Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Dec. 26, 2022, 10:17 p.m.	Dec. 26, 2022, 10:22 p.m.

Size	1.5MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
MD5	`8b4ed76bdc73cfee76a35aaf5148867d`
SHA256	`81ede9a74a43e57f026c751c4b83780d2bd2a2ba81e0d0986f80158d431a44b1`
CRC32	`6380783C`
ssdeep	`24576:xt24rzHQNbDGv+3dixYmhZZ49GXB/7F0nFx4cM0Ud668h3upqaZ0GNZhd:tvX+NAYE89kF0McM0UdrpqY`
PDB Path	d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
Yara	IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file

zakrep.exe "C:\Users\test22\AppData\Local\Temp\zakrep.exe"
3020
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\RarSFX0\1.cmd" "
  1116
  - rundll32.exe rundll32 service.dll, dllmain
    2244
    - rundll32.exe rundll32 service.dll, dllmain
      776

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 26, 2022, 10:17 p.m.			0	0

Command line console output was observed (3 events)

Time & API	Arguments	Status	Return
WriteConsoleW Dec. 26, 2022, 10:17 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\RarSFX0> console_handle: 0x00000007	1	1
WriteConsoleW Dec. 26, 2022, 10:17 p.m.	buffer: rundll32 console_handle: 0x00000007	1	1
WriteConsoleW Dec. 26, 2022, 10:17 p.m.	buffer: service.dll, dllmain console_handle: 0x00000007	1	1

This executable has a PDB path (1 event)

pdb_path

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 26, 2022, 10:17 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 99 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74012000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cf3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74bb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x759f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74b91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007717a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077205000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077182000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077179000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007718a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000771f9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000771cb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007718e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000771bc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077186000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077172000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077186000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000771bc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007718c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077174000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077174000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077189000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077189000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007717e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007717d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000771bc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077181000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077179000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077192000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007717b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077187000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000771d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077191000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000771d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000771e0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077180000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000771cc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007717f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000771ba000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000771ba000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000771ff000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077171000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077172000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Dec. 26, 2022, 10:17 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000771bb000 process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\service.dll
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\1.cmd

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\1.cmd

zakrep.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All