Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 25, 2021, 9:53 a.m.	June 25, 2021, 10:44 a.m.

Size	70.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`6b8f35c0e97b6387f6de945afdb59a42`
SHA256	`4560cd213d514c8edbea06e666c7d0b000ed0ded3df0b2692481714573fe07b5`
CRC32	`5ED7E2DE`
ssdeep	`1536:cW/Xd0Hspd2ebsVHHj4RTh7FCVDrCvcrvE:3Fpd9sVnj4qCvcr`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

j79.exe "C:\Users\test22\AppData\Local\Temp\j79.exe"
7388
- svchost.exe C:\Windows\System32\svchost.exe
  3204
- cmd.exe /c del C:\Users\test22\AppData\Local\Temp\j79.exe >> NUL
  4456

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch
188.64.170.208	Active	Moloch
188.64.170.79	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosdate

The executable uses a known packer (1 event)

packer

Armadillo v1.71

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 25, 2021, 9:52 a.m.	process_identifier: 7388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:52 a.m.	process_identifier: 7388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00408000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:52 a.m.	process_identifier: 7388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00420000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:52 a.m.	process_identifier: 7388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13103000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\aaaaaaaa.exe
file	C:\Windows\System32\aaaaaaaa.exe

Creates a suspicious process (1 event)

cmdline

C:\Windows\System32\svchost.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\j79.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 25, 2021, 9:52 a.m.	thread_identifier: 4356 thread_handle: 0x000000d8 process_identifier: 4456 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: /c del C:\Users\test22\AppData\Local\Temp\j79.exe >> NUL filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000000d4	1	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 25, 2021, 9:52 a.m.	process_identifier: 7388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8192 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x13101000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0000b400', u'virtual_address': u'0x00001000', u'entropy': 6.944252233518853, u'name': u'.text', u'virtual_size': u'0x0000b36a'}

entropy

6.94425223352

description

A section with a high entropy has been found

entropy

0.652173913043

description

Overall entropy of this PE file is high

Yara rule detected in process memory (9 events)

description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

/c del C:\Users\test22\AppData\Local\Temp\j79.exe >> NUL

Communicates with host for which no DNS query was performed (3 events)

host	172.217.25.14
host	188.64.170.208
host	188.64.170.79

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 25, 2021, 9:52 a.m.	process_identifier: 3204 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09500000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000d8	1	0	0

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aaaaaaaa				reg_value	C:\Windows\System32\aaaaaaaa.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\aaaaaaaa				reg_value	C:\Users\test22\aaaaaaaa.exe

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory June 25, 2021, 9:52 a.m.	buffer: MZÿÿ¸@Ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $UùîE4½E4½E4½;½F4½;Ê½B4½E4½p4½LL½F4½LL½D4½LL½D4½RichE4½PELÖþâRà D0N`P @ PPpÐÐ.textöCD `.data\|`H@À.reloc®pL@B base_address: 0x09500000 process_identifier: 3204 process_handle: 0x000000d8	1	1
WriteProcessMemory June 25, 2021, 9:52 a.m.	buffer: 0123456789ABCDEF"3Djjj79#188.64.170.79:443#188.64.170.208:443#Næ@»±¿D base_address: 0x09506000 process_identifier: 3204 process_handle: 0x000000d8	1	1
WriteProcessMemory June 25, 2021, 9:52 a.m.	buffer: °¸2¼24444*414W4f4m44À4Î4Û4ú4$515E5R5c55´5Á5[6`6f6k6p6v6{6¿6ê67z77Ü7&8d88¼89'999C9]999Ë9Ö9é9ó9:;:F:Y:c:x:«:¶:É:Ó:è:;&;9;C;W;b;u;;;L<¶= >¤>¨>¬>°>´>¸>¼>À> $511ý1é2ú2/3>33þ4¹:;:<^<0x0$0B0L0l021<1`1u11Z34³4à4ì455 5,575W5_5k5¶6Ê6:+:G:W:å:õ:;$;@;P;j;y;À;Ì;ç;ï;û;Ð=Ü=ø=>#>2>D>T>w>>>¬>Ç>Á?@ÄH1P1`1j1e222º2È2ï2&3G3W3o3333¿3Ï3ð344µ4È4Ð45Å5Ì5Ý5ã5ï56 66(6=6K6h6r66¸677é728j8s8¬8-9G9q99ç9ò9ù9:4:H:.<?<P<>9>Y>g>q>>¢>¨>®>´>º>À>Ç>Î>Õ>Ü>ã>ê>ñ>?????'?-?8?@?K?P?V?g?n? base_address: 0x09507000 process_identifier: 3204 process_handle: 0x000000d8	1	1
WriteProcessMemory June 25, 2021, 9:52 a.m.	buffer: P base_address: 0x7efde008 process_identifier: 3204 process_handle: 0x000000d8	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory June 25, 2021, 9:52 a.m.	buffer: MZÿÿ¸@Ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $UùîE4½E4½E4½;½F4½;Ê½B4½E4½p4½LL½F4½LL½D4½LL½D4½RichE4½PELÖþâRà D0N`P @ PPpÐÐ.textöCD `.data\|`H@À.reloc®pL@B base_address: 0x09500000 process_identifier: 3204 process_handle: 0x000000d8	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 7388 called NtSetContextThread to modify thread in remote process 3204
NtSetContextThread June 25, 2021, 9:52 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 156257840 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000d4 process_identifier: 3204	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 7388 resumed a thread in remote process 3204
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x000000d4 suspend_count: 1 process_identifier: 3204	1	0	0

Executed a process and injected code into it, probably while unpacking (11 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW June 25, 2021, 9:52 a.m.	thread_identifier: 1836 thread_handle: 0x000000d4 process_identifier: 3204 current_directory: filepath: track: 1 command_line: C:\Windows\System32\svchost.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000d8	1	1
NtGetContextThread June 25, 2021, 9:52 a.m.	thread_handle: 0x000000d4	1	0
NtAllocateVirtualMemory June 25, 2021, 9:52 a.m.	process_identifier: 3204 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09500000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000d8	1	0
WriteProcessMemory June 25, 2021, 9:52 a.m.	buffer: MZÿÿ¸@Ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $UùîE4½E4½E4½;½F4½;Ê½B4½E4½p4½LL½F4½LL½D4½LL½D4½RichE4½PELÖþâRà D0N`P @ PPpÐÐ.textöCD `.data\|`H@À.reloc®pL@B base_address: 0x09500000 process_identifier: 3204 process_handle: 0x000000d8	1	1
WriteProcessMemory June 25, 2021, 9:52 a.m.	buffer: base_address: 0x09501000 process_identifier: 3204 process_handle: 0x000000d8	1	1
WriteProcessMemory June 25, 2021, 9:52 a.m.	buffer: 0123456789ABCDEF"3Djjj79#188.64.170.79:443#188.64.170.208:443#Næ@»±¿D base_address: 0x09506000 process_identifier: 3204 process_handle: 0x000000d8	1	1
WriteProcessMemory June 25, 2021, 9:52 a.m.	buffer: °¸2¼24444*414W4f4m44À4Î4Û4ú4$515E5R5c55´5Á5[6`6f6k6p6v6{6¿6ê67z77Ü7&8d88¼89'999C9]999Ë9Ö9é9ó9:;:F:Y:c:x:«:¶:É:Ó:è:;&;9;C;W;b;u;;;L<¶= >¤>¨>¬>°>´>¸>¼>À> $511ý1é2ú2/3>33þ4¹:;:<^<0x0$0B0L0l021<1`1u11Z34³4à4ì455 5,575W5_5k5¶6Ê6:+:G:W:å:õ:;$;@;P;j;y;À;Ì;ç;ï;û;Ð=Ü=ø=>#>2>D>T>w>>>¬>Ç>Á?@ÄH1P1`1j1e222º2È2ï2&3G3W3o3333¿3Ï3ð344µ4È4Ð45Å5Ì5Ý5ã5ï56 66(6=6K6h6r66¸677é728j8s8¬8-9G9q99ç9ò9ù9:4:H:.<?<P<>9>Y>g>q>>¢>¨>®>´>º>À>Ç>Î>Õ>Ü>ã>ê>ñ>?????'?-?8?@?K?P?V?g?n? base_address: 0x09507000 process_identifier: 3204 process_handle: 0x000000d8	1	1
WriteProcessMemory June 25, 2021, 9:52 a.m.	buffer: P base_address: 0x7efde008 process_identifier: 3204 process_handle: 0x000000d8	1	1
NtSetContextThread June 25, 2021, 9:52 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 156257840 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000d4 process_identifier: 3204	1	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x000000d4 suspend_count: 1 process_identifier: 3204	1	0
CreateProcessInternalW June 25, 2021, 9:52 a.m.	thread_identifier: 4356 thread_handle: 0x000000d8 process_identifier: 4456 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: /c del C:\Users\test22\AppData\Local\Temp\j79.exe >> NUL filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000000d4	1	1

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Bkav	W32.AIDetect.malware1
MicroWorld-eScan	Gen:Variant.Mikey.117366
CAT-QuickHeal	Trojanpws.Zbot.28622
ALYac	Gen:Variant.Mikey.117366
Cylance	Unsafe
Sangfor	Riskware.Win32.Agent.ky
K7AntiVirus	Trojan ( 0049538e1 )
Alibaba	TrojanDownloader:Win32/Cutwail.99e5a3b0
K7GW	Trojan ( 0049538e1 )
Cybereason	malicious.0e97b6
Arcabit	Trojan.Mikey.D1CA76
BitDefenderTheta	Gen:NN.ZexaF.34758.eqW@aGXG9cgi
Cyren	W32/Trojan.NWZI-4417
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.AXJU
Baidu	Win32.Trojan-Downloader.Waski.a
TrendMicro-HouseCall	TROJ_GEN.R002C0DFJ21
Avast	Win32:Agent-AUID [Trj]
Kaspersky	HEUR:Backdoor.Win32.Androm.gen
BitDefender	Gen:Variant.Mikey.117366
Paloalto	generic.ml
AegisLab	Hacktool.Win32.ArchSMS.m1fO
Tencent	Win32.Trojan.Mikey.Wqxj
Ad-Aware	Gen:Variant.Mikey.117366
Emsisoft	Gen:Variant.Mikey.117366 (B)
VIPRE	Trojan.Win32.Upatre.jr (v)
TrendMicro	TROJ_GEN.R002C0DFJ21
McAfee-GW-Edition	PWSZbot-FOK!6B8F35C0E97B
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.6b8f35c0e97b6387
Sophos	ML/PE-A
APEX	Malicious
eGambit	Unsafe.AI_Score_99%
Avira	HEUR/AGEN.1116493
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	TrojanDownloader:Win32/Cutwail.BF
GData	Gen:Variant.Mikey.117366
Cynet	Malicious (score: 100)
AhnLab-V3	Spyware/Win32.Zbot.C282998
Acronis	suspicious
McAfee	PWSZbot-FOK!6B8F35C0E97B
MAX	malware (ai score=100)
VBA32	Backdoor.Androm
Ikarus	Trojan-Downloader.Win32.Upatre
Fortinet	W32/Wonton.AQ!tr
AVG	Win32:Agent-AUID [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_90% (W)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 events)

dead_host	188.64.170.208:443
dead_host	188.64.170.79:443

j79.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All