Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 4, 2021, 1:53 p.m.	Sept. 4, 2021, 1:56 p.m.

Size	234.3KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`0a9de49281cf90a99f03cb917ac16afe`
SHA256	`66e9a440c0e4719ed9c472be00302f7a1176f48b5e0153284abc0c8060d70306`
CRC32	`3D6B91F7`
ssdeep	`6144:S9X0G6PHRrBTA8lVcf5fNMRkjqm5kDy8iGLkA:00zfRxAschfSOczToA`
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

bin_Protected.exe "C:\Users\test22\AppData\Local\Temp\bin_Protected.exe"
2220
dllhost.exe "C:\Windows\System32\dllhost.exe"
2244

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 4, 2021, 1:53 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 4, 2021, 1:54 p.m.	stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xffd5cfc0 registers.esp: 2621160 registers.edi: 0 registers.eax: 1970484152 registers.ebp: 2621168 registers.edx: 4292202432 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 4, 2021, 1:53 p.m.	process_identifier: 2220 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 2220 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 2220 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 2220 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\nsy6125.tmp\whfcpczcxj.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\nsy6125.tmp\whfcpczcxj.dll

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00005600', u'virtual_address': u'0x0003b000', u'entropy': 7.76202497752768, u'name': u'.rsrc', u'virtual_size': u'0x00005538'}

entropy

7.76202497753

description

A section with a high entropy has been found

entropy

0.401869158879

description

Overall entropy of this PE file is high

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 018d43e742f84460f7b7e928c505b19152f9a732

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 2244 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x000001f0	1	0	0

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2220 manipulating memory of non-child process 2244
NtAllocateVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 2244 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x000001f0	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2220 injected into non-child 2244
WriteProcessMemory Sept. 4, 2021, 1:54 p.m.	buffer: base_address: 0x7efde008 process_identifier: 2244 process_handle: 0x000001f0	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2220 called NtSetContextThread to modify thread in remote process 2244
NtSetContextThread Sept. 4, 2021, 1:54 p.m.	registers.eip: 1702125923 registers.esp: 2053729377 registers.edi: 0 registers.eax: 774080 registers.ebp: 1869376577 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001ec process_identifier: 2244	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2220 resumed a thread in remote process 2244
NtResumeThread Sept. 4, 2021, 1:54 p.m.	thread_handle: 0x000001ec suspend_count: 1 process_identifier: 2244	1	0	0

File has been identified by 21 AntiVirus engines on VirusTotal as malicious (21 events)

Bkav	W32.AIDetect.malware2
MicroWorld-eScan	Gen:Variant.Razy.916074
FireEye	Generic.mg.0a9de49281cf90a9
McAfee	Artemis!0A9DE49281CF
Cylance	Unsafe
ESET-NOD32	a variant of Win32/GenKryptik.FJXX
APEX	Malicious
Paloalto	generic.ml
Kaspersky	VHO:Trojan-Spy.Win32.Noon.gen
BitDefender	Gen:Variant.Razy.916074
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	BehavesLike.Win32.ICLoader.dc
Emsisoft	Gen:Variant.Razy.916074 (B)
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Razy.916074
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Razy.916074
MAX	malware (ai score=84)
VBA32	BScope.TrojanPSW.Banker
Malwarebytes	Malware.AI.3849881016
SentinelOne	Static AI - Malicious PE

Executed a process and injected code into it, probably while unpacking (7 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Sept. 4, 2021, 1:54 p.m.	thread_identifier: 2264 thread_handle: 0x000001ec process_identifier: 2244 current_directory: filepath: C:\Windows\System32\dllhost.exe track: 1 command_line: filepath_r: C:\Windows\System32\dllhost.exe stack_pivoted: 0 creation_flags: 524292 (CREATE_SUSPENDED\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000001f0	1	1
NtAllocateVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 2244 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x000001f0	1	0
WriteProcessMemory Sept. 4, 2021, 1:54 p.m.	buffer: base_address: 0x000a0000 process_identifier: 2244 process_handle: 0x000001f0	1	1
WriteProcessMemory Sept. 4, 2021, 1:54 p.m.	buffer: base_address: 0x7efde008 process_identifier: 2244 process_handle: 0x000001f0	1	1
NtGetContextThread Sept. 4, 2021, 1:54 p.m.	thread_handle: 0x000001ec	1	0
NtSetContextThread Sept. 4, 2021, 1:54 p.m.	registers.eip: 1702125923 registers.esp: 2053729377 registers.edi: 0 registers.eax: 774080 registers.ebp: 1869376577 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001ec process_identifier: 2244	1	0
NtResumeThread Sept. 4, 2021, 1:54 p.m.	thread_handle: 0x000001ec suspend_count: 1 process_identifier: 2244	1	0

bin_Protected.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All