Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 15, 2021, 5:59 p.m.	Oct. 15, 2021, 6:10 p.m.

Size	342.9KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`9b93526bb5cb8f5b487a2236f45bf4a9`
SHA256	`c5804308c95cf5f08e0b06cc674be6e1b9421c13a174ddcc73f7d1252001f9e5`
CRC32	`56F2FB56`
ssdeep	`6144:s3lglS9B3U1wB7zS96KyZzlhWIUiFjD7jiH4/a7B9spsnuHifcYcsTAtLtZ2KwUC:9GBEuBqI9UeiHGa7EQDcKExw1UkN`
Yara	PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library

TimeLimitInst.exe "C:\Users\test22\AppData\Local\Temp\TimeLimitInst.exe"
2776
- TimeLimit.exe "C:\Program Files (x86)\TimeLimit\TimeLimit.exe"
  1048
  - cmd.exe C:\Windows\system32\cmd.exe /c cacls "C:\Program Files (x86)\TimeLimit\TimeLimit.dat" /e /g users:f
    2696
    - cacls.exe cacls "C:\Program Files (x86)\TimeLimit\TimeLimit.dat" /e /g users:f
      2312
  - cmd.exe C:\Windows\system32\cmd.exe /c cacls "C:\Program Files (x86)\TimeLimit\token.dat" /e /g users:f
    2692
    - cacls.exe cacls "C:\Program Files (x86)\TimeLimit\token.dat" /e /g users:f
      1912

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (28 events)

Time & API	Arguments	Status	Return
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW Oct. 15, 2021, 6:09 p.m.	buffer: C:\Program Files (x86)\TimeLimit\TimeLimit.dat console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Oct. 15, 2021, 6:09 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW Oct. 15, 2021, 6:09 p.m.	buffer: C:\Program Files (x86)\TimeLimit\token.dat console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 15, 2021, 5:59 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 15, 2021, 6 p.m.	stacktrace: CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x766fd08c TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x766f964b TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x766e4d6b TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x766e6f7c CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x766ee825 TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x766e6002 TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x766e5fe8 TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x766e49e3 TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x766e5a20 RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x773d9a91 LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x773f8f10 RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x773f8e5c ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x75737a25 timelimitinst+0x351b @ 0x40351b exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25 exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4 exception.instruction: call dword ptr [ecx + 0xc] exception.module: MSCTF.dll exception.exception_code: 0xc0000005 exception.offset: 278260 exception.address: 0x76713ef4 registers.esp: 1637240 registers.edi: 0 registers.eax: 42830224 registers.ebp: 1637268 registers.edx: 1 registers.ebx: 0 registers.esi: 6028480 registers.ecx: 1917466076	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Oct. 15, 2021, 6 p.m.

stacktrace:

CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x766fd08c
TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x766f964b
TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x766e4d6b
TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x766e6f7c
CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x766ee825
TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x766e6002
TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x766e5fe8
TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x766e49e3
TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x766e5a20
RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x773d9a91
LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x773f8f10
RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x773f8e5c
ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x75737a25
timelimitinst+0x351b @ 0x40351b

exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25
exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4
exception.instruction: call dword ptr [ecx + 0xc]
exception.module: MSCTF.dll
exception.exception_code: 0xc0000005
exception.offset: 278260
exception.address: 0x76713ef4
registers.esp: 1637240
registers.edi: 0
registers.eax: 42830224
registers.ebp: 1637268
registers.edx: 1
registers.ebx: 0
registers.esi: 6028480
registers.ecx: 1917466076

Allocates read-write-execute memory (usually to unpack itself) (13 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 15, 2021, 5:59 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 5:59 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 5:59 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72801000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 5:59 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72721000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 5:59 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 5:59 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72722000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 5:59 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 6 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756a1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 15, 2021, 6:09 p.m.	process_identifier: 1048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 6:09 p.m.	process_identifier: 1048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73dd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 6:09 p.m.	process_identifier: 1048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d94000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 6:09 p.m.	process_identifier: 1048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73dd2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 15, 2021, 6:09 p.m.	process_identifier: 1048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72601000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Oct. 15, 2021, 6 p.m.	total_number_of_free_bytes: 13727694848 free_bytes_available: 13727694848 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0
GetDiskFreeSpaceExW Oct. 15, 2021, 6 p.m.	total_number_of_free_bytes: 13727694848 free_bytes_available: 13727694848 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\nss6357.tmp\InstallOptions.dll
file	C:\Program Files (x86)\TimeLimit\TimeLimit.exe
file	C:\Windows\System32\LogNotify.dll

Creates a suspicious process (2 events)

cmdline	C:\Windows\system32\cmd.exe /c cacls "C:\Program Files (x86)\TimeLimit\token.dat" /e /g users:f
cmdline	C:\Windows\system32\cmd.exe /c cacls "C:\Program Files (x86)\TimeLimit\TimeLimit.dat" /e /g users:f

Installs itself for autorun at Windows startup (6 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SamiApp	reg_value	C:\Program Files (x86)\TimeLimit\TimeLimit.exe \|
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\log32not\DLLName	reg_value	LogNotify.dll
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\log32not\Logon	reg_value	WlxEventLogon
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\log32not\Logoff	reg_value	WlxEventLogoff
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\log32not\Impersonate	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\log32not\Asynchronous	reg_value	1

Disables Windows' Task Manager (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr

File has been identified by 19 AntiVirus engines on VirusTotal as malicious (19 events)

Lionic	Trojan.Win32.WinlogonHook.4!c
MicroWorld-eScan	Gen:Trojan.WinlogonHook.NG0@aeXlZ3mO
McAfee	RDN/Generic
Cylance	Unsafe
Sangfor	Trojan.Win32.Heur.dmSfrmyLH@iG
BitDefender	Gen:Trojan.WinlogonHook.NG0@aeXlZ3mO
K7GW	Trojan ( 7000000f1 )
K7AntiVirus	Trojan ( 7000000f1 )
Arcabit	Trojan.WinlogonHook.EA411C
Avast	FileRepMalware
Emsisoft	Gen:Trojan.WinlogonHook.NG0@aeXlZ3mO (B)
FireEye	Gen:Trojan.WinlogonHook.NG0@aeXlZ3mO
MAX	malware (ai score=88)
Microsoft	Trojan:Win32/Rundis.gen!A
GData	Gen:Trojan.Heur.dmSfrmyLH@iG
ALYac	Gen:Trojan.Heur.dmSfrmyLH@iG
TrendMicro-HouseCall	TROJ_GEN.R002H09DR21
BitDefenderTheta	AI:Packer.E1C0F9971C
AVG	FileRepMalware

Uses suspicious command line tools or Windows utilities (4 events)

cmdline	C:\Windows\system32\cmd.exe /c cacls "C:\Program Files (x86)\TimeLimit\token.dat" /e /g users:f
cmdline	C:\Windows\system32\cmd.exe /c cacls "C:\Program Files (x86)\TimeLimit\TimeLimit.dat" /e /g users:f
cmdline	cacls "C:\Program Files (x86)\TimeLimit\token.dat" /e /g users:f
cmdline	cacls "C:\Program Files (x86)\TimeLimit\TimeLimit.dat" /e /g users:f

TimeLimitInst.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All