Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 25, 2021, 2:34 p.m.	June 25, 2021, 2:39 p.m.

Size	620.8KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`5e8f78570b9610d10fe961dd12e8dba6`
SHA256	`d2517e4a148f49f87722265abdfb091cc8655e78edb715c70aafc46cc6e75d64`
CRC32	`DA9FAA22`
ssdeep	`12288:fj+BuagU0y60p1u8lES1PBD7aJOth+no0Ukhf/kGIQr:L+BIU0GO8lEEPN75tSBlf/TIQr`
Yara	Antivirus - Contains references to security software IsPE32 - (no description) PE_Header_Zero - PE File Signature

ssetup.exe "C:\Users\test22\AppData\Local\Temp\ssetup.exe"
620
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\n3OVbL.bat""
  872
  - PING.EXE ping -n 2 127.1
    2256

Name	Response	Post-Analysis Lookup
s5_rep.listw.top	A 8.135.96.89	8.135.96.89
s5_down.listw.top	A 120.79.176.83	120.79.176.83

IP Address	Status	Action
114.114.114.114	Active	Moloch
120.79.176.83	Active	Moloch
164.124.101.2	Active	Moloch
8.135.96.89	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:62329 -> 114.114.114.114:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW June 25, 2021, 2:34 p.m.	buffer: The batch file cannot be found. console_handle: 0x0000000b	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 25, 2021, 2:34 p.m.		1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

FILE

Foreign language identified in PE resource (7 events)

name

FILE

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0004da50

size

0x00048380

name

FILE

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0004da50

size

0x00048380

name

RT_DIALOG

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000052c0

size

0x000000e8

name

RT_DIALOG

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000052c0

size

0x000000e8

name

RT_STRING

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000961f0

size

0x0000003c

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000053a8

size

0x00000324

name

RT_MANIFEST

language

LANG_CHINESE

filetype

XML 1.0 document, ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00095dd0

size

0x0000041c

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\n3OVbL.bat

Creates a service (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceA June 25, 2021, 2:34 p.m.	service_start_name: start_type: 0 password: display_name: mspci filepath: C:\Windows\System32\drivers\mspci.sys service_name: mspci filepath_r: C:\Windows\system32\drivers\mspci.sys desired_access: 983551 service_handle: 0x0057b0a0 error_control: 1 service_type: 1 service_manager_handle: 0x0057b140	1	5746848	0

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\ssetup.exe

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 event)

Time & API	Arguments	Status	Return	Repeated
Process32NextW June 25, 2021, 2:34 p.m.	snapshot_handle: 0x000000c4 process_name: taskhost.exe process_identifier: 3032	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00092000', u'virtual_address': u'0x00005000', u'entropy': 7.9794487394775695, u'name': u'.rsrc', u'virtual_size': u'0x00091230'}

entropy

7.97944873948

description

A section with a high entropy has been found

entropy

0.973333333333

description

Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

ping -n 2 127.1

Installs itself for autorun at Windows startup (1 event)

service_name

mspci

service_path

C:\Windows\System32\drivers\mspci.sys

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\n3OVbL.bat

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D8C7019BD363CEA27D25594A5517BD6A5225E04B\Blob

Creates and runs a batch file to remove the original binary (1 event)

file	276cfadc80c356ef_n3OVbL.bat

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.46530551
FireEye	Generic.mg.5e8f78570b9610d1
McAfee	RDN/Generic.grp
Cylance	Unsafe
Zillya	Trojan.AgentCRTD.Win32.9239
Sangfor	Trojan.Win32.Save.a
Alibaba	Trojan:Win32/Witch.3a75efb7
Symantec	Trojan.Gen.MBT
TrendMicro-HouseCall	TROJ_GEN.R002H0CFO21
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan.Win32.Witch.gen
BitDefender	Trojan.GenericKD.46530551
Paloalto	generic.ml
AegisLab	Trojan.Win32.Witch.4!c
Rising	Trojan.DDLives!1.D77E (CLASSIC)
Ad-Aware	Trojan.GenericKD.46530551
Emsisoft	Trojan.GenericKD.46530551 (B)
Comodo	TrojWare.Win32.Agent.xmmpz@0
McAfee-GW-Edition	Artemis!Trojan
APEX	Malicious
eGambit	Unsafe.AI_Score_99%
Avira	TR/Dropper.Gen
MAX	malware (ai score=81)
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	HackTool:Win32/AutoKMS!ml
GData	Trojan.GenericKD.46530551
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.Generic.R426870
VBA32	BScope.Trojan.Pasta
Ikarus	Trojan.Dropper
Fortinet	W32/Witch!tr
AVG	Win32:Malware-gen
Panda	Trj/CI.A

ssetup.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All