Report - ZeroBOX

ScreenShot


Created	2024.06.24 15:51	Machine	s1_win7_x6401
Filename	pumairld.txt.ps1
Type	ASCII text, with very long lines, with no line terminators
AI Score	Not founds	Behavior Score	8.4
ZERO API	file : clean
VT API (file)	17 detected (Malicious, score, GBLD, Save, PowerShell, PShell, ai score=81)
md5	19a7f5e2e7fd8e14d8129dcdf6c8b992
sha256	21c2d6fa3ebf8865bbfd76ed22dffb95f587db80ab4f570a379bab75c34a8f3d
ssdeep	24:XMbJsZKpJsJfWI3MjxBxLABT6UvoBunqfnxDttPWAa6Oz1umAdg:sJ/pJeuI8jxBenooG98/Adg
imphash
impfuzzy

Network IP location

Level	Description
watch	Attempts to identify installed AV products by installation directory
watch	Creates a suspicious Powershell process
watch	Drops a binary and executes it
watch	File has been identified by 17 AntiVirus engines on VirusTotal as malicious
watch	Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe
watch	One or more non-whitelisted processes were created
watch	The process powershell.exe wrote an executable file to disk
notice	A process created a hidden window
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Checks adapter addresses which can be used to detect virtual network interfaces
notice	Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice	Creates a shortcut to an executable file
notice	Creates a suspicious process
notice	Poweshell is sending data to a remote host
notice	URL downloaded by powershell script
info	Checks amount of memory in system
info	Checks if process is being debugged by a debugger
info	Command line console output was observed
info	Queries for the computername
info	Uses Windows APIs to generate a cryptographic key

Level	Name	Description	Collection
warning	Generic_Malware_Zero	Generic Malware	binaries (download)
watch	Antivirus	Contains references to security software	binaries (download)

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
cdn.discordapp.com whois			162.159.134.233		malware
162.159.134.233 whois			162.159.134.233		malware

Report - pumairld.txt.ps1