Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 1, 2021, 11:32 a.m.	Nov. 1, 2021, 11:40 a.m.

Size	215.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`eea1c3d1ab9dd50b3dae826b35c8b138`
SHA256	`7e148999439b83e74d823e98f7a82e4bd75d5e259e4c6351aabbb446eb9dfcc8`
CRC32	`5C48788E`
ssdeep	`6144:lRqUj7H4qyEcBDcUGi9ghYW2bGj9Gz+NpYg5iYI5Lw6/30iEtE/6uz6HgNQHJxWU:lRq47H/tcBDcUG6ghSW9GiNpYJYI5U6M`
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library

instd.exe "C:\Users\test22\AppData\Local\Temp\instd.exe"
1896
- instd.exe "C:\Program Files (x86)\GnomeUpdate\instd.exe"
  2616
- schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC ONLOGON /TN "instd.exe" /TR "'C:\Program Files (x86)\GnomeUpdate\instd.exe'" /RL HIGHEST /F
  2684

Name	Response	Post-Analysis Lookup
mas.to	A 88.99.75.82	88.99.75.82

IP Address	Status	Action
164.124.101.2	Active	Moloch
88.99.75.82	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:53893 -> 164.124.101.2:53	2027757	ET DNS Query for .to TLD	Potentially Bad Traffic
UDP 192.168.56.103:53893 -> 8.8.8.8:53	2027757	ET DNS Query for .to TLD	Potentially Bad Traffic
TCP 192.168.56.103:49172 -> 88.99.75.82:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 88.99.75.82:443 -> 192.168.56.103:49174	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49173 -> 88.99.75.82:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Nov. 1, 2021, 11:32 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Nov. 1, 2021, 11:32 a.m.	buffer: SUCCESS: The scheduled task "instd.exe" has successfully been created. console_handle: 0x00000007	1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Nov. 1, 2021, 11:32 a.m.	stacktrace: 0x4e21b3 0x4e22da 0x4e2ca6 0x4e2d4e 0x4e00d0 instd+0x12fa @ 0x8512fa instd+0x2e528 @ 0x87e528 instd+0x2e9e8 @ 0x87e9e8 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 0f be 02 50 8b 4d 0c 51 e8 7b ff ff ff 83 c4 08 exception.instruction: movsx eax, byte ptr [edx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4e4668 registers.esp: 3327096 registers.edi: 4980736 registers.eax: 7 registers.ebp: 3327096 registers.edx: 7 registers.ebx: 4980736 registers.esi: 5111808 registers.ecx: 7	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 1, 2021, 11:32 a.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00200000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 11:32 a.m.	process_identifier: 1896 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00260000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 11:32 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 28672 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00260000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 11:32 a.m.	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 11:32 a.m.	process_identifier: 2616 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 11:32 a.m.	process_identifier: 2616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 28672 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e0000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Program Files (x86)\GnomeUpdate\instd.exe

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC ONLOGON /TN "instd.exe" /TR "'C:\Program Files (x86)\GnomeUpdate\instd.exe'" /RL HIGHEST /F
cmdline	schtasks.exe /Create /SC ONLOGON /TN "instd.exe" /TR "'C:\Program Files (x86)\GnomeUpdate\instd.exe'" /RL HIGHEST /F

Drops a binary and executes it (1 event)

file	C:\Program Files (x86)\GnomeUpdate\instd.exe

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Nov. 1, 2021, 11:32 a.m.	show_type: 0 filepath_r: C:\Program Files (x86)\GnomeUpdate\instd.exe parameters: filepath: C:\Program Files (x86)\GnomeUpdate\instd.exe	1	1	0
ShellExecuteExW Nov. 1, 2021, 11:32 a.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /SC ONLOGON /TN "instd.exe" /TR "'C:\Program Files (x86)\GnomeUpdate\instd.exe'" /RL HIGHEST /F filepath: schtasks.exe	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (35 events)

Time & API	Arguments	Status	Return
Process32FirstW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: [System Process] process_identifier: 0	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: System process_identifier: 4	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: smss.exe process_identifier: 232	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: csrss.exe process_identifier: 312	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: wininit.exe process_identifier: 340	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: csrss.exe process_identifier: 360	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: winlogon.exe process_identifier: 404	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: services.exe process_identifier: 440	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: lsass.exe process_identifier: 456	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: lsm.exe process_identifier: 464	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 572	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 652	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 716	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 792	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 836	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: audiodg.exe process_identifier: 896	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 988	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 348	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: spoolsv.exe process_identifier: 1032	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 1084	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: taskhost.exe process_identifier: 1152	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 1372	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: sppsvc.exe process_identifier: 1676	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 1748	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: dwm.exe process_identifier: 1900	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: explorer.exe process_identifier: 1924	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: pw.exe process_identifier: 2016	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: SearchIndexer.exe process_identifier: 1180	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: SearchProtocolHost.exe process_identifier: 740	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: SearchFilterHost.exe process_identifier: 1124	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: mobsync.exe process_identifier: 2888	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: pw.exe process_identifier: 2936	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: taskhost.exe process_identifier: 3024	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: SearchProtocolHost.exe process_identifier: 2328	1	1
Process32NextW Nov. 1, 2021, 11:32 a.m.	snapshot_handle: 0x000000b8 process_name: instd.exe process_identifier: 1896	1	1

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00007000', u'virtual_address': u'0x00031000', u'entropy': 7.475501102117054, u'name': u'.rsrc', u'virtual_size': u'0x00006e9e'}

entropy

7.47550110212

description

A section with a high entropy has been found

Expresses interest in specific running processes (1 event)

process

instd.exe

Yara rule detected in process memory (19 events)

description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	task schedule	rule	schtasks_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC ONLOGON /TN "instd.exe" /TR "'C:\Program Files (x86)\GnomeUpdate\instd.exe'" /RL HIGHEST /F
cmdline	schtasks.exe /Create /SC ONLOGON /TN "instd.exe" /TR "'C:\Program Files (x86)\GnomeUpdate\instd.exe'" /RL HIGHEST /F

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 2e105a47fd0932aa44bf2277f44e380e64f5d3d5

Installs itself for autorun at Windows startup (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC ONLOGON /TN "instd.exe" /TR "'C:\Program Files (x86)\GnomeUpdate\instd.exe'" /RL HIGHEST /F
cmdline	schtasks.exe /Create /SC ONLOGON /TN "instd.exe" /TR "'C:\Program Files (x86)\GnomeUpdate\instd.exe'" /RL HIGHEST /F

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1896 resumed a thread in remote process 2616
Process injection	Process 1896 resumed a thread in remote process 2684
NtResumeThread Nov. 1, 2021, 11:32 a.m.	thread_handle: 0x00000200 suspend_count: 1 process_identifier: 2616	1	0	0
NtResumeThread Nov. 1, 2021, 11:32 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 2684	1	0	0

Generates some ICMP traffic

File has been identified by 42 AntiVirus engines on VirusTotal as malicious (42 events)

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Malicious.4!c
Elastic	malicious (high confidence)
McAfee	Artemis!EEA1C3D1AB9D
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 00584baa1 )
BitDefender	Gen:Heur.ZOF.2
K7GW	Riskware ( 00584baa1 )
Cybereason	malicious.1ab9dd
Arcabit	Trojan.ZOF.2
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Generik.HOTRTHM
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Zenpak.gen
MicroWorld-eScan	Gen:Heur.ZOF.2
Avast	Win32:Malware-gen
Ad-Aware	Gen:Heur.ZOF.2
Emsisoft	Gen:Heur.ZOF.2 (B)
McAfee-GW-Edition	BehavesLike.Win32.Upatre.dm
FireEye	Generic.mg.eea1c3d1ab9dd50b
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Avira	TR/Dropper.Gen
MAX	malware (ai score=82)
Gridinsoft	Ransom.Win32.Sabsik.vb
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	HEUR:Trojan.Win32.Zenpak.gen
GData	Gen:Heur.ZOF.2
VBA32	BScope.TrojanSpy.Mufila
ALYac	Gen:Heur.ZOF.2
Malwarebytes	MachineLearning/Anomalous.95%
TrendMicro-HouseCall	TROJ_GEN.R002H07JU21
Rising	Trojan.Generic@ML.89 (RDMK:5Mo5Q4NVKDVk0zFMidBEzQ)
eGambit	Unsafe.AI_Score_80%
Fortinet	W32/PossibleThreat
BitDefenderTheta	AI:Packer.87110F6C1F
AVG	Win32:Malware-gen
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_70% (W)

instd.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All