Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 30, 2021, 8:46 p.m.	July 30, 2021, 8:50 p.m.

Size	1.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`075ba8e35c73b895b107baad6b85bb82`
SHA256	`d77d79c44479ca36692d5a388a496b9d7c8bb51d5cd0bd30ad88da0a9cac4bd6`
CRC32	`0D0B1C90`
ssdeep	`24576:ZBe1ZMgyuhpuwvq8qLduQgfbZi9jnv5ErDkCWRsrD:u1ZbhTvq8qLBgjZsj2gWD`
Yara	IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

lv.exe "C:\Users\test22\AppData\Local\Temp\lv.exe"
2076
- vpn.exe "C:\Users\test22\AppData\Local\Temp\New Feature\vpn.exe"
  2192
  - cmd.exe cmd /c LvTasfZdX
    2300
  - cmd.exe cmd /c cmd < Rapiva.mov
    2364
    - cmd.exe cmd
      2444
      - findstr.exe findstr /V /R "^pAvofqIrkohjdrCgCTcBhWrPbuXmHqloifUaNcpwSZexQIXXPwRGojGjbGKoroclYytqolBuKxJgUJZOpqKGoDZUJIVuKqXJDRcKDXOFmLVODaaNHWZrnPwxulsAgccJvZKehgkkktubI$" Sento.mov
        2488
      - Arteria.exe.com Arteria.exe.com U
        2532
        
        Arteria.exe.com C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Arteria.exe.com U
        2600
      - PING.EXE ping localhost -n 30
        2664
- 4.exe "C:\Users\test22\AppData\Local\Temp\New Feature\4.exe"
  2228

Name	Response	Post-Analysis Lookup
GgdtfkaEHdAzKOSzI.GgdtfkaEHdAzKOSzI

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 30, 2021, 8:46 p.m.			0	0
IsDebuggerPresent July 30, 2021, 8:46 p.m.			0	0
IsDebuggerPresent July 30, 2021, 8:46 p.m.			0	0

Command line console output was observed (50 out of 90 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: 'LvTasfZdX' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: Set adxuz=DESKTOP- console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: Set noUryvnBNwrTHOoqZyirKXyXolw=QO5QU33 console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: Set ESyzmQVGtvNBhmKzaBqlG=ping console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: if %computername%==%adxuz% exit console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: Set bkgRoWKCmGRjyarzWEFzWIk=MZ console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: <nul set /p = "%bkgRoWKCmGRjyarzWEFzWIk%" > Arteria.exe.com console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: findstr /V /R "^pAvofqIrkohjdrCgCTcBhWrPbuXmHqloifUaNcpwSZexQIXXPwRGojGjbGKoroclYytqolBuKxJgUJZOpqKGoDZUJIVuKqXJDRcKDXOFmLVODaaNHWZrnPwxulsAgccJvZKehgkkktubI$" Sento.mov >> Arteria.exe.com" console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: copy Mutato.mov U console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: start Arteria.exe.com U console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: %ESyzmQVGtvNBhmKzaBqlG% localhost -n 30 console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW July 30, 2021, 8:46 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: Pinging test22-PC [::1] console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: with 32 bytes of data: console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA July 30, 2021, 8:46 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 30, 2021, 8:46 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (28 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x767a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73951000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a02000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ae1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b92000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c13000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x739c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 90112 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03341000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2228 region_size: 155648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03260000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ae1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b92000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ae1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b92000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2600 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 102400 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x043d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x043ea000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x043f2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x043f4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 30, 2021, 8:46 p.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x043f5000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW July 30, 2021, 8:46 p.m.	number_of_free_clusters: 3005413 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0
GetDiskFreeSpaceW July 30, 2021, 8:46 p.m.	number_of_free_clusters: 3005413 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0

Creates executable files on the filesystem (7 events)

file	C:\Program Files (x86)\foler\olader\acppage.dll
file	C:\Users\test22\AppData\Local\Temp\New Feature\vpn.exe
file	C:\Program Files (x86)\foler\olader\acledit.dll
file	C:\Users\test22\AppData\Local\Temp\nso5223.tmp\UAC.dll
file	C:\Program Files (x86)\foler\olader\adprovider.dll
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Arteria.exe.com
file	C:\Users\test22\AppData\Local\Temp\New Feature\4.exe

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Local\Temp\nso5223.tmp\UAC.dll
file	C:\Users\test22\AppData\Local\Temp\New Feature\vpn.exe
file	C:\Users\test22\AppData\Local\Temp\New Feature\4.exe

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

ping localhost -n 30

Attempts to identify installed AV products by installation directory (2 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\AVG

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

reg_value

rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2444 resumed a thread in remote process 2532
NtResumeThread July 30, 2021, 8:46 p.m.	thread_handle: 0x00000134 suspend_count: 0 process_identifier: 2532	1	0	0

File has been identified by 26 AntiVirus engines on VirusTotal as malicious (26 events)

Cynet	Malicious (score: 100)
Zillya	Backdoor.Agent.Win32.79796
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005595971 )
K7GW	Trojan ( 005595971 )
Cybereason	malicious.aa6b8d
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/ClipBanker.IR
APEX	Malicious
ClamAV	Win.Packed.Filerepmalware-9864117-0
Kaspersky	UDS:Backdoor.Win32.Agent.gen
SUPERAntiSpyware	Trojan.Agent/GenericKD
Avast	Win32:Trojan-gen
Emsisoft	Trojan.Crypt (A)
Sophos	Troj/Agent-BHFT
eGambit	Unsafe.AI_Score_72%
Microsoft	Program:Win32/Wacapew.C!ml
ZoneAlarm	HEUR:Trojan-PSW.Win32.Coins.gen
GData	Win32.Trojan.BSE.HLJWVB
AhnLab-V3	Trojan/Win.Generic.C4493298
BitDefenderTheta	Gen:NN.ZexaF.34050.wuW@a8UgWCbG
Malwarebytes	Malware.AI.4024116118
Rising	Trojan.Kryptik!1.C6FC (CLASSIC)
SentinelOne	Static AI - Suspicious PE
AVG	Win32:Trojan-gen
Qihoo-360	HEUR/QVM42.0.EDD4.Malware.Gen

lv.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All