Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

main.ps1

Browser Login Data Stealer Generic Malware Antivirus OS Processor Check ftp

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 17, 2025, 5:13 p.m.	Jan. 17, 2025, 5:16 p.m.

Size	1004.4KB
Type	HTML document, UTF-8 Unicode text, with very long lines
MD5	`f8a7afd165d1f8f66b6885d2fbfe42a2`
SHA256	`94a23e724a681eef9b43751f07d87bb6581ad6e56d63f6efbf52167a75019d35`
CRC32	`D2EE29C2`
ssdeep	`12288:zsbMpOL/saqkPV9Fe2LtcIDSsmw+9uvZJT3CqQrhryf65NRPaCieMjdvCJv1Vi0J:zsZmkkwsJ`
Yara	infoStealer_browser_b_Zero - browser info stealer ftp_command - ftp command Antivirus - Contains references to security software OS_Processor_Check_Zero - OS Processor Check

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\main.ps1
2544

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (17 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: Unexpected token ':"en"' in expression or statement. console_handle: 0x00000023	1	1	0
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\main.ps1:42 char:65 console_handle: 0x0000002f	1	1	0
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: + <script type="application/json" id="client-env">{"locale":"en" <<<< ,"featu console_handle: 0x0000003b	1	1	0
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: reFlags":["alive_longer_retries","bypass_copilot_indexing_quota","copilot_new_r console_handle: 0x00000047	1	1	0
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: eferences_ui","copilot_beta_features_opt_in","copilot_chat_retry_on_error","cop console_handle: 0x00000053	1	1	0
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: ilot_chat_persist_submitted_input","copilot_conversational_ux_history_refs","co console_handle: 0x0000005f	1	1	0
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: pilot_editor_upsells","copilot_free_limited_user","copilot_implicit_context","c console_handle: 0x0000006b	1	1	0
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: opilot_no_floating_button","copilot_smell_icebreaker_ux","experimentation_azure console_handle: 0x00000077	1	1	0
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: _variant_endpoint","failbot_handle_non_errors","geojson_azure_maps","ghost_pilo console_handle: 0x00000083	1	1	0
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: t_confidence_truncation_25","ghost_pilot_confidence_truncation_40","hovercard_a console_handle: 0x0000008f	1	1	0
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: ccessibility","issues_react_remove_placeholders","issues_react_blur_item_picker console_handle: 0x0000009b	1	1	0
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: _on_close","marketing_pages_search_explore_provider","react_keyboard_shortcuts_ console_handle: 0x000000a7	1	1	0
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: dialog","remove_child_patch","sample_network_conn_type","site_metered_billing_u console_handle: 0x000000b3	1	1	0
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: pdate","lifecycle_label_name_updates"]}</script> console_handle: 0x000000bf	1	1	0
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: + CategoryInfo : ParserError: (:"en":String) [], ParentContainsEr console_handle: 0x000000cb	1	1	0
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: rorRecordException console_handle: 0x000000d7	1	1	0
WriteConsoleW Jan. 17, 2025, 5:13 p.m.	buffer: + FullyQualifiedErrorId : UnexpectedToken console_handle: 0x000000e3	1	1	0

Uses Windows APIs to generate a cryptographic key (4 events)

Time & API	Arguments	Status	Return	Repeated
CryptExportKey Jan. 17, 2025, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x05573970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Jan. 17, 2025, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x05573970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Jan. 17, 2025, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bc278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0
CryptExportKey Jan. 17, 2025, 5:13 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006bc278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 17, 2025, 5:13 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (19 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06250000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06330000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06331000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06332000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06333000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06334000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06335000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06336000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06337000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0633b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0634c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0634d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0634e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026af000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021b9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0