Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

35d427_02df7f9ae2d74130872a6c4165f7ed60.txt

Anti_VM ScreenShot AntiVM AntiDebug

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 18, 2021, 6:31 p.m.	Aug. 18, 2021, 6:57 p.m.

Size	398.7KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`e61641b2f563a8a0e2866300c18b5864`
SHA256	`050641c2cd6e9e1a677419fd094e1696941c1bc5912a495b77bf7a8a3fe000e3`
CRC32	`221E295D`
ssdeep	`12288:FMwY3ANv/d2VH17RUM5uZgBzED5cehpMdM:FM+g9M`
Yara	anti_vm_detect - Possibly employs anti-virtualization techniques

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "wZBCZhkJPyRsCgy" C:\Users\test22\AppData\Local\Temp\35d427_02df7f9ae2d74130872a6c4165f7ed60.txt
1280
- notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\test22\AppData\Local\Temp\35d427_02df7f9ae2d74130872a6c4165f7ed60.txt
  2084

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 18, 2021, 6:31 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 18, 2021, 6:31 p.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736b2000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 18, 2021, 6:31 p.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73733000 process_handle: 0xffffffff	1	0	0

File has been identified by 4 AntiVirus engines on VirusTotal as malicious (4 events)

Symantec	Downloader!gm
Avast	SNH:Script [Dropper]
Ikarus	Trojan-Dropper.PS.Agent
AVG	SNH:Script [Dropper]

Yara rule detected in process memory (9 events)

description	Take ScreenShot				rule	ScreenShot
description	(no description)				rule	DebuggerCheck__GlobalFlags
description	(no description)				rule	DebuggerCheck__QueryInfo
description	(no description)				rule	DebuggerHiding__Thread
description	(no description)				rule	DebuggerHiding__Active
description	(no description)				rule	ThreadControl__Context
description	(no description)				rule	SEH__vectored
description	Checks if being debugged				rule	anti_dbg
description	Bypass DEP				rule	disable_dep