Sh1n0g1 / z9

PowerShell Script Analyzer

z9 PowerShell Log Analyzer

Japanese

Abstract

This tools detects the artifact of the PowerShell based malware from the eventlog of PowerShell logging.
Online Demo

Install

git clone https://github.com/Sh1n0g1/z9
cd z9
pip install -r requirements.txt

How to use

usage: z9.py [-h] [--output OUTPUT] [-s] [--no-viewer] [--utf8] input

positional arguments:
  input                 Input file path

options:
  -h, --help            show this help message and exit
  --output OUTPUT, -o OUTPUT
                        Output file path
  -s, --static          Enable Static Analysis mode
  --no-viewer           Disable opening the JSON viewer in a web browser
  --utf8                Read scriptfile in utf-8 (deprecated)

Analyze Event Logs (Recommended)

python z9.py <input file> -o <output json>
python z9.py <input file> -o <output json> --no-viewer

Arguments	Meaning
input file	XML file exported from eventlog
-o output json	filename of z9 result
--no-viewer	do not open the viewer

Example)

python z9.py util\log\mwpsop.xml -o sample1.json

Analyze PowerShell File Statically

• This approach will only do the static analysis and may not provide a proper result especially when the sample is obfuscated.

python z9.py <input file> -o <output json> -s
python z9.py <input file> -o <output json> -s --utf8
python z9.py <input file> -o <output json> -s --no-viewer

Arguments	Meaning
input file	PowerShell file to be analyzed
-o output json	filename of z9 result
-s	perform static analysis
--utf8	specify when the input file is in UTF-8
--no-viewer	do not open the viewer

Example)

python z9.py malware.ps1 -o sample1.json -s

How to prepare the XML file

Enable PowerShell Logging

1. Right-click and merge this registry file:util/enable_powershell_logging.reg .
2. Reboot the PC
3. All powershell execution will be logged in eventlog

Export Eventlog to XML

1. Execute this batch file:util/collect_psevent.bat .
2. The XML files will be created under util/log directory.
3. Both XML file can be parsed by this tool.

How to Delete the Existing Eventlog

• Execute this batch file:util/collect_psevent.bat with "Run as Admin"

Authors

hanataro-miz
si-tm
take32457
Bigdrea6
azaberrypi
Sh1n0g1