Releases (4).zipZIP analysis report - Suspicious

2 process(es) observed

PowerShell script blocks the sample executed, as PowerShell itself logged them (event 4104) - so an encoded or Invoke-Expression-decoded payload is captured in its final, deobfuscated form, the way it actually ran.

function Get-SystemDriveInfo() {
    [string]$wql = "SELECT * FROM Win32_LogicalDisk WHERE MediaType=12 AND Name = '" + ${env:systemdrive} + "'"
    return Get-WmiObject -query $wql
}

function Format-DiskSpaceMB([double]$space = $(throw "No space is specified")) {
    return [string]([Math]::Round(($space / 1KB), 3))
}

function Get-FolderSize([string]$folder = $(throw "No folder is specified")) {
    if([String]::IsNullOrEmpty($folder) -or (-not(Test-Path $folder))) {
        return 0
    }

    if(-not $Global:DirectoryObject) {
        $Global:DirectoryObject = New-Object -comobject "Scripting.FileSystemObject"
    }

    return ($Global:DirectoryObject.GetFolder($folder).Size) / 1kb
}

function Get-MachineReportPath {
    return "${env:AllUsersProfile}\Microsoft\Windows\WER\ReportQueue"
}

function Get-UserReportPath {
    return "${env:localappdata}\Microsoft\Windows\WER\ReportQueue"
}

function Get-RegistryValue([string]$registryEntryPath = $(throw "No registry entry path is specified"), [string]$registryEntryName = $(throw "No registry entry name is specified"), [double]$defaultValue = 0.0) {
    [double]$registryEntryValue = $defaultValue

    $registryEntry = Get-ItemProperty -Path $registryEntryPath -Name $registryEntryName
    if($registryEntry -ne $null) {
        $registryEntryValue = $registryEntry.$registryEntryName
    }

	return $registryEntryValue
}

function Get-Percentage() {
    [string]$registryEntryPath = "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting"
    [string]$registryEntryName = "MaxQueueSizePercentage"
    [double]$defaultValue = 100.0

    return Get-RegistryValue $registryEntryPath $registryEntryName $defaultValue
}

function Get-FreeSpace {
    [double]$freeSpace = 0.0
    [string]$wql = "SELECT * FROM Win32_LogicalDisk WHERE MediaType=12"
    $drives = Get-WmiObject -query $wql
    if($null -ne $drives) {
        foreach($drive in $drives) {
            $freeSpace += ($drive.freeSpace)
        }
    }

    return ($freeSpace / 1KB)
}

# Localized	12/07/2019 05:47 AM (GMT)	303:6.40.20520 	CL_LocalizationData.psd1
ConvertFrom-StringData @'
###PSLOC
filesFailToRemove_description=Exceptions caught while removing files.
checkBrokenDesktopShortcuts_progress=Checking for broken shortcuts...
checkBrokenStartupShortcuts_progress=Checking for broken startup links...
brokenDesktopShortcuts_name=Broken desktop shortcuts
brokenDesktopShortcuts_description=List of desktop shortcuts for which the target executable no longer exists.
brokenStartupShortcuts_name=Broken startup shortcuts
brokenStartupShortcuts_description=List of startup shortcuts for which the target executable no longer exists.
deleteBrokenDesktopShortcuts_progress=Deleting broken shortcuts...
deleteBrokenStartupShortcuts_progress=Deleting broken startup links...
checkSystemTime_progress=Checking clock time...
syncSystemTime_progress=Synchronizing clock time...
timeDelayAgainstTimeServer_name=Clock synchronization
checkUnusedDesktopIcons_progress=Checking for unused desktop icons...
unusedDesktopShortcuts_name=Unused desktop shortcuts
unusedDesktopShortcuts_description=List of shortcuts that have not been recently accessed for
unusedTimeUnit=months.
deleteUnusedDesktopShortcuts_progress=Deleting unused shortcuts...
timeServerName=Time server name
samplesCollected=Samples collected
serverTime=Server time
localTime=Local time
timeDifference=Time difference
shortcutName=Shortcut name
CheckWERQueue=Checking for unnecessary files...
DeleteUserWERQueue=Deleting Windows error reports...
DeleteSystemWERQueue=Deleting Windows error reports...
CheckTSHistory=Checking for unnecessary files...
DeleteUserTSHistory=Deleting troubleshooting history...
DeleteAdminTSHistory=Deleting troubleshooting history...
freeSpace=Free space
totalSpace=Total space
driveName=Drive name
systemDriveInfo_name=Disk information
systemDriveInfo_description=Details of the system drive.
UserReportInfo_name=User Report details
UserReportInfo_descr

& 'C:\Windows\TEMP\SDIAG_11365b23-e55b-4d2a-91f9-f44f3f59e018\TS_WERQueue.ps1'

# Caller validation to ensure we are calling from and actual script, and not from a malicious command line
function Test-Caller {
    param(
        [Parameter(Mandatory=$true)]
        [System.Management.Automation.CallStackFrame[]]
        $CallStack
    )
    $caller = $CallStack[1]
    $location = $caller.Location
    Write-Verbose -Message $('caller: ' + $location) -Verbose
    if ($location -eq '<No file>') {
        throw 'Invoke-Expression cannot be used in a script'
    }
}

# Generated with
# $var = New-Object System.Management.Automation.CommandMetadata (Get-Command Invoke-Expression)
# [System.Management.Automation.ProxyCommand]::Create($var) | Out-File .\Invoke-Expression.ps1
function Invoke-Expression {
    [CmdletBinding(HelpUri='https://go.microsoft.com/fwlink/?LinkID=2097030')]
param(
    [Parameter(Mandatory=$true, Position=0, ValueFromPipeline=$true)]
    [string]
    ${Command})

begin
{
    try {
        Test-Caller -CallStack (Get-PSCallStack)
        $outBuffer = $null
        if ($PSBoundParameters.TryGetValue('OutBuffer', [ref]$outBuffer))
        {
            $PSBoundParameters['OutBuffer'] = 1
        }

        $wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Microsoft.PowerShell.Utility\Invoke-Expression', [System.Management.Automation.CommandTypes]::Cmdlet)
        $scriptCmd = {& $wrappedCmd @PSBoundParameters }

        $steppablePipeline = $scriptCmd.GetSteppablePipeline($myInvocation.CommandOrigin)
        $steppablePipeline.Begin($PSCmdlet)
    } catch {
        throw
    }
}

process
{
    try {
        $steppablePipeline.Process($_)
    } catch {
        throw
    }
}

end
{
    try {
        $steppablePipeline.End()
    } catch {
        throw
    }
}
<#

.ForwardHelpTargetName Microsoft.PowerShell.Utility\Invoke-Expression
.ForwardHelpCategory Cmdlet

#>
}

# Generated with
# $var = New-Object System.Management.Automation.CommandMetadata (Get-Com

13 captured texts were unwrapped locally; 1 yielded something. An address below is text found in a command line: recovering one is not evidence that the sample reached it, and a well-formed hostname here may be a file path or a type name.

# Caller validation to ensure we are calling from and actual script, and not from a malicious command line
function Test-Caller {
    param(
        [Parameter(Mandatory=$true)]
        [System.Management.Automation.CallStackFrame[]]
        $CallStack
    )
    $caller = $CallStack[1]
    $location = $caller.Location
    Write-Verbose -Message $('caller: ' + $location) -Verbose
    if ($location -eq '<No file>') {
        throw 'Invoke-Expression cannot be used in a script'
    }
}

# Generated with
# $var = New-Object System.Management.Automation.CommandMetadata (Get-Command Invoke-Expression)
# [System.Management.Automation.ProxyCommand]::Create($var) | Out-File .\Invoke-Expression.ps1
function Invoke-Expression {
    [CmdletBinding(HelpUri='https://go.microsoft.com/fwlink/?LinkID=2097030')]
param(
    [Parameter(Mandatory=$true, Position=0, ValueFromPipeline=$true)]
    [string]
    ${Command})

begin
{
    try {
        Test-Caller -CallStack (Get-PSCallStack)
        $outBuffer = $null
        if ($PSBoundParameters.TryGetValue('OutBuffer', [ref]$outBuffer))
        {
            $PSBoundParameters['OutBuffer'] = 1
        }

        $wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Microsoft.PowerShell.Utility\Invoke-Expression', [System.Management.Automation.CommandTypes]::Cmdlet)
        $scriptCmd = {& $wrappedCmd @PSBoundParameters }

        $steppablePipeline = $scriptCmd.GetSteppablePipeline($myInvocation.CommandOrigin)
        $steppablePipeline.Begin($PSCmdlet)
    } catch {
        throw
    }
}

process
{
    try {
        $steppablePipeline.Process($_)
    } catch {
        throw
    }
}

end
{
    try {
        $steppablePipeline.End()
    } catch {
        throw
    }
}
<#

.ForwardHelpTargetName Microsoft.PowerShell.Utility\Invoke-Expression
.ForwardHelpCategory Cmdlet

#>
}

# Generated with
# $var = New-Object System.Management.Automation.CommandMetadata (Get-Com

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

No operations match your filter.

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

Hash lookups only - the sample itself is never uploaded to any third party.

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

rule auto_file_2934_yara
{
    meta:
        description = "Auto-generated from scan 2934"
        author = "sandbox auto-generator"
        anchors = "5 independent regions"
    strings:
        $s0 = "!ksn?= }\\\\" ascii fullword
        $s1 = "lFoz.dPn" ascii fullword
        $s2 = "FR.EsXV(8" ascii fullword
        $s3 = "ihnaM%:4|" ascii fullword
        $s4 = ".UB`8NS+" ascii fullword
    condition:
        filesize < 14288596 and all of them
}

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).