Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 9, 2023, 5:31 p.m.	March 9, 2023, 5:39 p.m.

Size	370.0KB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`9029a43c6034a4f0b3408fd38936beb9`
SHA256	`91a6e2bae07280209aa0a6cc69e76915326cbf41cef338dbe6fbed040a8bf9f8`
CRC32	`1CB9CB5F`
ssdeep	`6144:YIXxajWVr8qF3YyLaa3uFtEfC8KZohOT1YRHKy:vXxajWl8MYrxtWKZoAqH`
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library OS_Processor_Check_Zero - OS Processor Check PE_Header_Zero - PE File Signature IsPE64 - (no description)

dd_64.exe "C:\Users\test22\AppData\Local\Temp\dd_64.exe"
2540

Name	Response	Post-Analysis Lookup
chromedriver.storage.googleapis.com	A 34.64.4.16	142.250.206.208
github.com	A 20.200.245.247	20.200.245.247

IP Address	Status	Action
164.124.101.2	Active	Moloch
195.123.211.57	Active	Moloch
20.200.245.247	Active	Moloch
34.64.4.16	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 20.200.245.247:443 -> 192.168.56.101:49170	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49165 -> 20.200.245.247:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49163 -> 34.64.4.16:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49169 -> 20.200.245.247:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49161 -> 195.123.211.57:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.101:49161 -> 195.123.211.57:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 20.200.245.247:443 -> 192.168.56.101:49166	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49168 -> 20.200.245.247:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49161 -> 195.123.211.57:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.101:49161 -> 195.123.211.57:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.101:49164 -> 20.200.245.247:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49163 34.64.4.16:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1C3	CN=*.storage.googleapis.com	41:50:4b:65:48:0d:a3:ad:6f:e5:44:02:02:69:ff:a7:1f:e8:7f:d0

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW March 9, 2023, 5:24 p.m.	computer_name: TEST22-PC	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 9, 2023, 5:24 p.m.	stacktrace: TF_GetInputScope+0x22ce CtfImeDestroyThreadMgr-0x17ce msctf+0x154a6 @ 0x7fefee654a6 TF_GetInputScope+0x2002 CtfImeDestroyThreadMgr-0x1a9a msctf+0x151da @ 0x7fefee651da TF_GetInputScope+0x1f71 CtfImeDestroyThreadMgr-0x1b2b msctf+0x15149 @ 0x7fefee65149 TF_GetInputScope+0x373b CtfImeDestroyThreadMgr-0x361 msctf+0x16913 @ 0x7fefee66913 TF_GetInputScope+0x3910 CtfImeDestroyThreadMgr-0x18c msctf+0x16ae8 @ 0x7fefee66ae8 TF_GetInputScope+0x386e CtfImeDestroyThreadMgr-0x22e msctf+0x16a46 @ 0x7fefee66a46 ImmEnumInputContext+0xb6 ImmDestroyIMCC-0x116 imm32+0x34ea @ 0x7fefd5e34ea TF_GetInputScope+0x2a78 CtfImeDestroyThreadMgr-0x1024 msctf+0x15c50 @ 0x7fefee65c50 TF_CanUninitialize+0x74 CtfNotifyIME-0x1318 msctf+0x21ea4 @ 0x7fefee71ea4 TF_CleanUpPrivateMessages+0xf48 DllGetClassObject-0x514 msctf+0x180d4 @ 0x7fefee680d4 TF_CleanUpPrivateMessages+0xf26 DllGetClassObject-0x536 msctf+0x180b2 @ 0x7fefee680b2 TF_CleanUpPrivateMessages+0xc7b DllGetClassObject-0x7e1 msctf+0x17e07 @ 0x7fefee67e07 TF_CleanUpPrivateMessages+0xbb8 DllGetClassObject-0x8a4 msctf+0x17d44 @ 0x7fefee67d44 RtlProcessFlsData+0x84 LdrUnlockLoaderLock-0x7c ntdll+0x2b894 @ 0x76d5b894 LdrShutdownThread+0x4b RtlCleanUpTEBLangLists-0x95 ntdll+0x46a9b @ 0x76d76a9b RtlExitUserThread+0x38 LdrShutdownThread-0xe8 ntdll+0x46968 @ 0x76d76968 BaseThreadInitThunk+0x15 CreateThread-0x4b kernel32+0x16535 @ 0x76c26535 RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521 exception.instruction_r: ff 50 38 e9 80 fc fe ff 48 8b 03 49 8b d5 48 8b exception.symbol: TF_GetInputScope+0x22ce CtfImeDestroyThreadMgr-0x17ce msctf+0x154a6 exception.instruction: call qword ptr [rax + 0x38] exception.module: MSCTF.dll exception.exception_code: 0xc0000005 exception.offset: 87206 exception.address: 0x7fefee654a6 registers.r14: 0 registers.r15: 0 registers.rcx: 56341392 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 51313504 registers.r11: 0 registers.r8: -9223372036837998592 registers.r9: 5267184 registers.rdx: 5267184 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1950540856 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

March 9, 2023, 5:24 p.m.

stacktrace:

TF_GetInputScope+0x22ce CtfImeDestroyThreadMgr-0x17ce msctf+0x154a6 @ 0x7fefee654a6
TF_GetInputScope+0x2002 CtfImeDestroyThreadMgr-0x1a9a msctf+0x151da @ 0x7fefee651da
TF_GetInputScope+0x1f71 CtfImeDestroyThreadMgr-0x1b2b msctf+0x15149 @ 0x7fefee65149
TF_GetInputScope+0x373b CtfImeDestroyThreadMgr-0x361 msctf+0x16913 @ 0x7fefee66913
TF_GetInputScope+0x3910 CtfImeDestroyThreadMgr-0x18c msctf+0x16ae8 @ 0x7fefee66ae8
TF_GetInputScope+0x386e CtfImeDestroyThreadMgr-0x22e msctf+0x16a46 @ 0x7fefee66a46
ImmEnumInputContext+0xb6 ImmDestroyIMCC-0x116 imm32+0x34ea @ 0x7fefd5e34ea
TF_GetInputScope+0x2a78 CtfImeDestroyThreadMgr-0x1024 msctf+0x15c50 @ 0x7fefee65c50
TF_CanUninitialize+0x74 CtfNotifyIME-0x1318 msctf+0x21ea4 @ 0x7fefee71ea4
TF_CleanUpPrivateMessages+0xf48 DllGetClassObject-0x514 msctf+0x180d4 @ 0x7fefee680d4
TF_CleanUpPrivateMessages+0xf26 DllGetClassObject-0x536 msctf+0x180b2 @ 0x7fefee680b2
TF_CleanUpPrivateMessages+0xc7b DllGetClassObject-0x7e1 msctf+0x17e07 @ 0x7fefee67e07
TF_CleanUpPrivateMessages+0xbb8 DllGetClassObject-0x8a4 msctf+0x17d44 @ 0x7fefee67d44
RtlProcessFlsData+0x84 LdrUnlockLoaderLock-0x7c ntdll+0x2b894 @ 0x76d5b894
LdrShutdownThread+0x4b RtlCleanUpTEBLangLists-0x95 ntdll+0x46a9b @ 0x76d76a9b
RtlExitUserThread+0x38 LdrShutdownThread-0xe8 ntdll+0x46968 @ 0x76d76968
BaseThreadInitThunk+0x15 CreateThread-0x4b kernel32+0x16535 @ 0x76c26535
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

exception.instruction_r: ff 50 38 e9 80 fc fe ff 48 8b 03 49 8b d5 48 8b
exception.symbol: TF_GetInputScope+0x22ce CtfImeDestroyThreadMgr-0x17ce msctf+0x154a6
exception.instruction: call qword ptr [rax + 0x38]
exception.module: MSCTF.dll
exception.exception_code: 0xc0000005
exception.offset: 87206
exception.address: 0x7fefee654a6
registers.r14: 0
registers.r15: 0
registers.rcx: 56341392
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 51313504
registers.r11: 0
registers.r8: -9223372036837998592
registers.r9: 5267184
registers.rdx: 5267184
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1950540856
registers.r13: 0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, Connection to IP address

suspicious_request

POST http://195.123.211.57/g.php

Performs some HTTP requests (2 events)

request	POST http://195.123.211.57/g.php
request	GET https://chromedriver.storage.googleapis.com/LATEST_RELEASE_65

Sends data using the HTTP POST Method (1 event)

request

POST http://195.123.211.57/g.php

Reads the systems User Agent and subsequently performs requests (1 event)

Time & API	Arguments	Status	Return	Repeated
InternetOpenW March 9, 2023, 5:24 p.m.	proxy_name: proxy_bypass: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) access_type: 0	1	13369348	0

Communicates with host for which no DNS query was performed (1 event)

host

195.123.211.57

Harvests credentials from local email clients (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\(Default)

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.9029a43c6034a4f0
McAfee	Artemis!9029A43C6034
VIPRE	Gen:Variant.Lazy.299183
Sangfor	Trojan.Win32.Lazy.V9z8
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.Win32.SelfDel.icct
BitDefender	Gen:Variant.Lazy.299183
MicroWorld-eScan	Gen:Variant.Lazy.299183
Avast	FileRepMalware [Misc]
McAfee-GW-Edition	BehavesLike.Win64.NetLoader.fh
Emsisoft	Gen:Variant.Lazy.299183 (B)
Arcabit	Trojan.Lazy.D490AF
GData	Gen:Variant.Lazy.299183
ALYac	Gen:Variant.Lazy.299183
MAX	malware (ai score=86)
Rising	Trojan.SelfDel!8.275 (CLOUD)
MaxSecure	Trojan.Malware.300983.susgen
AVG	FileRepMalware [Misc]

dd_64.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All