Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 20, 2022, 2:08 p.m.	May 20, 2022, 2:21 p.m.

Size	703.4KB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`a1128f30ff8209aa2a2d414e6da4076f`
SHA256	`64ce95ae24281b52d627bb4757c0c816170b865ae9c23e9642e72fefebef1dff`
CRC32	`6F4E373F`
ssdeep	`12288:e6PAqtyGLbFSccQdITR6eaFeA/sIrPA+ApmqB11cVKjLPdz:rwGXBBWTTaFeA/sIrPAD4qB1KQz`
Yara	IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

updated.exe "C:\Users\test22\AppData\Local\Temp\updated.exe"
2832
- AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2936

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 20, 2022, 2:08 p.m.			0	0
IsDebuggerPresent May 20, 2022, 2:08 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 20, 2022, 2:08 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (5 events)

section	SrSLt
section	EY8VhRz
section	WkrYta
section	gFnKa
section	yntboc

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (23 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2832 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2832 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d92000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73472000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e1b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00462000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d1a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0069a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00697000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

AppLaunch.exe tried to sleep 176 seconds, actually delayed analysis time by 176 seconds

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 3d16d77279ec8a6460c3b59808940c7e372f3e3a

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000114	1	0	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory May 20, 2022, 2:08 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2936 process_handle: 0x00000114	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2832 called NtSetContextThread to modify thread in remote process 2936
NtSetContextThread May 20, 2022, 2:08 p.m.	registers.eip: 2003108292 registers.esp: 2882208 registers.edi: 0 registers.eax: 4211902 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000110 process_identifier: 2936	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2832 resumed a thread in remote process 2936
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2936	1	0	0

Executed a process and injected code into it, probably while unpacking (50 out of 69 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW May 20, 2022, 2:08 p.m.	thread_identifier: 2940 thread_handle: 0x00000110 process_identifier: 2936 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000114	1	1
NtGetContextThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000110	1	0
NtAllocateVirtualMemory May 20, 2022, 2:08 p.m.	process_identifier: 2936 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000114	1	0
WriteProcessMemory May 20, 2022, 2:08 p.m.	buffer: base_address: 0x00400000 process_identifier: 2936 process_handle: 0x00000114	1	1
WriteProcessMemory May 20, 2022, 2:08 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2936 process_handle: 0x00000114	1	1
NtSetContextThread May 20, 2022, 2:08 p.m.	registers.eip: 2003108292 registers.esp: 2882208 registers.edi: 0 registers.eax: 4211902 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000110 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000184 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x000001fc suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000238 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000290 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000300 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000318 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000330 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000348 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000360 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000378 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000390 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x000003ac suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x000003c4 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x000003dc suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x000003f4 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000414 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x0000042c suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000440 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000458 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000470 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000488 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x000004a0 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x000004b8 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x000004d0 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x000004e8 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000500 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000518 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000530 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000548 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:08 p.m.	thread_handle: 0x00000560 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:09 p.m.	thread_handle: 0x0000057c suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:09 p.m.	thread_handle: 0x00000594 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:09 p.m.	thread_handle: 0x000005b0 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:09 p.m.	thread_handle: 0x000005c8 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:09 p.m.	thread_handle: 0x000005e0 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:09 p.m.	thread_handle: 0x000005f8 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:09 p.m.	thread_handle: 0x00000608 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:09 p.m.	thread_handle: 0x00000620 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:09 p.m.	thread_handle: 0x00000638 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:09 p.m.	thread_handle: 0x00000650 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:09 p.m.	thread_handle: 0x00000668 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread May 20, 2022, 2:09 p.m.	thread_handle: 0x00000680 suspend_count: 1 process_identifier: 2936	1	0

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Injuke.4!c
DrWeb	Trojan.Inject4.32014
MicroWorld-eScan	Gen:Variant.Ser.Lazy.929
FireEye	Gen:Variant.Ser.Lazy.929
McAfee	GenericRXSW-LV!A1128F30FF82
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005916431 )
Alibaba	Trojan:Win32/PSWStealer.0b7b7369
K7GW	Trojan ( 005916431 )
Arcabit	Trojan.Ser.Lazy.929
BitDefenderTheta	Gen:NN.ZexaF.34682.RuY@aia1Snd
Cyren	W32/Kryptik.GOC.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.HPFH
Paloalto	generic.ml
ClamAV	Win.Trojan.Fragtor-9943708-0
Kaspersky	HEUR:Trojan.Win32.Injuke.gen
BitDefender	Gen:Variant.Ser.Lazy.929
Avast	Win32:PWSX-gen [Trj]
Tencent	Win32.Trojan.Falsesign.Lify
Ad-Aware	Gen:Variant.Ser.Lazy.929
Sophos	Mal/Generic-S
TrendMicro	TrojanSpy.Win32.AZORULT.YXCEPZ
McAfee-GW-Edition	GenericRXSW-LV!A1128F30FF82
Emsisoft	Gen:Variant.Ser.Lazy.929 (B)
Ikarus	Trojan.Win32.Crypt
Jiangmin	TrojanSpy.Stealer.uda
Webroot	W32.Trojan.Gen
Avira	TR/Crypt.Agent.tctlg
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Heur!.00002031
Microsoft	Trojan:Win32/PSWStealer.FV!MTB
ViRobot	Trojan.Win32.Z.Ser.720312
ZoneAlarm	HEUR:Trojan.Win32.Injuke.gen
GData	Gen:Variant.Ser.Lazy.929
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R492451
VBA32	BScope.TrojanSpy.Stealer
ALYac	Gen:Variant.Ser.Lazy.929
MAX	malware (ai score=84)
Malwarebytes	Trojan.Dropper
TrendMicro-HouseCall	TrojanSpy.Win32.AZORULT.YXCEPZ
Rising	Stealer.Agent!8.C2 (CLOUD)
MaxSecure	Trojan.Malware.74209402.susgen
Fortinet	W32/Kryptik.HPFH!tr
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/Genetic.gen

updated.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All