Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 19, 2021, 1:29 p.m.	May 19, 2021, 1:33 p.m.

Size	3.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`74059a7fb97d04bcdf3df8a1cc4fdcd8`
SHA256	`5db83c4d6969803c9d7d558f9b6e008edcf365b99b5461c767342c6771af13fe`
CRC32	`DFD7AF5D`
ssdeep	`98304:ozqXXC79pjuyKZMgKuBiJOLGqoTZu4FA8osQ:JXS7/u3ZMgKugampFH6`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

sisifo_setup.exe "C:\Users\test22\AppData\Local\Temp\sisifo_setup.exe"
6988

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 19, 2021, 1:29 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (7 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 19, 2021, 1:29 p.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73dd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:29 p.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:29 p.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:29 p.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:29 p.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:29 p.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:29 p.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756a1000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\nsqA1.tmp\InstallOptions.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\nsqA1.tmp\InstallOptions.dll

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

MicroWorld-eScan	Trojan.GenericKD.41750562
FireEye	Trojan.GenericKD.41750562
ALYac	Gen:Variant.Bulz.200000
Malwarebytes	Generic.Malware/Suspicious
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanSpy:Win32/Stealer.4b3b3097
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.fb97d0
BitDefenderTheta	Gen:NN.ZemsilCO.34780.ciW@aOSXh4o
Cyren	W32/Trojan.QJZN-6545
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender	Trojan.GenericKD.41750562
NANO-Antivirus	Trojan.Win32.Stealer.ibghvw
Emsisoft	Trojan.GenericKD.41750562 (B)
F-Secure	Trojan.TR/Spy.Stealer.cmlwm
TrendMicro	TROJ_GEN.R06BC0WIB20
McAfee-GW-Edition	RDN/Generic PWS.y
Sophos	Mal/Generic-S
Avira	TR/Spy.Stealer.cmlwm
MAX	malware (ai score=89)
Antiy-AVL	Trojan[Spy]/MSIL.Stealer
Gridinsoft	Ransom.Win32.Wacatac.oa
Microsoft	Trojan:Win32/Ymacco.AA5D
AegisLab	Trojan.Win32.Generic.4!c
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Stealer.gen
GData	Gen:Variant.Bulz.200000
Cynet	Malicious (score: 85)
McAfee	Artemis!74059A7FB97D
VBA32	TrojanSpy.MSIL.Stealer
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R06BC0WIB20
Tencent	Msil.Trojan-spy.Stealer.Aedx
Fortinet	W32/Stealer!tr
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen
Qihoo-360	Generic/Trojan.Spy.67f

sisifo_setup.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All