Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Nov. 1, 2021, 5:58 p.m.	Nov. 1, 2021, 5:59 p.m.

Size	215.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`eea1c3d1ab9dd50b3dae826b35c8b138`
SHA256	`7e148999439b83e74d823e98f7a82e4bd75d5e259e4c6351aabbb446eb9dfcc8`
CRC32	`5C48788E`
ssdeep	`6144:lRqUj7H4qyEcBDcUGi9ghYW2bGj9Gz+NpYg5iYI5Lw6/30iEtE/6uz6HgNQHJxWU:lRq47H/tcBDcUG6ghSW9GiNpYJYI5U6M`
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library

instd.exe "C:\Users\test22\AppData\Local\Temp\instd.exe"
2424
- instd.exe "C:\Program Files (x86)\GnomeUpdate\instd.exe"
  2040
- schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC ONLOGON /TN "instd.exe" /TR "'C:\Program Files (x86)\GnomeUpdate\instd.exe'" /RL HIGHEST /F
  1544

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Nov. 1, 2021, 5:58 p.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Nov. 1, 2021, 5:58 p.m.	buffer: SUCCESS: The scheduled task "instd.exe" has successfully been created. console_handle: 0x00000007	1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 1, 2021, 5:58 p.m.	process_identifier: 2424 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00490000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 5:58 p.m.	process_identifier: 2424 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 5:58 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 28672 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 5:58 p.m.	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00210000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 1, 2021, 5:58 p.m.	process_identifier: 2040 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00370000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 5:58 p.m.	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 28672 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00370000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Program Files (x86)\GnomeUpdate\instd.exe

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC ONLOGON /TN "instd.exe" /TR "'C:\Program Files (x86)\GnomeUpdate\instd.exe'" /RL HIGHEST /F
cmdline	schtasks.exe /Create /SC ONLOGON /TN "instd.exe" /TR "'C:\Program Files (x86)\GnomeUpdate\instd.exe'" /RL HIGHEST /F

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Nov. 1, 2021, 5:58 p.m.	show_type: 0 filepath_r: C:\Program Files (x86)\GnomeUpdate\instd.exe parameters: filepath: C:\Program Files (x86)\GnomeUpdate\instd.exe	1	1	0
ShellExecuteExW Nov. 1, 2021, 5:58 p.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /SC ONLOGON /TN "instd.exe" /TR "'C:\Program Files (x86)\GnomeUpdate\instd.exe'" /RL HIGHEST /F filepath: schtasks.exe	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (37 events)

Time & API	Arguments	Status	Return
Process32FirstW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: [System Process] process_identifier: 0	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: System process_identifier: 4	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: smss.exe process_identifier: 228	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: csrss.exe process_identifier: 304	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: wininit.exe process_identifier: 352	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: csrss.exe process_identifier: 364	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: winlogon.exe process_identifier: 408	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: services.exe process_identifier: 444	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: lsass.exe process_identifier: 460	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: lsm.exe process_identifier: 468	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 572	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 640	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 712	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 780	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 816	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: audiodg.exe process_identifier: 892	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 984	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 368	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: spoolsv.exe process_identifier: 728	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 1052	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: taskhost.exe process_identifier: 1136	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: dwm.exe process_identifier: 1224	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: explorer.exe process_identifier: 1264	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 1360	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: IMEDICTUPDATE.EXE process_identifier: 1456	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: svchost.exe process_identifier: 1904	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: SearchIndexer.exe process_identifier: 1100	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: WmiPrvSE.exe process_identifier: 2640	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: pw.exe process_identifier: 2916	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: mobsync.exe process_identifier: 2728	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: tvnserver.exe process_identifier: 1568	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: tvnserver.exe process_identifier: 880	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: pw.exe process_identifier: 1628	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: taskhost.exe process_identifier: 2964	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: SearchProtocolHost.exe process_identifier: 2948	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: SearchFilterHost.exe process_identifier: 2664	1	1
Process32NextW Nov. 1, 2021, 5:58 p.m.	snapshot_handle: 0x000000b8 process_name: instd.exe process_identifier: 2424	1	1

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00007000', u'virtual_address': u'0x00031000', u'entropy': 7.475501102117054, u'name': u'.rsrc', u'virtual_size': u'0x00006e9e'}

entropy

7.47550110212

description

A section with a high entropy has been found

Expresses interest in specific running processes (1 event)

process

instd.exe

Yara rule detected in process memory (19 events)

description	task schedule	rule	schtasks_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC ONLOGON /TN "instd.exe" /TR "'C:\Program Files (x86)\GnomeUpdate\instd.exe'" /RL HIGHEST /F
cmdline	schtasks.exe /Create /SC ONLOGON /TN "instd.exe" /TR "'C:\Program Files (x86)\GnomeUpdate\instd.exe'" /RL HIGHEST /F

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 2e105a47fd0932aa44bf2277f44e380e64f5d3d5

Installs itself for autorun at Windows startup (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC ONLOGON /TN "instd.exe" /TR "'C:\Program Files (x86)\GnomeUpdate\instd.exe'" /RL HIGHEST /F
cmdline	schtasks.exe /Create /SC ONLOGON /TN "instd.exe" /TR "'C:\Program Files (x86)\GnomeUpdate\instd.exe'" /RL HIGHEST /F

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2424 resumed a thread in remote process 2040
Process injection	Process 2424 resumed a thread in remote process 1544
NtResumeThread Nov. 1, 2021, 5:58 p.m.	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 2040	1	0	0
NtResumeThread Nov. 1, 2021, 5:58 p.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 1544	1	0	0

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 events)

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Malicious.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Heur.ZOF.2
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 00584baa1 )
K7GW	Riskware ( 00584baa1 )
Cybereason	malicious.1ab9dd
Arcabit	Trojan.ZOF.2
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Generik.HOTRTHM
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Zenpak.gen
BitDefender	Gen:Heur.ZOF.2
MicroWorld-eScan	Gen:Heur.ZOF.2
Avast	Win32:Malware-gen
Ad-Aware	Gen:Heur.ZOF.2
Sophos	Mal/Generic-S
Comodo	.UnclassifiedMalware@0
McAfee-GW-Edition	BehavesLike.Win32.Upatre.dm
FireEye	Generic.mg.eea1c3d1ab9dd50b
Emsisoft	Gen:Heur.ZOF.2 (B)
Ikarus	Trojan.SuspectCRC
Avira	TR/Dropper.Gen
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Ransom.Win32.Sabsik.vb
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	HEUR:Trojan.Win32.Zenpak.gen
GData	Gen:Heur.ZOF.2
McAfee	Artemis!EEA1C3D1AB9D
MAX	malware (ai score=100)
VBA32	BScope.TrojanSpy.Mufila
Malwarebytes	MachineLearning/Anomalous.95%
TrendMicro-HouseCall	TROJ_GEN.R002H07JU21
Rising	Trojan.Generic@ML.89 (RDMK:5Mo5Q4NVKDVk0zFMidBEzQ)
Yandex	Trojan.Zenpak!ns9gDCep0oM
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_80%
Fortinet	W32/PossibleThreat
BitDefenderTheta	AI:Packer.87110F6C1F
AVG	Win32:Malware-gen
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_70% (W)

instd.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All