Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 15, 2023, 4:31 p.m.	March 15, 2023, 4:33 p.m.

Size	5.5MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`33614c059849aaeacaa68422b11a9795`
SHA256	`25884495d9c27c8b120bfab40bd28b7f5255b4916c54c7fb74a90dd8000bf44e`
CRC32	`5D00A51B`
ssdeep	`98304:cKYGKdACTgvV6qPvZpgvXM/N3qZBO0cY2YPGvhP0JGom5:cp86qPvZ6v6NH0l7PXm5`
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library Generic_Malware_Zero - Generic Malware Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen OS_Processor_Check_Zero - OS Processor Check CAB_file_format - CAB archive file Microsoft_Office_File_Zero - Microsoft Office File Malicious_Packer_Zero - Malicious Packer ASPack_Zero - ASPack packed file IsPE32 - (no description) PE_Header_Zero - PE File Signature Antivirus - Contains references to security software Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\AnyDesk.exe.ps1
3060

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (6 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 15, 2023, 4:31 p.m.	buffer: Missing closing ')' in expression. console_handle: 0x00000023	1	1
WriteConsoleW March 15, 2023, 4:31 p.m.	buffer: At C:\Users\test22\AppData\Local\Temp\AnyDesk.exe.ps1:13 char:1 console_handle: 0x0000002f	1	1
WriteConsoleW March 15, 2023, 4:31 p.m.	buffer: + <<<< ‹‹P‹BÿÐŽÈèù«NtÆD$è=«‹ÎÇD$ÿÿÿÿè°‹L$d‰ console_handle: 0x0000003b	1	1
WriteConsoleW March 15, 2023, 4:31 p.m.	buffer: + CategoryInfo : ParserError: (CloseParenToken:TokenId) [], Paren console_handle: 0x00000047	1	1
WriteConsoleW March 15, 2023, 4:31 p.m.	buffer: tContainsErrorRecordException console_handle: 0x00000053	1	1
WriteConsoleW March 15, 2023, 4:31 p.m.	buffer: + FullyQualifiedErrorId : MissingEndParenthesisInExpression console_handle: 0x0000005f	1	1

Uses Windows APIs to generate a cryptographic key (4 events)

Time & API	Arguments	Status	Return
CryptExportKey March 15, 2023, 4:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x06246c40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 15, 2023, 4:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x06246c40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 15, 2023, 4:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00712530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 15, 2023, 4:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00712530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 15, 2023, 4:31 p.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

IDR_EXE

Allocates read-write-execute memory (usually to unpack itself) (19 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09130000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09320000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09321000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09322000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09323000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09324000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09325000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09326000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09327000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0932b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0933c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0933d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0933e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02689000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02862000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 15, 2023, 4:31 p.m.	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02863000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00542200', u'virtual_address': u'0x00033000', u'entropy': 7.810745253868082, u'name': u'.rsrc', u'virtual_size': u'0x0054203c'}

entropy

7.81074525387

description

A section with a high entropy has been found

entropy

0.967130669062

description

Overall entropy of this PE file is high

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Trojan.GenericKD.65870094
ClamAV	Win.Trojan.6818577-1
McAfee	Artemis!33614C059849
VIPRE	Trojan.GenericKD.65870094
Sangfor	Trojan.Win32.Agent.Vg9c
Alibaba	TrojanDownloader:Win32/Banload.a5d6adfe
Symantec	Trojan.Gen.MBT
ESET-NOD32	PowerShell/TrojanDownloader.Agent.DPX
Paloalto	generic.ml
Cynet	Malicious (score: 99)
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.65870094
Avast	Win32:Malware-gen
Rising	Downloader.Agent/PS!8.1250D (CLOUD)
Zillya	Backdoor.Bifrose.Win32.99631
McAfee-GW-Edition	Artemis!Trojan
FireEye	Trojan.GenericKD.65870094
Emsisoft	Trojan.GenericKD.65870094 (B)
Ikarus	Exploit.CVE-2021-41379
GData	Trojan.GenericKD.65870094
Jiangmin	Backdoor/Poison.hhc
Webroot	W32.Trojan.Gen
Avira	TR/Redcap.xmkaz
Gridinsoft	Spy.Win32.Gen.bot
Arcabit	Trojan.Generic.D3ED190E
Microsoft	Trojan:Win32/Casdet!rfn
Google	Detected
ALYac	Trojan.GenericKD.65870094
MAX	malware (ai score=89)
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H09CC23
MaxSecure	PSW.W32.MSIL.Stealer.gen_258327
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
Panda	Trj/Chgt.AD

AnyDesk.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All