Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 24, 2021, 6:11 p.m.	April 24, 2021, 6:13 p.m.

Size	471.9KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`474212e701552f22566f71a1585e8e94`
SHA256	`53bd776c525c7f8998d2504fdd2454819267d9f4eb5c1ca53b9388ce5dfcdcff`
CRC32	`C9DC81AD`
ssdeep	`3072:LHAA0+w1XX/2kOrhidWCnW/G4Jx5SW2+xQ9OoqAC9aClqR2d3djh8lxxURtCsr4:7IJ1ekOakB1K9OXAC9Xh8lxxUlr4`
Yara	PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsDLL - (no description) IsWindowsGUI - (no description) HasOverlay - Overlay Check keylogger - Run a keylogger

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ind.html.dll,DllRegisterServer
1116
- explorer.exe C:\Windows\SysWOW64\explorer.exe
  1396
  - schtasks.exe "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jubhwgwpo /tr "regsvr32.exe -s \"C:\Users\test22\AppData\Local\Temp\ind.html.dll\"" /SC ONCE /Z /ST 01:33 /ET 01:45
    2760
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ind.html.dll,
1556

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
149.202.83.171	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (5 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 24, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 24, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 24, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 24, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 24, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 24, 2021, 6:11 p.m.			0	0
IsDebuggerPresent April 24, 2021, 6:11 p.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW April 24, 2021, 6:11 p.m.	buffer: SUCCESS: The scheduled task "jubhwgwpo" has successfully been created. console_handle: 0x00000007	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 24, 2021, 6:11 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	.code
section	.qddw
section

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (17 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10070000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10070000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d21000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1116 region_size: 462848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01d30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 462848 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10000000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cb0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73744000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ab1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1396 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73da2000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\ind.html.dll

Creates a suspicious process (1 event)

cmdline

"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jubhwgwpo /tr "regsvr32.exe -s \"C:\Users\test22\AppData\Local\Temp\ind.html.dll\"" /SC ONCE /Z /ST 01:33 /ET 01:45

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\ind.html.dll

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW April 24, 2021, 6:11 p.m.	thread_identifier: 1812 thread_handle: 0x00000178 process_identifier: 2760 current_directory: filepath: track: 1 command_line: "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jubhwgwpo /tr "regsvr32.exe -s \"C:\Users\test22\AppData\Local\Temp\ind.html.dll\"" /SC ONCE /Z /ST 01:33 /ET 01:45 filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x0000019c	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 events)

Time & API	Arguments	Status	Return
Process32NextW April 24, 2021, 6:11 p.m.	snapshot_handle: 0x00000188 process_name: pw.exe process_identifier: 2000	1	1
Process32NextW April 24, 2021, 6:11 p.m.	snapshot_handle: 0x00000188 process_name: taskhost.exe process_identifier: 852	1	1
Process32NextW April 24, 2021, 6:11 p.m.	snapshot_handle: 0x00000188 process_name: rundll32.exe process_identifier: 1116	1	1

Yara rule detected in process memory (17 events)

description	Listen for incoming communication	rule	network_tcp_listen
description	Take screenshot	rule	screenshot
description	Run a keylogger	rule	keylogger
description	Create or check mutex	rule	win_mutex
description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_files_operation
description	Match Winsock 2 API library declaration	rule	Str_Win32_Winsock2_Library
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jubhwgwpo /tr "regsvr32.exe -s \"C:\Users\test22\AppData\Local\Temp\ind.html.dll\"" /SC ONCE /Z /ST 01:33 /ET 01:45

Communicates with host for which no DNS query was performed (1 event)

host

149.202.83.171

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1396 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d0000 process_handle: 0x00000190	1	0	0

Installs itself for autorun at Windows startup (1 event)

cmdline

"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jubhwgwpo /tr "regsvr32.exe -s \"C:\Users\test22\AppData\Local\Temp\ind.html.dll\"" /SC ONCE /Z /ST 01:33 /ET 01:45

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1116 resumed a thread in remote process 1396
NtResumeThread April 24, 2021, 6:11 p.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 1396	1	0	0

Uses Sysinternals tools in order to add additional command line functionality (1 event)

cmdline

"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jubhwgwpo /tr "regsvr32.exe -s \"C:\Users\test22\AppData\Local\Temp\ind.html.dll\"" /SC ONCE /Z /ST 01:33 /ET 01:45

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Malwarebytes	Generic.Trojan.Malicious.DDS
AegisLab	Trojan.Win32.Scar.4!c
Sangfor	Trojan.Win32.Save.a
Alibaba	Trojan:Win32/Kryptik.dd740880
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZedlaF.34678.Dy6@aaVVuNf
ESET-NOD32	a variant of Win32/Kryptik.HKHG
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:Trojan.Win32.Scar
BitDefender	Gen:Variant.Razy.863431
MicroWorld-eScan	Gen:Variant.Razy.863431
Ad-Aware	Gen:Variant.Razy.863431
Sophos	Mal/Generic-R + Mal/EncPk-APW
FireEye	Generic.mg.474212e701552f22
Emsisoft	Gen:Variant.Razy.863431 (B)
SentinelOne	Static AI - Malicious PE
Webroot	W32.Malware.Gen
MAX	malware (ai score=83)
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Gen:Variant.Razy.863431
McAfee	Artemis!474212E70155
TrendMicro-HouseCall	TROJ_GEN.R002H0DDN21
Ikarus	Trojan.Win32.Inject
eGambit	Unsafe.AI_Score_80%
AVG	Win32:BankerX-gen [Trj]
Avast	Win32:BankerX-gen [Trj]

Executed a process and injected code into it, probably while unpacking (8 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW April 24, 2021, 6:11 p.m.	thread_identifier: 596 thread_handle: 0x00000188 process_identifier: 1396 current_directory: filepath: track: 1 command_line: C:\Windows\SysWOW64\explorer.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000190	1	1
NtMapViewOfSection April 24, 2021, 6:11 p.m.	section_handle: 0x00000194 process_identifier: 1396 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: base_address: 0x00100000 allocation_type: 0 () section_offset: 0 view_size: 233472 process_handle: 0x00000190	1	0
NtAllocateVirtualMemory April 24, 2021, 6:11 p.m.	process_identifier: 1396 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x000b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000190	1	0
WriteProcessMemory April 24, 2021, 6:11 p.m.	buffer: base_address: 0x000b0000 process_identifier: 1396 process_handle: 0x00000190	1	1
NtGetContextThread April 24, 2021, 6:11 p.m.	thread_handle: 0x00000188	1	0
NtResumeThread April 24, 2021, 6:11 p.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 1396	1	0
NtResumeThread April 24, 2021, 6:11 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 1396	1	0
CreateProcessInternalW April 24, 2021, 6:11 p.m.	thread_identifier: 1812 thread_handle: 0x00000178 process_identifier: 2760 current_directory: filepath: track: 1 command_line: "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jubhwgwpo /tr "regsvr32.exe -s \"C:\Users\test22\AppData\Local\Temp\ind.html.dll\"" /SC ONCE /Z /ST 01:33 /ET 01:45 filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x0000019c	1	1

ind.html

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All