Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 25, 2021, 9:31 a.m.	June 25, 2021, 9:48 a.m.

Size	375.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`04c71f94367c495e5e9d7ed91fdeb190`
SHA256	`45b9b5a84f5275c59e017c2d3d685da689d39478dac5464b5acab97ef42073e0`
CRC32	`9AF95E4D`
ssdeep	`6144:ORjbUHOvGUNIE/FDjBazqjWgR+MSEtvlZTONpRGX5B4PY3mA0O0Gp8NhA5Jod:ejbh9tDjiuT+xEtl0u4w3mAZyJd`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

mysql.exe "C:\Users\test22\AppData\Local\Temp\mysql.exe"
8072
- cmd.exe C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\test22\AppData\Local\Temp\mysql.exe > nul
  3804
  - PING.EXE ping -n 2 127.0.0.1
    5656

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
121.4.183.54	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 25, 2021, 9:30 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

PAGE

The executable uses a known packer (1 event)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (10 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 8072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740f1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 8072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77371000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 8072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744b1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 8072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744a1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 8072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x66a91000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 8072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 8072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x673a1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 8072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10001000 process_handle: 0xffffffff		3221225713
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 8072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 331776 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10151000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 25, 2021, 9:30 a.m.	process_identifier: 5656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73321000 process_handle: 0xffffffff	1	0

Creates a service (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceA June 25, 2021, 9:30 a.m.	service_start_name: start_type: 2 password: display_name: Aqiyqi Arjariar Jbsjbrjb Skcs filepath: C:\Windows\System32\mysql.exe -auto service_name: Mtldtl Dumdu filepath_r: C:\Windows\system32\mysql.exe -auto desired_access: 18 service_handle: 0x008f4dd0 error_control: 0 service_type: 16 service_manager_handle: 0x008f4e70	1	9391568	0

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\test22\AppData\Local\Temp\mysql.exe > nul

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\mysql.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0005d400', u'virtual_address': u'0x00002000', u'entropy': 7.875308271467312, u'name': u'.data', u'virtual_size': u'0x0005d394'}

entropy

7.87530827147

description

A section with a high entropy has been found

entropy

0.997326203209

description

Overall entropy of this PE file is high

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	ping -n 2 127.0.0.1
cmdline	C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\test22\AppData\Local\Temp\mysql.exe > nul

Communicates with host for which no DNS query was performed (2 events)

host	121.4.183.54
host	172.217.25.14

Installs itself for autorun at Windows startup (1 event)

service_name

Mtldtl Dumdu

service_path

C:\Windows\System32\mysql.exe -auto

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\mysql.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 8072 resumed a thread in remote process 3804
NtResumeThread June 25, 2021, 9:30 a.m.	thread_handle: 0x00000174 suspend_count: 1 process_identifier: 3804	1	0	0

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader30.28282
MicroWorld-eScan	Gen:Variant.Zusy.313935
FireEye	Generic.mg.04c71f94367c495e
CAT-QuickHeal	Backdoor.FarfliPMF.S19352949
ALYac	Gen:Variant.Zusy.313935
Cylance	Unsafe
Zillya	Trojan.GenKryptik.Win32.36169
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0055a5d81 )
K7GW	Trojan ( 0055a5d81 )
Cybereason	malicious.4367c4
BitDefenderTheta	Gen:NN.ZexaF.34738.xmW@a0gar3n
Cyren	W32/Agent.BOB.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.EZKJ
APEX	Malicious
ClamAV	Win.Trojan.Farfli-9645812-0
Kaspersky	HEUR:Backdoor.Win32.Farfli.vho
BitDefender	Gen:Variant.Zusy.313935
NANO-Antivirus	Trojan.Win32.Farfli.gethzp
Avast	Win32:BackdoorX-gen [Trj]
Ad-Aware	Gen:Variant.Zusy.313935
TACHYON	Backdoor/W32.Farfli.384000
Sophos	ML/PE-A + Troj/AutoG-KM
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Emsisoft	Gen:Variant.Zusy.313935 (B)
Ikarus	Trojan.Win32.Krypt
Avira	BDS/Farfli.xrlrm
Microsoft	Trojan:Win32/GhostRAT
GData	Gen:Variant.Zusy.313935
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.RL_Farfli.R299612
Acronis	suspicious
McAfee	Trojan-FRMW!04C71F94367C
MAX	malware (ai score=86)
VBA32	Trojan.Injuke
Malwarebytes	Backdoor.Ghost
Zoner	Trojan.Win32.105885
Rising	Trojan.Win32.FakeFolder.ae (CLASSIC)
Yandex	Trojan.GenAsa!6tUyyqkpagE
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.74662882.susgen
Fortinet	W32/Generic.AP.1EEA56A!tr
AVG	Win32:BackdoorX-gen [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_80% (D)

mysql.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All