Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 4, 2021, 10:03 a.m.	May 4, 2021, 10:05 a.m.

Size	206.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`7564bb42086def493a6e8f27bf923647`
SHA256	`a3c26859ace3885b7226ca185e922a78725603d81a0a9e6bc1ec69a2d83435cb`
CRC32	`BC004156`
ssdeep	`1536:c2DSHGSEqH9DYaeSS3d5he/09YAn/MmVrYemI3AErUrlE0jUc2kNSDeBD/HaOGWo:c2KGcRmV5b9YEVknI31SEUUeN2eZxZJu`
Yara	Win_PUP_MyWebSearch - It changes the browser start page, installs a toolbar ... PE_Header_Zero - PE File Signature IsPE32 - (no description)

yourlocallotto.exe "C:\Users\test22\AppData\Local\Temp\yourlocallotto.exe"
112
- rundll32.exe rundll32 C:\PROGRA~2\YOURLO~1\Installr\1.bin\20EZSETP.dll,Update
  2208

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 4, 2021, 10:03 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 4, 2021, 10:03 a.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PART

Allocates read-write-execute memory (usually to unpack itself) (8 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 4, 2021, 10:03 a.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10014000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 10:03 a.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x765b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 10:03 a.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73770000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 10:03 a.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 10:03 a.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72be1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 10:03 a.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ba4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 10:03 a.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c72000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 10:03 a.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e1000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (3 events)

file	C:\Program Files (x86)\yourlocallotto1_20EI\Installr\1.bin\20EZSETP.dll
file	C:\Program Files (x86)\yourlocallotto1_20EI\Installr\1.bin\NP20EISb.dll
file	C:\Program Files (x86)\yourlocallotto1_20EI\Installr\1.bin\20EIPlug.dll

File has been identified by 33 AntiVirus engines on VirusTotal as malicious (33 events)

Bkav	W32.HfsAdware.1166
CAT-QuickHeal	PUA.Mindsparki1.Gen
Malwarebytes	PUP.Optional.MindSpark
Zillya	Adware.MyWebSearch.Win32.2684
Baidu	Win32.Trojan.WisdomEyes.151026.9950.9996
F-Prot	W32/MyWeb.G
ESET-NOD32	Win32/AdInstaller potentially unwanted
TrendMicro-HouseCall	TROJ_SPNR.0EI513
Avast	Win32:FunWeb-J [PUP]
ClamAV	Win.Adware.Mywebsearch-219
Kaspersky	not-a-virus:WebToolbar.Win32.MyWebSearch.rh
NANO-Antivirus	Riskware.Win32.WebSearch.dbxdjn
ViRobot	Adware.MyWebSearch.211008.C[h]
SUPERAntiSpyware	PUP.AdInstaller
Rising	Trjoan.Generic-xQZSKt3K8GV (Cloud)
Sophos	Generic PUA MH (PUA)
DrWeb	Trojan.MulDrop6.40078
VIPRE	MyWebSearch.J (v) (not malicious)
TrendMicro	TROJ_SPNR.0EI513
Cyren	W32/MyWeb.YEIO-7739
Antiy-AVL	RiskWare[WebToolbar]/Win32.MyWebSearch.rh
Arcabit	PUP.WebToolbar.MyWebSearch
AegisLab	Webtoolbar.W32.Gen!c
AhnLab-V3	PUP/Win32.FunWeb
GData	Win32.Adware.Mindspark.E
TotalDefense	Win32/Tnega.GaNNPfC
AVware	MyWebSearch.J (v)
Tencent	Win32.Trojan.Falsesign.Aguu
Yandex	PUA.Toolbar.MyWebSearch!
Fortinet	Riskware/MyWebSearch
AVG	AdInstaller.FunWeb
Baidu-International	Adware.Win32.MyWebSearch.bQ
Qihoo-360	Trojan.Generic

yourlocallotto.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All