Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 17, 2023, 9:42 a.m.	March 17, 2023, 9:47 a.m.

Size	3.7MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`d4fc8415802d26f5902a925dafa09f95`
SHA256	`b5c72a18578c6cc7007b6c7738fa9f72b57ecaf26be44964af3947f7f2b5422f`
CRC32	`3CE6060F`
ssdeep	`98304:GUwJ6Lv3608hjXk/o58364xowyoYLDVEjIHpnzwu7GsD:CSv61hjXk/W8364xowMqcnzwuCg`
Yara	UPX_Zero - UPX packed file IsPE64 - (no description) PE_Header_Zero - PE File Signature

Setupdark.exe "C:\Users\test22\AppData\Local\Temp\Setupdark.exe"
2548
- cmd.exe "C:\Windows\System32\cmd.exe" /c ""C:\Users\test22\AppData\Local\Temp\7zSFX\KillDuplicate.cmd" "C:\Users\test22\AppData\Local\Temp\7zSFX" "Setupdark.exe""
  2680
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\7ZSfx000.cmd" "
  2856

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (13 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 17, 2023, 9:42 a.m.	buffer: The system cannot find the path specified. console_handle: 0x000000000000000b	1	1
WriteConsoleW March 17, 2023, 9:42 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW March 17, 2023, 9:42 a.m.	buffer: del console_handle: 0x0000000000000007	1	1
WriteConsoleW March 17, 2023, 9:42 a.m.	buffer: "C:\Users\test22\AppData\Local\Temp\Setupdark.exe" console_handle: 0x0000000000000007	1	1
WriteConsoleW March 17, 2023, 9:42 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW March 17, 2023, 9:42 a.m.	buffer: if console_handle: 0x0000000000000007	1	1
WriteConsoleW March 17, 2023, 9:42 a.m.	buffer: exist "C:\Users\test22\AppData\Local\Temp\Setupdark.exe" console_handle: 0x0000000000000007	1	1
WriteConsoleW March 17, 2023, 9:42 a.m.	buffer: goto console_handle: 0x0000000000000007	1	1
WriteConsoleW March 17, 2023, 9:42 a.m.	buffer: Repeat console_handle: 0x0000000000000007	1	1
WriteConsoleW March 17, 2023, 9:42 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW March 17, 2023, 9:42 a.m.	buffer: del console_handle: 0x0000000000000007	1	1
WriteConsoleW March 17, 2023, 9:42 a.m.	buffer: "C:\Users\test22\AppData\Local\Temp\7ZSfx000.cmd" console_handle: 0x0000000000000007	1	1
WriteConsoleW March 17, 2023, 9:42 a.m.	buffer: The batch file cannot be found. console_handle: 0x000000000000000b	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 17, 2023, 9:42 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 17, 2023, 9:42 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW March 17, 2023, 9:42 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13319299072 root_path: C:\Users\test22\AppData\Local\Temp\7zSFX total_number_of_bytes: 0	1	1	0

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\7zSFX\KillDuplicate.cmd
file	C:\Users\test22\AppData\Local\Temp\7zSFX\installer.exe
file	C:\Users\test22\AppData\Local\Temp\7ZSfx000.cmd

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /c ""C:\Users\test22\AppData\Local\Temp\7zSFX\KillDuplicate.cmd" "C:\Users\test22\AppData\Local\Temp\7zSFX" "Setupdark.exe""

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW March 17, 2023, 9:42 a.m.	show_type: 0 filepath_r: cmd parameters: /c ""C:\Users\test22\AppData\Local\Temp\7zSFX\KillDuplicate.cmd" "C:\Users\test22\AppData\Local\Temp\7zSFX" "Setupdark.exe"" filepath: cmd	1	1	0
ShellExecuteExW March 17, 2023, 9:42 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\7ZSfx000.cmd parameters: filepath: C:\Users\test22\AppData\Local\Temp\7ZSfx000.cmd	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00015c00', u'virtual_address': u'0x00027000', u'entropy': 7.912547152349569, u'name': u'UPX1', u'virtual_size': u'0x00016000'}

entropy

7.91254715235

description

A section with a high entropy has been found

entropy

0.816901408451

description

Overall entropy of this PE file is high

The executable is compressed using UPX (2 events)

section	UPX0				description	Section name indicates UPX
section	UPX1				description	Section name indicates UPX

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\7zSFX\installer.exe

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\7zSFX\installer.exe
file	C:\Users\test22\AppData\Local\Temp\7ZSfx000.cmd

File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 events)

Lionic	Trojan.Win32.Bsymem.4!c
MicroWorld-eScan	Trojan.GenericKD.65962425
ClamAV	Win.Malware.Misc-9963874-0
FireEye	Trojan.GenericKD.65962425
Malwarebytes	Malware.AI.4261796574
CrowdStrike	win/grayware_confidence_70% (D)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win64/Packed.Enigma.BV
Paloalto	generic.ml
Kaspersky	UDS:Trojan.Win32.Bsymem.akff
BitDefender	Trojan.GenericKD.65962425
NANO-Antivirus	Virus.Win64.Virut-Gen.bwpxnc
Avast	FileRepMalware [Misc]
Sophos	Generic ML PUA (PUA)
DrWeb	Trojan.Inject4.54573
McAfee-GW-Edition	Artemis!Virus
Emsisoft	Trojan.GenericKD.65962425 (B)
SentinelOne	Static AI - Suspicious SFX
Antiy-AVL	HackTool/Win32.DefenderControl
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	UDS:Trojan.Win32.Bsymem.akff
GData	Trojan.GenericKD.65962425
Google	Detected
McAfee	Artemis!D4FC8415802D
MAX	malware (ai score=88)
Ikarus	Worm.Win32.Fujack.o
Fortinet	W32/PossibleThreat
AVG	FileRepMalware [Misc]

Setupdark.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All