Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 21, 2021, 12:37 p.m.	June 21, 2021, 12:40 p.m.

Size	4.4KB
Type	Bourne-Again shell script, ASCII text executable, with very long lines
MD5	`04b3c04aa965443963cbe30966ff9d04`
SHA256	`31acdede467b222c789ab041dd7aaa91562c0e93a54c93cfdf2f526f111c7046`
CRC32	`E04FF129`
ssdeep	`48:vXkMV4k0X51V4QXrmrWV4hXgoV4bXEMEEV4EfXskV4/X51V4QX9ZV48XySV4xXCd:vpeTnTil20bEpfrMfbHZjyp0rJP1Vf`
Yara	None matched

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "tzLDj" C:\Users\test22\AppData\Local\Temp\jaws
3024
- rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\test22\AppData\Local\Temp\jaws
  1836
  - editplus.exe "editplus.exe"
    2664

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 21, 2021, 12:37 p.m.			0	0
IsDebuggerPresent June 21, 2021, 12:37 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 21, 2021, 12:37 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (14 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 21, 2021, 12:37 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73770000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2021, 12:37 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x729b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2021, 12:37 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2021, 12:37 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x728e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2021, 12:37 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x729b2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2021, 12:37 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2021, 12:37 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2021, 12:37 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2021, 12:37 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2021, 12:37 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2021, 12:37 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2021, 12:37 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2021, 12:37 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2021, 12:37 p.m.	process_identifier: 2664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x729b2000 process_handle: 0xffffffff	1

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Attempts to modify browser security settings (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\EDITPLUS.EXE

Harvests credentials from local email clients (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Microsoft Outlook\Capabilities\FileAssociations

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3024 resumed a thread in remote process 1836
NtResumeThread June 21, 2021, 12:37 p.m.	thread_handle: 0x0000028c suspend_count: 1 process_identifier: 1836	1	0	0

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

CAT-QuickHeal	Trojan.Shell.Downloader.39008
McAfee	Linux/Downloader.w
Sangfor	Malware.ELF-Script.Save.f4cf3acc
Cyren	SH/Mirai.A.gen!Camelot
ESET-NOD32	Linux/TrojanDownloader.SH.S
TrendMicro-HouseCall	ELF_MIRAILOD.SM
Avast	BV:Downloader-AAN [Drp]
Kaspersky	HEUR:Trojan-Downloader.Shell.Agent.p
NANO-Antivirus	Trojan.Script.Downloader.fjajjs
Tencent	Heur:Trojan.Linux.Downloader.e
DrWeb	Linux.DownLoader.664
TrendMicro	ELF_MIRAILOD.SM
McAfee-GW-Edition	Linux/Downloader.w
Avira	LINUX/Agent.SH.B
Microsoft	Trojan:Linux/Dakkatoni.F!MTB
ZoneAlarm	HEUR:Trojan-Downloader.Shell.Agent.p
Cynet	Malicious (score: 99)
AhnLab-V3	Shell/ElfDownloader.S1
Rising	Malware.Small/BASH !1.C8A3 (CLASSIC)
AVG	BV:Downloader-AAN [Drp]

jaws

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All