Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 20, 2021, 8:12 p.m.	July 20, 2021, 8:42 p.m.

Size	262.7KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`928ec247e6f6cd246851bfab7a7154fb`
SHA256	`ebcb11c34621fb23b52cd1525f932bf3eb550359547518805b6db9da1698a6da`
CRC32	`47ABC5A8`
ssdeep	`6144:SQbSnYgZbTL1QNCVQAE12yeFwtLQgJlugDRe4JlTQBUrtr:SKSY8TL20+AQ2y/t9ugDRe4JliC`
Yara	IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check PE_Header_Zero - PE File Signature

neww.exe "C:\Users\test22\AppData\Local\Temp\neww.exe"
2216
- neww.exe "C:\Users\test22\AppData\Local\Temp\neww.exe"
  2384
  - dw20.exe dw20.exe -x -s 444
    1332

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA July 20, 2021, 8:12 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW July 20, 2021, 8:12 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 20, 2021, 8:12 p.m.			0	0
IsDebuggerPresent July 20, 2021, 8:12 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 20, 2021, 8:12 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 20, 2021, 8:12 p.m.	stacktrace: SafeArrayDestroy+0xf SafeArrayUnlock-0x1d6 oleaut32+0x1defa @ 0x767bdefa neww+0x12d5 @ 0x4012d5 neww+0x14e5 @ 0x4014e5 neww+0x1819 @ 0x401819 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 5e 08 0f 87 e6 9e 01 00 57 0f b7 7e 02 f7 c7 exception.symbol: SafeArrayDestroy+0x2c SafeArrayUnlock-0x1b9 oleaut32+0x1df17 exception.instruction: cmp dword ptr [esi + 8], ebx exception.module: OLEAUT32.dll exception.exception_code: 0xc0000005 exception.offset: 122647 exception.address: 0x767bdf17 registers.esp: 1637996 registers.edi: 2147942411 registers.eax: 0 registers.ebp: 1638004 registers.edx: 860 registers.ebx: 0 registers.esi: 185856 registers.ecx: 6114384	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 2384 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f10000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x725d1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x725d2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 2384 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00507000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00505000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 1332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72212000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 20, 2021, 8:12 p.m.	process_identifier: 1332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2216 called NtSetContextThread to modify thread in remote process 2384
NtSetContextThread July 20, 2021, 8:12 p.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4200587 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000d4 process_identifier: 2384	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2216 resumed a thread in remote process 2384
NtResumeThread July 20, 2021, 8:12 p.m.	thread_handle: 0x000000d4 suspend_count: 1 process_identifier: 2384	1	0	0

File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ulise.260215
FireEye	Generic.mg.928ec247e6f6cd24
Cylance	Unsafe
Cybereason	malicious.c43ab5
BitDefenderTheta	Gen:NN.ZexaF.34796.qiZ@aqLTLFg
Cyren	W32/Kryptik.ERD.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.FHSC
Kaspersky	UDS:Trojan-Spy.Win32.Noon
BitDefender	Gen:Variant.Ulise.260215
Avast	Win32:PWSX-gen [Trj]
Rising	Trojan.Generic@ML.94 (RDML:jVijBh6+yscG94Eks4HMnw)
Ad-Aware	Gen:Variant.Ulise.260215
McAfee-GW-Edition	BehavesLike.Win32.Dropper.dc
SentinelOne	Static AI - Suspicious PE
APEX	Malicious
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Ulise.260215
Cynet	Malicious (score: 100)
Acronis	suspicious
MAX	malware (ai score=82)
VBA32	Malware-Cryptor.General.3
Fortinet	W32/Kryptik.HIBR!tr
AVG	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	HEUR/QVM20.1.B4A6.Malware.Gen

Executed a process and injected code into it, probably while unpacking (10 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW July 20, 2021, 8:12 p.m.	thread_identifier: 1772 thread_handle: 0x000000d4 process_identifier: 2384 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\neww.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\neww.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\neww.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000d8	1	1
NtGetContextThread July 20, 2021, 8:12 p.m.	thread_handle: 0x000000d4	1	0
NtUnmapViewOfSection July 20, 2021, 8:12 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2384 process_handle: 0x000000d8	1	0
NtMapViewOfSection July 20, 2021, 8:12 p.m.	section_handle: 0x000000e0 process_identifier: 2384 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: base_address: 0x00400000 allocation_type: 0 () section_offset: 0 view_size: 274432 process_handle: 0x000000d8	1	0
NtSetContextThread July 20, 2021, 8:12 p.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4200587 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000d4 process_identifier: 2384	1	0
NtResumeThread July 20, 2021, 8:12 p.m.	thread_handle: 0x000000d4 suspend_count: 1 process_identifier: 2384	1	0
NtResumeThread July 20, 2021, 8:12 p.m.	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 2384	1	0
NtResumeThread July 20, 2021, 8:12 p.m.	thread_handle: 0x00000164 suspend_count: 1 process_identifier: 2384	1	0
CreateProcessInternalW July 20, 2021, 8:12 p.m.	thread_identifier: 1536 thread_handle: 0x000001d4 process_identifier: 1332 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe track: 1 command_line: dw20.exe -x -s 444 filepath_r: C:\Windows\Microsoft.NET\Framework\v2.0.50727\\dw20.exe stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x000001d0	1	1
NtResumeThread July 20, 2021, 8:12 p.m.	thread_handle: 0x000000b8 suspend_count: 1 process_identifier: 1332	1	0

neww.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All