Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Feb. 21, 2023, 7:56 a.m.	Feb. 21, 2023, 7:58 a.m.

Size	367.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`4813bbedfb4ac4c6b9819c3e0b09ae4c`
SHA256	`e2fceae16b2385a8e596aea841a593482101741ab8f1a3344b95d001dd9ea0e6`
CRC32	`18444BA6`
ssdeep	`6144:rGihL1FoUe/5kNiSxj+ProHMJV2gBLOqxIPdZanPkfTPW/XvFarSVkXkfMN:JoO+PM4tp9xIPdZaPkqn5kXkfY`
Yara	IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file

aloe.exe "C:\Users\test22\AppData\Local\Temp\aloe.exe"
2568
cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "images" /tr '"C:\Users\test22\AppData\Roaming\images.exe"' & exit
3008
- schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "images" /tr '"C:\Users\test22\AppData\Roaming\images.exe"'
  2088
cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\tmpADBF.tmp.bat""
3060
- timeout.exe timeout 3
  2116
- images.exe "C:\Users\test22\AppData\Roaming\images.exe"
  2212

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.19.85.136	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Feb. 21, 2023, 7:57 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Feb. 21, 2023, 7:57 a.m.	buffer: The batch file cannot be found. console_handle: 0x0000000b	1	1	0
WriteConsoleW Feb. 21, 2023, 7:57 a.m.	buffer: SUCCESS: The scheduled task "images" has successfully been created. console_handle: 0x00000007	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 21, 2023, 7:56 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Feb. 21, 2023, 7:56 a.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73342000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Feb. 21, 2023, 7:57 a.m.	process_identifier: 2212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73282000 process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\nsgBD31.tmp\jaizf.dll
file	C:\Users\test22\AppData\Local\Temp\nsqEFDF.tmp\jaizf.dll

Creates a suspicious process (1 event)

cmdline

schtasks /create /f /sc onlogon /rl highest /tn "images" /tr '"C:\Users\test22\AppData\Roaming\images.exe"'

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Roaming\images.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Roaming\images.exe
file	C:\Users\test22\AppData\Local\Temp\nsgBD31.tmp\jaizf.dll

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://nsis.sf.net/NSIS_Error

Yara rule detected in process memory (32 events)

description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Take ScreenShot	rule	ScreenShot
description	Communications use DNS	rule	Network_DNS
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Steal credential	rule	local_credential_Steal
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win
description	File Downloader	rule	Network_Downloader
description	Escalate priviledges	rule	Escalate_priviledges
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communications over FTP	rule	Network_FTP
description	Match Windows Http API call	rule	Str_Win32_Http_API

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

schtasks /create /f /sc onlogon /rl highest /tn "images" /tr '"C:\Users\test22\AppData\Roaming\images.exe"'

Communicates with host for which no DNS query was performed (1 event)

host

185.19.85.136

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Feb. 21, 2023, 7:56 a.m.	process_identifier: 2676 region_size: 307200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000200	1	0	0
NtAllocateVirtualMemory Feb. 21, 2023, 7:57 a.m.	process_identifier: 2328 region_size: 307200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000204	1	0	0

Installs itself for autorun at Windows startup (1 event)

cmdline

schtasks /create /f /sc onlogon /rl highest /tn "images" /tr '"C:\Users\test22\AppData\Roaming\images.exe"'

Manipulates memory of a non-child process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2568 manipulating memory of non-child process 2676
Process injection	Process 2212 manipulating memory of non-child process 2328
NtAllocateVirtualMemory Feb. 21, 2023, 7:56 a.m.	process_identifier: 2676 region_size: 307200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000200	1	0	0
NtAllocateVirtualMemory Feb. 21, 2023, 7:57 a.m.	process_identifier: 2328 region_size: 307200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000204	1	0	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2568 called NtSetContextThread to modify thread in remote process 2676
Process injection	Process 2212 called NtSetContextThread to modify thread in remote process 2328
NtSetContextThread Feb. 21, 2023, 7:56 a.m.	registers.eip: 1995571652 registers.esp: 1638384 registers.edi: 0 registers.eax: 4200587 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001fc process_identifier: 2676	1	0	0
NtSetContextThread Feb. 21, 2023, 7:57 a.m.	registers.eip: 1995571652 registers.esp: 1638384 registers.edi: 0 registers.eax: 4200587 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000200 process_identifier: 2328	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3060 resumed a thread in remote process 2212
NtResumeThread Feb. 21, 2023, 7:57 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2212	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

185.19.85.136:6060

Executed a process and injected code into it, probably while unpacking (12 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Feb. 21, 2023, 7:56 a.m.	thread_identifier: 2680 thread_handle: 0x000001fc process_identifier: 2676 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\aloe.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\aloe.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\aloe.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000200	1	1
NtGetContextThread Feb. 21, 2023, 7:56 a.m.	thread_handle: 0x000001fc	1	0
NtAllocateVirtualMemory Feb. 21, 2023, 7:56 a.m.	process_identifier: 2676 region_size: 307200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000200	1	0
NtSetContextThread Feb. 21, 2023, 7:56 a.m.	registers.eip: 1995571652 registers.esp: 1638384 registers.edi: 0 registers.eax: 4200587 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001fc process_identifier: 2676	1	0
CreateProcessInternalW Feb. 21, 2023, 7:57 a.m.	thread_identifier: 1384 thread_handle: 0x00000084 process_identifier: 2088 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: schtasks /create /f /sc onlogon /rl highest /tn "images" /tr '"C:\Users\test22\AppData\Roaming\images.exe"' filepath_r: C:\Windows\system32\schtasks.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
CreateProcessInternalW Feb. 21, 2023, 7:57 a.m.	thread_identifier: 2108 thread_handle: 0x00000084 process_identifier: 2116 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\timeout.exe track: 1 command_line: timeout 3 filepath_r: C:\Windows\system32\timeout.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW Feb. 21, 2023, 7:57 a.m.	thread_identifier: 2216 thread_handle: 0x00000088 process_identifier: 2212 current_directory: filepath: C:\Users\test22\AppData\Roaming\images.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\images.exe" filepath_r: C:\Users\test22\AppData\Roaming\images.exe stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
NtResumeThread Feb. 21, 2023, 7:57 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2212	1	0
CreateProcessInternalW Feb. 21, 2023, 7:57 a.m.	thread_identifier: 2388 thread_handle: 0x00000200 process_identifier: 2328 current_directory: filepath: C:\Users\test22\AppData\Roaming\images.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\images.exe" filepath_r: C:\Users\test22\AppData\Roaming\images.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000204	1	1
NtGetContextThread Feb. 21, 2023, 7:57 a.m.	thread_handle: 0x00000200	1	0
NtAllocateVirtualMemory Feb. 21, 2023, 7:57 a.m.	process_identifier: 2328 region_size: 307200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000204	1	0
NtSetContextThread Feb. 21, 2023, 7:57 a.m.	registers.eip: 1995571652 registers.esp: 1638384 registers.edi: 0 registers.eax: 4200587 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000200 process_identifier: 2328	1	0

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 events)

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Trojan.Generic.31429288
FireEye	Trojan.Generic.31429288
ALYac	Backdoor.RAT.Async
Cylance	Unsafe
Zillya	Trojan.Crysan.Win32.120
K7AntiVirus	Trojan ( 0058ad981 )
Alibaba	Backdoor:Win32/SpyNoon.f73d0535
K7GW	Trojan ( 0058ad981 )
Cybereason	malicious.dfb4ac
Arcabit	Trojan.Generic.D1DF92A8
Cyren	W32/Injector.AQP.gen!Eldorado
Symantec	Packed.Generic.606
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Injector.EQPP
Cynet	Malicious (score: 100)
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Backdoor.Win32.Crysan.gen
BitDefender	Trojan.Generic.31429288
NANO-Antivirus	Trojan.Win32.Inject.jjbkbu
SUPERAntiSpyware	Trojan.Agent/Gen-Siggen
Avast	Win32:Evo-gen [Trj]
Tencent	Win32.Backdoor.Crysan.Osmw
Ad-Aware	Trojan.Generic.31429288
Sophos	Mal/Generic-S
Comodo	Malware@#1g0z3j592mvb2
F-Secure	Trojan.TR/Injector.qclfc
DrWeb	Trojan.Siggen15.52890
VIPRE	Trojan.Generic.31429288
McAfee-GW-Edition	GenericRXQZ-DD!93B8A08A294A
Emsisoft	Trojan.Generic.31429288 (B)
Webroot	W32.Trojan.GenKDZ
Avira	TR/Injector.jtyui
MAX	malware (ai score=85)
Antiy-AVL	Trojan/Win32.Injector
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:Win32/Lokibot.VALC!MTB
ZoneAlarm	HEUR:Backdoor.Win32.Crysan.gen
GData	MSIL.Backdoor.ASyncRAT.EMGLB6
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C4788132
McAfee	Artemis!4813BBEDFB4A
VBA32	TrojanSpyNoon
Malwarebytes	Malware.AI.3172593706
Rising	Trojan.Generic@AI.98 (RDML:4NDuA8yBPUgUv/ZhoMfD6g)
Ikarus	Trojan.Win32.Injector
MaxSecure	Trojan.Malware.121218.susgen
AVG	Win32:Evo-gen [Trj]

aloe.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All