Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 25, 2021, 3:15 p.m.	June 25, 2021, 3:17 p.m.

Size	24.4MB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`63e32043d2d8713aae718fc11416153b`
SHA256	`32ae83dce97b97caff308dc542e85e89570dc4eb35cdf10a357124300d3a1fe7`
CRC32	`0E2E8B65`
ssdeep	`393216:VWPx1jpayhjOzsjEvOdlJTdNXhFUbMwc:VWPx1jpaqOzsQvOdlJTLXUD`
Yara	IsPE64 - (no description) Antivirus - Contains references to security software anti_vm_detect - Possibly employs anti-virtualization techniques Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file

autoupdate.exe "C:\Users\test22\AppData\Local\Temp\autoupdate.exe"
204
- procdump.exe C:\Users\test22\AppData\Local\Temp/procdump.exe -accepteula -ma lsass.exe C:\Users\test22\AppData\Local\Temp/1.dmp
  2164

Name	Response	Post-Analysis Lookup
m.windowsupdatesupport.org	A 173.209.56.170 A 93.95.227.42 A 93.95.226.238 A 89.45.4.101	89.45.4.101

IP Address	Status	Action
164.124.101.2	Active	Moloch
93.95.226.238	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49200 -> 93.95.226.238:80	2024897	ET USER_AGENTS Go HTTP Client User-Agent	Misc activity
TCP 192.168.56.101:49200 -> 93.95.226.238:80	2032355	ET INFO Request for EXE via GO HTTP Client	Misc activity
TCP 93.95.226.238:80 -> 192.168.56.101:49200	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 93.95.226.238:80 -> 192.168.56.101:49200	2014519	ET INFO EXE - Served Inline HTTP	Misc activity

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.symtab

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (1 event)

request

GET http://m.windowsupdatesupport.org/d/procdump.exe

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\procdump.exe
file	C:\Users\test22\AppData\Local\Temp\procdump64.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\procdump.exe

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (41 events)

Time & API	Arguments	Status	Return
Process32FirstW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: [System Process] process_identifier: 0	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: System process_identifier: 4	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: smss.exe process_identifier: 224	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: csrss.exe process_identifier: 300	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: wininit.exe process_identifier: 348	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: csrss.exe process_identifier: 364	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: winlogon.exe process_identifier: 396	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: services.exe process_identifier: 440	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: lsass.exe process_identifier: 456	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: lsm.exe process_identifier: 464	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: svchost.exe process_identifier: 568	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: svchost.exe process_identifier: 640	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: svchost.exe process_identifier: 700	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: svchost.exe process_identifier: 776	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: svchost.exe process_identifier: 824	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: audiodg.exe process_identifier: 892	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: svchost.exe process_identifier: 968	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: svchost.exe process_identifier: 264	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: spoolsv.exe process_identifier: 820	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: svchost.exe process_identifier: 292	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: svchost.exe process_identifier: 1192	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: srvany.exe process_identifier: 1244	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: taskhost.exe process_identifier: 1284	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: KMService.exe process_identifier: 1324	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: conhost.exe process_identifier: 1376	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: sppsvc.exe process_identifier: 1800	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: svchost.exe process_identifier: 1876	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: dwm.exe process_identifier: 1496	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: explorer.exe process_identifier: 1848	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: WmiPrvSE.exe process_identifier: 1916	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: pw.exe process_identifier: 2816	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: SearchIndexer.exe process_identifier: 2940	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: SearchProtocolHost.exe process_identifier: 1480	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: SearchFilterHost.exe process_identifier: 3040	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: SearchProtocolHost.exe process_identifier: 2120	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: mobsync.exe process_identifier: 1068	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: pw.exe process_identifier: 1552	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: taskhost.exe process_identifier: 2668	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: autoupdate.exe process_identifier: 204	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: procdump.exe process_identifier: 2164	1	1
Process32NextW June 25, 2021, 3:15 p.m.	snapshot_handle: 0x0000028c process_name: conhost.exe process_identifier: 2324	1	1

The binary likely contains encrypted or compressed data indicative of a packer (7 events)

section

{u'size_of_data': u'0x000fec00', u'virtual_address': u'0x01231000', u'entropy': 7.997411840270105, u'name': u'/19', u'virtual_size': u'0x000fea52'}

entropy

7.99741184027

description