Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 1, 2021, 10:28 a.m.	Nov. 1, 2021, 10:50 a.m.

Size	929.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`b10006163a7219e99b2049a680226d2a`
SHA256	`166f42d9f5a77471c3537ad00e246c4e58e7e9b113e248799cd938467b2dddfc`
CRC32	`16D91164`
ssdeep	`24576:KAOcZwXYQpJWTMTYMer8cn+BP1dHO3453ioO2R/YzVW:wNPWdr9GHOo5vOqt`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

B-Server.exe "C:\Users\test22\AppData\Local\Temp\B-Server.exe"
2088
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\RarSFX0\doubtfulnesses.bat" "
  2244
  - predebate.exe predebate.exe -p"mvaazhtryyrpekuskaihnhtnmvhran"
    2744
    - belated.exe "C:\Users\test22\AppData\Local\Temp\RarSFX1\belated.exe"
      656

Name	Response	Post-Analysis Lookup
cdn.discordapp.com	A 162.159.135.233 A 162.159.134.233 A 162.159.129.233 A 162.159.130.233 A 162.159.133.233	162.159.134.233

IP Address	Status	Action
162.159.133.233	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49204 -> 162.159.133.233:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.101:49204 162.159.133.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	54:e1:a7:9d:cc:c8:60:86:f1:a5:da:74:0e:5a:ab:45:df:37:8a:78

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 1, 2021, 10:28 a.m.			0	0
IsDebuggerPresent Nov. 1, 2021, 10:28 a.m.			0	0

Command line console output was observed (12 events)

Time & API	Arguments	Status	Return
WriteConsoleW Nov. 1, 2021, 10:28 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\RarSFX0> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 1, 2021, 10:28 a.m.	buffer: REM console_handle: 0x00000007	1	1
WriteConsoleW Nov. 1, 2021, 10:28 a.m.	buffer: ;tealike curative sorn fingerboards seleniums witchings mugwort patinates vittle console_handle: 0x00000007	1	1
WriteConsoleW Nov. 1, 2021, 10:28 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\RarSFX0> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 1, 2021, 10:28 a.m.	buffer: REM console_handle: 0x00000007	1	1
WriteConsoleW Nov. 1, 2021, 10:28 a.m.	buffer: ;eagerness whetters raddled aerophyte presentnesses scruff rotguts forints doted console_handle: 0x00000007	1	1
WriteConsoleW Nov. 1, 2021, 10:28 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\RarSFX0> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 1, 2021, 10:28 a.m.	buffer: REM console_handle: 0x00000007	1	1
WriteConsoleW Nov. 1, 2021, 10:28 a.m.	buffer: ;capitalized chignon thiosulfates azons mayan lorimers thuja squirearchies mediacies outboasting console_handle: 0x00000007	1	1
WriteConsoleW Nov. 1, 2021, 10:28 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\RarSFX0> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 1, 2021, 10:28 a.m.	buffer: predebate.exe console_handle: 0x00000007	1	1
WriteConsoleW Nov. 1, 2021, 10:28 a.m.	buffer: -p"mvaazhtryyrpekuskaihnhtnmvhran" console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (12 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 1, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00667d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00667d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00667d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00667d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00667df8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00667df8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00667cf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00667cf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00667cf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00667cf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00667db8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 1, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00667db8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 1, 2021, 10:28 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Nov. 1, 2021, 10:28 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x70711194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x705e2ba1 mscorlib+0x2f45a5 @ 0x6f8945a5 mscorlib+0x2f46fc @ 0x6f8946fc mscorlib+0x2f4688 @ 0x6f894688 0x5f03ad 0x5f00d7 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x706274ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x70627610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x706b1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x706b1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x706b1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x706b416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7234f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x723c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x723c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 3402524 registers.edi: 0 registers.eax: 3402524 registers.ebp: 3402604 registers.edx: 0 registers.ebx: 7421480 registers.esi: 6586280 registers.ecx: 4075712161	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Nov. 1, 2021, 10:28 a.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x70711194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x705e2ba1
mscorlib+0x2f45a5 @ 0x6f8945a5
mscorlib+0x2f46fc @ 0x6f8946fc
mscorlib+0x2f4688 @ 0x6f894688
0x5f03ad
0x5f00d7
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x706274ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x70627610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x706b1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x706b1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x706b1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x706b416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7234f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x723c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x723c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3402524
registers.edi: 0
registers.eax: 3402524
registers.ebp: 3402604
registers.edx: 0
registers.ebx: 7421480
registers.esi: 6586280
registers.ecx: 4075712161

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET https://cdn.discordapp.com/attachments/893177342426509335/903573549502070855/0310EDB8.jpg
suspicious_features	GET method with no useragent header	suspicious_request	GET https://cdn.discordapp.com/attachments/893177342426509335/903573552630997002/7318C9C6.jpg
suspicious_features	GET method with no useragent header	suspicious_request	GET https://cdn.discordapp.com/attachments/893177342426509335/903573555021754378/CA9F2980.jpg

Performs some HTTP requests (3 events)

request	GET https://cdn.discordapp.com/attachments/893177342426509335/903573549502070855/0310EDB8.jpg
request	GET https://cdn.discordapp.com/attachments/893177342426509335/903573552630997002/7318C9C6.jpg
request	GET https://cdn.discordapp.com/attachments/893177342426509335/903573555021754378/CA9F2980.jpg

Allocates read-write-execute memory (usually to unpack itself) (21 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x728c2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x728c2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00720000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70561000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70562000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c40000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00db0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00392000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0039a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0039c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 10:28 a.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\RarSFX1\belated.exe
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\predebate.exe
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\doubtfulnesses.bat

Drops a binary and executes it (3 events)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\doubtfulnesses.bat
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\predebate.exe
file	C:\Users\test22\AppData\Local\Temp\RarSFX1\belated.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\predebate.exe
file	C:\Users\test22\AppData\Local\Temp\RarSFX1\belated.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Nov. 1, 2021, 10:28 a.m.	flags: 15 family: 0		111	0

B-Server.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All