Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 9, 2021, 11:32 a.m.	April 9, 2021, 11:53 a.m.

Size	344.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`d840022368e5c69eb49c091f9e99b09c`
SHA256	`b8a5cf81ab9584f1ca6e937c2b6e2f399c4dcd81fc300b0746c4fbfd98b80ff7`
CRC32	`BE25055F`
ssdeep	`6144:CBkWYKSs0zTRc/lk+e8qBnm6D0Xcuyr/pBBTZ7DEDd0c1RnrUKlWqPT:gkWUs0zTRcybtBnlAs5VnQWc1RewT`
Yara	PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check

ScHost.exe "C:\Users\test22\AppData\Local\Temp\ScHost.exe"
7092
- ScHost.exe "C:\Users\test22\AppData\Local\Temp\ScHost.exe" 1
  4848

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW April 9, 2021, 11:25 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 9, 2021, 11:25 a.m.			0	0
IsDebuggerPresent April 9, 2021, 11:27 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 9, 2021, 11:25 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 147 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000810000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000900000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0831000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0aae000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0aae000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0aaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0aaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0aaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0aaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0aaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0aaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0aaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0aaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0ab0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0ab0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0ab0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0ab0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0ab0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0ab1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0ab1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0ab1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0ab1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0aae000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00022000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00012000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00023000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00112000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0002c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00160000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00024000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00161000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00025000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff001af000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff001a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0003f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00026000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00162000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0002a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00074000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00163000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 9, 2021, 11:25 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00054a00', u'virtual_address': u'0x00002000', u'entropy': 7.697803133337587, u'name': u'.text', u'virtual_size': u'0x0005488c'}

entropy

7.69780313334

description

A section with a high entropy has been found

entropy

0.985443959243

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 40 AntiVirus engines on VirusTotal as malicious (40 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.36660568
FireEye	Generic.mg.d840022368e5c69e
McAfee	GenericRXOC-NZ!D840022368E5
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Adware ( 005316791 )
Alibaba	AdWare:MSIL/CsdiMonetize.a11be8df
K7GW	Adware ( 005316791 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Adware.CsdiMonetize.AN
APEX	Malicious
Avast	FileRepMetagen [Adw]
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.36660568
Paloalto	generic.ml
Ad-Aware	Trojan.GenericKD.36660568
Sophos	Generic PUA MK (PUA)
DrWeb	Adware.WizzMonetize.1
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
SentinelOne	Static AI - Malicious PE
Webroot	W32.Malware.Gen
Avira	HEUR/AGEN.1123484
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft	Trojan.Win32.Agent.sd!ni
Microsoft	Backdoor:Win32/Bladabindi!ml
AegisLab	Trojan.Win32.Generic.4!c
GData	Win32.Application.Agent.UTDPDV
Cynet	Malicious (score: 99)
AhnLab-V3	PUP/Win32.RL_CsdiMonetize.C4302282
BitDefenderTheta	Gen:NN.ZemsilF.34670.vm0@a8YCZLk
MAX	malware (ai score=100)
Malwarebytes	Malware.AI.2357069248
TrendMicro-HouseCall	TROJ_GEN.R002H06D821
Rising	Adware.WizzNetwork!1.CDFD (CLOUD)
eGambit	Unsafe.AI_Score_99%
Fortinet	Riskware/Generic
AVG	FileRepMetagen [Adw]
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Win32/Trojan.Generic.HwMAcxsA

ScHost.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All