Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 14, 2021, 4:42 p.m.	Oct. 14, 2021, 4:45 p.m.

Size	1.2KB
Type	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=5, Archive, ctime=Fri Apr 9 04:50:48 2021, mtime=Wed Sep 15 07:11:58 2021, atime=Fri Apr 9 04:50:48 2021, length=71680, window=hide
MD5	`db8f42a798dd65d9bd8398c3e2564f06`
SHA256	`59b77f3b8d2e7d72c61d522a2bcabbe0b47be3b73e1a4001cb763589a656134c`
CRC32	`50E3F0B4`
ssdeep	`24:8gy2WCBYm1LjCylTyAKOex+/Clso0aPilpiAWBpAXD/lusmv:8IxLeyltKnLlsotBqXjlus`
Yara	Generic_Malware_Zero - Generic Malware Lnk_Format_Zero - LNK Format

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "vhIucrvFS" C:\Users\test22\AppData\Local\Temp\Documents.lnk
2364
- rundll32.exe "C:\Windows\System32\rundll32.exe" 1.dll,EnterDll
  2524

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Oct. 14, 2021, 4:43 p.m.	stacktrace: GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75176d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75176de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75176e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7755011a DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x7519cf5c SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x751cf73c SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x751cfa18 MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x751cfb1f New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x743677b7 MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x751cfd15 MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x751cfd57 rundll32+0x393f @ 0xcf393f rundll32+0x247a @ 0xcf247a rundll32+0x1baf @ 0xcf1baf rundll32+0x12e8 @ 0xcf12e8 rundll32+0x1901 @ 0xcf1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x73cc3f46 registers.esp: 1502768 registers.edi: 0 registers.eax: 1942765382 registers.ebp: 1502808 registers.edx: 0 registers.ebx: 0 registers.esi: 1942765382 registers.ecx: 7277928	1
__exception__ Oct. 14, 2021, 4:43 p.m.	stacktrace: GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75176d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75176de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75176e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7755011a DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x7519cf5c SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x751cf73c SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x751cfa18 MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x751cfb1f New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x743677b7 MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x751cfd15 MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x751cfd57 rundll32+0x393f @ 0xcf393f rundll32+0x247a @ 0xcf247a rundll32+0x1baf @ 0xcf1baf rundll32+0x12e8 @ 0xcf12e8 rundll32+0x1901 @ 0xcf1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x73cc3f46 registers.esp: 1502768 registers.edi: 0 registers.eax: 1942765382 registers.ebp: 1502808 registers.edx: 0 registers.ebx: 0 registers.esi: 1942765382 registers.ecx: 7277928	1
__exception__ Oct. 14, 2021, 4:43 p.m.	stacktrace: CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x74d1d08c TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x74d1964b TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x74d04d6b TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x74d06f7c CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x74d0e825 TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x74d06002 TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x74d05fe8 TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x74d049e3 TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x74d05a20 RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x77579a91 LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77598f10 RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77598e5c ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x76377a25 rundll32+0x135c @ 0xcf135c rundll32+0x1901 @ 0xcf1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25 exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4 exception.instruction: call dword ptr [ecx + 0xc] exception.module: MSCTF.dll exception.exception_code: 0xc0000005 exception.offset: 278260 exception.address: 0x74d33ef4 registers.esp: 1505412 registers.edi: 0 registers.eax: 11411656 registers.ebp: 1505440 registers.edx: 1 registers.ebx: 0 registers.esi: 4922848 registers.ecx: 1942631804	1

Time & API

Arguments

Status

Return

Repeated

__exception__

Oct. 14, 2021, 4:43 p.m.

stacktrace:

GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75176d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75176de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75176e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7755011a
DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x7519cf5c
SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x751cf73c
SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x751cfa18
MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x751cfb1f
New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x743677b7
MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x751cfd15
MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x751cfd57
rundll32+0x393f @ 0xcf393f
rundll32+0x247a @ 0xcf247a
rundll32+0x1baf @ 0xcf1baf
rundll32+0x12e8 @ 0xcf12e8
rundll32+0x1901 @ 0xcf1901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x73cc3f46
registers.esp: 1502768
registers.edi: 0
registers.eax: 1942765382
registers.ebp: 1502808
registers.edx: 0
registers.ebx: 0
registers.esi: 1942765382
registers.ecx: 7277928

__exception__

Oct. 14, 2021, 4:43 p.m.

stacktrace:

GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75176d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75176de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75176e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7755011a
DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x7519cf5c
SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x751cf73c
SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x751cfa18
MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x751cfb1f
New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x743677b7
MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x751cfd15
MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x751cfd57
rundll32+0x393f @ 0xcf393f
rundll32+0x247a @ 0xcf247a
rundll32+0x1baf @ 0xcf1baf
rundll32+0x12e8 @ 0xcf12e8
rundll32+0x1901 @ 0xcf1901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

__exception__

Oct. 14, 2021, 4:43 p.m.

stacktrace:

CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x74d1d08c
TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x74d1964b
TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x74d04d6b
TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x74d06f7c
CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x74d0e825
TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x74d06002
TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x74d05fe8
TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x74d049e3
TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x74d05a20
RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x77579a91
LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77598f10
RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77598e5c
ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x76377a25
rundll32+0x135c @ 0xcf135c
rundll32+0x1901 @ 0xcf1901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25
exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4
exception.instruction: call dword ptr [ecx + 0xc]
exception.module: MSCTF.dll
exception.exception_code: 0xc0000005
exception.offset: 278260
exception.address: 0x74d33ef4
registers.esp: 1505412
registers.edi: 0
registers.eax: 11411656
registers.ebp: 1505440
registers.edx: 1
registers.ebx: 0
registers.esi: 4922848
registers.ecx: 1942631804

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 14, 2021, 4:42 p.m.	process_identifier: 2524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c51000 process_handle: 0xffffffff	1	0	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\Documents.lnk

File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 events)

Cyren	LNK/Runner.C
ESET-NOD32	LNK/Agent.LL
TrendMicro-HouseCall	TROJ_FRS.VSNTJC21
Cynet	Malicious (score: 99)
Kaspersky	Trojan.WinLNK.Agent.xn
Ikarus	Trojan.LNK.Agent
Avira	EXP/LNK.DL
ZoneAlarm	Trojan.WinLNK.Agent.xn

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2364 resumed a thread in remote process 2524
NtResumeThread Oct. 14, 2021, 4:42 p.m.	thread_handle: 0x000002f0 suspend_count: 1 process_identifier: 2524	1	0	0

Documents.lnk

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All