Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 19, 2021, 1:28 p.m.	May 19, 2021, 1:45 p.m.

Size	3.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`610eba16c4e6bdff4d3b2da79d31e8f5`
SHA256	`43a73b7c8a2440908c014456b6dcad162bdba082d73a065b2ce695726f6dccff`
CRC32	`15B73417`
ssdeep	`98304:KAzqXXC79pjuyKZMgKtZGOLGqoTZu4FA8osfb:KhXS7/u3ZMgKqampFHd`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

sisifo_setup.exe "C:\Users\test22\AppData\Local\Temp\sisifo_setup.exe"
6012

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 19, 2021, 1:28 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (7 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 19, 2021, 1:28 p.m.	process_identifier: 6012 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73dd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:28 p.m.	process_identifier: 6012 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:29 p.m.	process_identifier: 6012 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:29 p.m.	process_identifier: 6012 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:29 p.m.	process_identifier: 6012 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:29 p.m.	process_identifier: 6012 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:29 p.m.	process_identifier: 6012 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756a1000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\nsl9BA4.tmp\InstallOptions.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\nsl9BA4.tmp\InstallOptions.dll

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

MicroWorld-eScan	Trojan.GenericKD.41750562
FireEye	Trojan.GenericKD.41750562
ALYac	Gen:Variant.Bulz.200000
Cylance	Unsafe
Zillya	Trojan.Stealer.Win32.7337
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.41750562
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.6c4e6b
Cyren	W32/Trojan.LYQE-0325
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
Alibaba	Trojan:Win32/Generic.d5e52df9
NANO-Antivirus	Trojan.Win32.Stealer.ibghwt
Emsisoft	Trojan.GenericKD.41750562 (B)
Comodo	Malware@#3q3z13ep3yz46
TrendMicro	TROJ_GEN.R007C0PKF20
McAfee-GW-Edition	RDN/Generic PWS.y
Sophos	Mal/Generic-S
Antiy-AVL	Trojan[Spy]/MSIL.Stealer
Gridinsoft	Ransom.Win32.Wacatac.oa!s5
Arcabit	Trojan.MSILPerseus.D32547, Trojan.Bulz.D30D40
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Stealer.gen
GData	Gen:Variant.Bulz.200000
McAfee	Artemis!610EBA16C4E6
Malwarebytes	Malware.AI.4236029869
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R007C0PKF20
Fortinet	W32/Stealer!tr
BitDefenderTheta	Gen:NN.ZemsilCO.34590.ciW@aOSXh4o
AVG	Win32:Malware-gen
Paloalto	generic.ml

sisifo_setup.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All