`cec79015727b3bff0975cf827521069f`
SHA256	`3c4ce855064c52c0717d5c57393c10d1dbbe45f033ac2ad55ac258ab2600ee40`
CRC32	`57159FFA`
ssdeep	`49152:lY1wOeTfeinwRg0Yd0YtWdR2++BqkPiblNmBZOqsHtL3rdyW6JKHINYMpnkq/3+w:H`
Yara	hide_executable_file - Hide executable file

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\g8wt4y.ps1
2544

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (8 events)

Time & API	Arguments	Status	Return
WriteConsoleW Dec. 6, 2024, 9:35 a.m.	buffer: GAC Version Location console_handle: 0x0000001b	1	1
WriteConsoleW Dec. 6, 2024, 9:35 a.m.	buffer: False v4.0.30319 console_handle: 0x00000023	1	1
WriteConsoleW Dec. 6, 2024, 9:35 a.m.	buffer: Exception calling "Main" with "0" argument(s): "The type initializer for 'QJAMs console_handle: 0x00000037	1	1
WriteConsoleW Dec. 6, 2024, 9:35 a.m.	buffer: rpfhk.HH' threw an exception." console_handle: 0x00000043	1	1
WriteConsoleW Dec. 6, 2024, 9:35 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\g8wt4y.ps1:4 char:22 console_handle: 0x0000004f	1	1
WriteConsoleW Dec. 6, 2024, 9:35 a.m.	buffer: + [QJAMsrpfhk.HH]::Main <<<< () console_handle: 0x0000005b	1	1
WriteConsoleW Dec. 6, 2024, 9:35 a.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x00000067	1	1
WriteConsoleW Dec. 6, 2024, 9:35 a.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x00000073	1	1

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey Dec. 6, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d5e98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 6, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d5e98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 6, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d5e98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 6, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d5e98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 6, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d5e98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 6, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005d5e98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 6, 2024, 9:35 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (17 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025ef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02579000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ae0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ae1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ae2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ae3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0d070000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0d260000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0d261000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0d262000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0d263000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0d264000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05461000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ae4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 6, 2024, 9:35 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ae5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

CTX	powershell.unknown.msilperseus
Skyhigh	PS/Agent.gs
ALYac	Gen:Variant.MSILPerseus.238142
VIPRE	Gen:Variant.MSILPerseus.238142
Arcabit	Trojan.MSILPerseus.D3A23E
Symantec	Trojan.Gen.MBT
ESET-NOD32	PowerShell/RiskWare.Inject.A
Avast	Other:Malware-gen [Trj]
Kaspersky	HEUR:Trojan-PSW.MSIL.Stealer.gen
BitDefender	Gen:Variant.MSILPerseus.238142
MicroWorld-eScan	Gen:Variant.MSILPerseus.238142
Emsisoft	Gen:Variant.MSILPerseus.238142 (B)
DrWeb	PowerShell.MulDrop.199
Ikarus	Trojan.PS.Agent
FireEye	Gen:Variant.MSILPerseus.238142
Google	Detected
Kingsoft	MSIL.Trojan-PSW.Stealer.gen
Microsoft	Trojan:PowerShell/Powdow.HNAV!MTB
GData	Gen:Variant.MSILPerseus.238142
McAfee	PS/Agent.gs
Tencent	Msil.Trojan-QQPass.QQRob.Pgil
huorong	Trojan/PS.Encpe.a
AVG	Other:Malware-gen [Trj]

g8wt4y.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All