Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 24, 2021, 10:50 p.m.	June 24, 2021, 11:01 p.m.

Size	7.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`ca183683227d610072473bc5d7cae338`
SHA256	`c1f0a466558441864502b7d7766cbf70c7c562b4ef8a13e562fd5c97f178dd8f`
CRC32	`E566D699`
ssdeep	`196608:52y1Ghlb1hukku/Ue7OaTmZLQdo7y/5TjzicAlWMd:52QGhlbCkku//FTmoUkpdMd`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

Konica_bizhub_362_282_222_Pcl.exe "C:\Users\test22\AppData\Local\Temp\Konica_bizhub_362_282_222_Pcl.exe"
3972
- Konica_bizhub_362_282_222_Pcl.exe "C:\Users\test22\AppData\Local\Temp\3582-490\Konica_bizhub_362_282_222_Pcl.exe"
  7140

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch
3.142.167.54	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Tries to locate where the browsers are installed (1 event)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 24, 2021, 10:50 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

Allocates read-write-execute memory (usually to unpack itself) (21 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73871000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73dd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x768d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x750f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72201000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72711000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72bb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x765b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72961000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72821000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71fc1000 process_handle: 0xffffffff	1

Steals private information from local Internet browsers (1 event)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe

Creates executable files on the filesystem (50 out of 137 events)

file	C:\Program Files (x86)\Mozilla Thunderbird\pingsender.exe
file	C:\Program Files (x86)\Google\Update\1.3.36.32\GoogleUpdateBroker.exe
file	C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.36.32\GoogleUpdateSetup.exe
file	C:\Program Files (x86)\Hnc\HncUtils\HncUpdate.exe
file	C:\Program Files (x86)\Mozilla Thunderbird\plugin-container.exe
file	C:\Program Files (x86)\Microsoft Office\Office12\REGFORM.EXE
file	C:\Program Files (x86)\Microsoft Office\Office12\DSSM.EXE
file	C:\Python27\Lib\site-packages\setuptools\cli-32.exe
file	C:\Program Files (x86)\Microsoft Office\Office12\ACCICONS.EXE
file	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\ODSERV.EXE
file	C:\Python27\Scripts\easy_install.exe
file	C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
file	C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\ose.exe
file	C:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe
file	C:\Program Files (x86)\7-Zip\7z.exe
file	C:\Program Files (x86)\Hnc\Common80\HimTrayIcon.exe
file	C:\Program Files (x86)\Hnc\Hwp80\HwpFinder.exe
file	C:\Program Files (x86)\Microsoft Office\Office12\SELFCERT.EXE
file	C:\Program Files (x86)\Microsoft Office\Office12\PPTVIEW.EXE
file	C:\Program Files (x86)\Microsoft Office\Office12\MSPUB.EXE
file	C:\Program Files (x86)\EditPlus\editplus.exe
file	C:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe
file	C:\Program Files (x86)\Hnc\Hwp80\HwpPrnMng.exe
file	C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
file	C:\Program Files (x86)\Google\Chrome\Application\chrome_proxy.exe
file	C:\Program Files (x86)\Mozilla Thunderbird\maintenanceservice.exe
file	C:\Program Files (x86)\Mozilla Thunderbird\minidump-analyzer.exe
file	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
file	C:\Program Files (x86)\Mozilla Thunderbird\crashreporter.exe
file	C:\MSOCache\All Users\{90120000-006E-0412-0000-0000000FF1CE}-C\DW20.EXE
file	C:\Program Files (x86)\Microsoft Office\Office12\INFOPATH.EXE
file	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
file	C:\Program Files (x86)\Hnc\Common80\HncReporter.exe
file	C:\Program Files (x86)\7-Zip\7zFM.exe
file	C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE
file	C:\Program Files (x86)\Microsoft Office\Office12\1042\ONELEV.EXE
file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files (x86)\Google\Chrome\Application\86.0.4240.111\notification_helper.exe
file	C:\Program Files (x86)\Hnc\Hwp80\HncPUAConverter.exe
file	C:\Program Files (x86)\Microsoft Office\Office12\MSTORE.EXE
file	C:\Program Files (x86)\Hnc\HncDic80\HncDic.exe
file	C:\Program Files (x86)\Microsoft Office\Office12\MSTORDB.EXE
file	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\ACECNFLT.EXE
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe
file	C:\Program Files (x86)\Hnc\Hwp80\Hwp.exe
file	C:\Program Files (x86)\Microsoft Office\Office12\MSQRY32.EXE
file	C:\Program Files (x86)\Google\Update\1.3.36.32\GoogleCrashHandler64.exe
file	C:\util\dotnet4.5.exe
file	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
file	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\3582-490\Konica_bizhub_362_282_222_Pcl.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\3582-490\Konica_bizhub_362_282_222_Pcl.exe
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 24, 2021, 10:50 p.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef90000 process_handle: 0xffffffff	1	0	0

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	3.142.167.54

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default)

reg_value

C:\Windows\svchost.com "%1" %*

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 events)

Bkav	W32.NeshtaB.PE
Elastic	malicious (high confidence)
MicroWorld-eScan	Win32.Neshta.A
FireEye	Generic.mg.ca183683227d6100
CAT-QuickHeal	W32.Neshta.C8
ALYac	Win32.Neshta.A
Cylance	Unsafe
Zillya	Virus.Neshta.Win32.1
Sangfor	Win.Trojan.Neshuta-1
K7AntiVirus	Virus ( 00556e571 )
K7GW	Virus ( 00556e571 )
Cybereason	malicious.3227d6
Baidu	Win32.Virus.Neshta.a
Cyren	W32/Neshta.OBIX-2981
Symantec	W32.Neshuta
ESET-NOD32	Win32/Neshta.A
APEX	Malicious
Avast	Win32:Apanas [Trj]
ClamAV	Win.Trojan.Neshuta-1
Kaspersky	Virus.Win32.Neshta.a
BitDefender	Win32.Neshta.A
NANO-Antivirus	Trojan.Win32.Winlock.fmobyw
ViRobot	Win32.Neshta.Gen.A
Tencent	Virus.Win32.Neshta.a
Ad-Aware	Win32.Neshta.A
Sophos	ML/PE-A + W32/Neshta-D
Comodo	Win32.Neshta.A@3ypg
DrWeb	Win32.HLLP.Neshta
VIPRE	Virus.Win32.Neshta.a (v)
TrendMicro	PE_NESHTA.A
McAfee-GW-Edition	BehavesLike.Win32.Wabot.wc
Emsisoft	Win32.Neshta.A (B)
SentinelOne	Static AI - Malicious PE
GData	Win32.Virus.Neshta.D
Jiangmin	Virus.Neshta.a
Avira	W32/Neshta.A
MAX	malware (ai score=89)
Gridinsoft	Virus.Neshta.A.sd!yf
Microsoft	Virus:Win32/Neshta.A
Cynet	Malicious (score: 100)
AhnLab-V3	Win32/Neshta
Acronis	suspicious
McAfee	W32/HLLP.41472.e
TACHYON	Virus/W32.Neshta
VBA32	Virus.Win32.Neshta.a
Malwarebytes	Neshta.Virus.FileInfector.DDS
Zoner	Virus.Win32.19514
TrendMicro-HouseCall	PE_NESHTA.A
Rising	Win32.Neshta.a (CLASSIC)
Yandex	Trojan.GenAsa!Mo0tdcmmg3o

Konica_bizhub_362_282_222_Pcl.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All