Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 22, 2022, 10:02 a.m.	Nov. 22, 2022, 10:22 a.m.

Size	24.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`e3c9d895497ffded48073eee0295bea4`
SHA256	`b1256289d4aaada74a40b6ca52aa0d382b7660943ea31744486007653ee925ad`
CRC32	`741410F2`
ssdeep	`393216:vmnJPDpxSBQjE7v4/Gx3OajsPk/SRSu8LrB2KNIWHzQUfUKls0p8lzOoVty:WIBQjUSq3OLk/VjLt2m1Bs0pa/y`
Yara	Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file

install1.exe "C:\Users\test22\AppData\Local\Temp\install1.exe"
2548
- install1.tmp "C:\Users\test22\AppData\Local\Temp\is-VMT38.tmp\install1.tmp" /SL5="$80178,24626888,780800,C:\Users\test22\AppData\Local\Temp\install1.exe"
  2600
  - install1.exe "C:\Users\test22\AppData\Local\Temp\install1.exe" /SILENT
    2724
    - install1.tmp "C:\Users\test22\AppData\Local\Temp\is-VNHL8.tmp\install1.tmp" /SL5="$90178,24626888,780800,C:\Users\test22\AppData\Local\Temp\install1.exe" /SILENT
      2788
      - VC_redist.x64.exe "C:\Users\test22\AppData\Local\Temp\is-LDLQB.tmp\VC_redist.x64.exe" /install /quiet
        2856
        
        VC_redist.x64.exe "C:\Windows\Temp\{55142627-2B33-4F2F-9EBD-F1215C96F7E3}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\test22\AppData\Local\Temp\is-LDLQB.tmp\VC_redist.x64.exe" -burn.filehandle.attached=200 -burn.filehandle.self=208 /install /quiet
        2904
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Nov. 22, 2022, 10:02 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 22, 2022, 10:02 a.m.			0	0
IsDebuggerPresent Nov. 22, 2022, 10:02 a.m.			0	0
IsDebuggerPresent Nov. 22, 2022, 10:02 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 22, 2022, 10:02 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.itext
section	.didata

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Nov. 22, 2022, 10:02 a.m.	stacktrace: TMethodImplementationIntercept+0x1fa4b1 dbkFCallWrapperAddr-0x21337 install1+0x2b0309 @ 0x6b0309 TMethodImplementationIntercept+0x1fa4b1 dbkFCallWrapperAddr-0x21337 install1+0x2b0309 @ 0x6b0309 TMethodImplementationIntercept+0x20d8f7 dbkFCallWrapperAddr-0xdef1 install1+0x2c374f @ 0x6c374f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1637812 registers.edi: 6071344 registers.eax: 1637812 registers.ebp: 1637892 registers.edx: 0 registers.ebx: 0 registers.esi: 2 registers.ecx: 7	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Nov. 22, 2022, 10:02 a.m.

stacktrace:

TMethodImplementationIntercept+0x1fa4b1 dbkFCallWrapperAddr-0x21337 install1+0x2b0309 @ 0x6b0309
TMethodImplementationIntercept+0x1fa4b1 dbkFCallWrapperAddr-0x21337 install1+0x2b0309 @ 0x6b0309
TMethodImplementationIntercept+0x20d8f7 dbkFCallWrapperAddr-0xdef1 install1+0x2c374f @ 0x6c374f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1637812
registers.edi: 6071344
registers.eax: 1637812
registers.ebp: 1637892
registers.edx: 0
registers.ebx: 0
registers.esi: 2
registers.ecx: 7

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 22, 2022, 10:02 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 22, 2022, 10:02 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 745472 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 22, 2022, 10:02 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 22, 2022, 10:02 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 22, 2022, 10:02 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72dd2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 22, 2022, 10:02 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72dd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 22, 2022, 10:02 a.m.	process_identifier: 2600 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 22, 2022, 10:02 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 22, 2022, 10:02 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 745472 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 22, 2022, 10:02 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 22, 2022, 10:02 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 22, 2022, 10:02 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73452000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 22, 2022, 10:02 a.m.	process_identifier: 2788 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73452000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 22, 2022, 10:02 a.m.	process_identifier: 2788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02290000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 22, 2022, 10:02 a.m.	process_identifier: 2904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73452000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Windows\Temp\{7FC5A12B-2BEF-4B42-99E9-FF1E87D995A1}\.ba\wixstdba.dll
file	C:\Windows\Temp\{55142627-2B33-4F2F-9EBD-F1215C96F7E3}\.cr\VC_redist.x64.exe

Drops a binary and executes it (1 event)

file	C:\Windows\Temp\{55142627-2B33-4F2F-9EBD-F1215C96F7E3}\.cr\VC_redist.x64.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-VMT38.tmp\install1.tmp

File has been identified by 3 AntiVirus engines on VirusTotal as malicious (3 events)

K7AntiVirus	Trojan ( 0059a7651 )
K7GW	Trojan ( 0059a7651 )
Webroot	W32.Malware.Gen

Queries for potentially installed applications (4 events)

Time & API	Arguments	Return
RegOpenKeyExW Nov. 22, 2022, 10:02 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{4EEBA74F-4BD2-444F-A5F5-ACB269AD2DF6}_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000101 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4EEBA74F-4BD2-444F-A5F5-ACB269AD2DF6}_is1	2
RegOpenKeyExW Nov. 22, 2022, 10:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d4cecf3b-b68f-4995-8840-52ea0fab646e} base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d4cecf3b-b68f-4995-8840-52ea0fab646e}	2
RegOpenKeyExW Nov. 22, 2022, 10:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d4cecf3b-b68f-4995-8840-52ea0fab646e}.RebootRequired base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d4cecf3b-b68f-4995-8840-52ea0fab646e}.RebootRequired	2
RegOpenKeyExW Nov. 22, 2022, 10:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d4cecf3b-b68f-4995-8840-52ea0fab646e} base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d4cecf3b-b68f-4995-8840-52ea0fab646e}	2

install1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All