Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 26, 2022, 8:23 a.m.	March 26, 2022, 8:25 a.m.

Size	884.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`4685811c853ceaebc991c3a8406694bf`
SHA256	`3242e0a736ef8ac90430a9f272ff30a81e2afc146fcb84a25c6e56e8192791e4`
CRC32	`9EF750F5`
ssdeep	`12288:oo6hrwBWQ1Ow8yPcT3ZinffOqJaFLGRTY7c223KmZaQRDSGEi:oo6dwBTj9U1wffO7FLG5Y7K3KmZ0GEi`
Yara	Malicious_Packer_Zero - Malicious Packer Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE32 - (no description)

uL1Ti1AagGYxw4OTxpJ5cSKaaa.exe "C:\Users\test22\AppData\Local\Temp\uL1Ti1AagGYxw4OTxpJ5cSKaaa.exe"
2176

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 26, 2022, 8:23 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 26, 2022, 8:23 a.m.	stacktrace: CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x75e8d08c TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x75e8964b TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x75e74d6b TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x75e76f7c CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x75e7e825 TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x75e76002 TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x75e75fe8 TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x75e749e3 TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x75e75a20 RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x77869a91 LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77888f10 RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77888e5c ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x75097a25 ul1ti1aaggyxw4otxpj5cskaaa+0x988da @ 0x4988da ul1ti1aaggyxw4otxpj5cskaaa+0x98b06 @ 0x498b06 ul1ti1aaggyxw4otxpj5cskaaa+0x98b2c @ 0x498b2c ul1ti1aaggyxw4otxpj5cskaaa+0x9b7ab @ 0x49b7ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25 exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4 exception.instruction: call dword ptr [ecx + 0xc] exception.module: MSCTF.dll exception.exception_code: 0xc0000005 exception.offset: 278260 exception.address: 0x75ea3ef4 registers.esp: 9370656 registers.edi: 0 registers.eax: 53604960 registers.ebp: 9370684 registers.edx: 1 registers.ebx: 0 registers.esi: 11503232 registers.ecx: 1948923604	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

March 26, 2022, 8:23 a.m.

stacktrace:

CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x75e8d08c
TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x75e8964b
TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x75e74d6b
TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x75e76f7c
CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x75e7e825
TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x75e76002
TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x75e75fe8
TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x75e749e3
TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x75e75a20
RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x77869a91
LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77888f10
RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77888e5c
ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x75097a25
ul1ti1aaggyxw4otxpj5cskaaa+0x988da @ 0x4988da
ul1ti1aaggyxw4otxpj5cskaaa+0x98b06 @ 0x498b06
ul1ti1aaggyxw4otxpj5cskaaa+0x98b2c @ 0x498b2c
ul1ti1aaggyxw4otxpj5cskaaa+0x9b7ab @ 0x49b7ab
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25
exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4
exception.instruction: call dword ptr [ecx + 0xc]
exception.module: MSCTF.dll
exception.exception_code: 0xc0000005
exception.offset: 278260
exception.address: 0x75ea3ef4
registers.esp: 9370656
registers.edi: 0
registers.eax: 53604960
registers.ebp: 9370684
registers.edx: 1
registers.ebx: 0
registers.esi: 11503232
registers.ecx: 1948923604

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 26, 2022, 8:23 a.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74273000 process_handle: 0xffffffff	1	0	0

File has been identified by 3 AntiVirus engines on VirusTotal as malicious (3 events)

Bkav	W32.AIDetect.malware2
APEX	Malicious
MaxSecure	Trojan.Malware.300983.susgen

uL1Ti1AagGYxw4OTxpJ5cSKaaa

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All