Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 22, 2023, 8:42 a.m.	April 22, 2023, 8:45 a.m.

Size	295.7KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`95c5281f68d37a162fcd1b679fdaff5e`
SHA256	`747618a8c380249ee66e65ece0c48cc71d19cfeaa2bf7850a93b80f980556d60`
CRC32	`C56FC497`
ssdeep	`6144:R9GfgEwSdJ4P3ZBeNIX8ikIEjFoEiWnIGhOG517kR4n7i/XpQZyKHvw22yEc:RQ4+d6PJBqIIZlnIXIAWSXCyKHY22rc`
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature

NODD.exe "C:\Users\test22\AppData\Local\Temp\NODD.exe"
2576
- win.exe "C:\Program Files\Windows NT\win.exe"
  2708

Name	Response	Post-Analysis Lookup
www.jz3366.top	A 211.101.237.65	211.101.237.65

IP Address	Status	Action
164.124.101.2	Active	Moloch
211.101.237.65	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
TCP 192.168.56.101:49163 -> 211.101.237.65:5566	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.101:49163 -> 211.101.237.65:5566	2016879	ET POLICY Unsupported/Fake Windows NT Version 5.0	Potential Corporate Privacy Violation
TCP 211.101.237.65:5566 -> 192.168.56.101:49163	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 211.101.237.65:5566 -> 192.168.56.101:49163	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 22, 2023, 8:42 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

The executable uses a known packer (1 event)

packer

NsPack 2.9 -> North Star

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

www.jz3366.top

description

Generic top level domain TLD

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 22, 2023, 8:42 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00330000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 22, 2023, 8:42 a.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73552000 process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (1 event)

file	C:\Program Files\Windows NT\win.exe

Creates a service (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceA April 22, 2023, 8:42 a.m.	service_start_name: start_type: 3 password: display_name: Udx32crD filepath: C:\Users\test22\AppData\Local\Temp\Udx32crD.sys service_name: Udx32crD filepath_r: C:\Users\test22\AppData\Local\Temp\\Udx32crD.sys desired_access: 16 service_handle: 0x006fcf28 error_control: 0 service_type: 1 service_manager_handle: 0x006fd018	1	7327528	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (30 events)

Time & API	Arguments	Status	Return
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x0000017c process_name: NODD.exe process_identifier: 2576	1	1
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: win.exe process_identifier: 2708	1	1
Process32NextW April 22, 2023, 8:44 a.m.	snapshot_handle: 0x00000184 process_name: svchost.exe process_identifier: 2112	1	1
Process32NextW April 22, 2023, 8:44 a.m.	snapshot_handle: 0x00000184 process_name: mscorsvw.exe process_identifier: 1336	1	1
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x0000025c process_name: win.exe process_identifier: 7602224		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000260 process_name: win.exe process_identifier: 7536688		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000258 process_name: win.exe process_identifier: 7536752		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000230 process_name: win.exe process_identifier: 3014768		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x0000022c process_name: win.exe process_identifier: 7274573		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000224 process_name: win.exe process_identifier: 5046390		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000254 process_name: win.exe process_identifier: 6815859		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000264 process_name: win.exe process_identifier: 6881397		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000268 process_name: win.exe process_identifier: 7602277		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x0000026c process_name: win.exe process_identifier: 6619235		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000270 process_name: win.exe process_identifier: 4456552		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000274 process_name: win.exe process_identifier: 7536758		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000278 process_name: win.exe process_identifier: 6684769		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x0000027c process_name: win.exe process_identifier: 4390992		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000280 process_name: process_identifier: 5439572		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000284 process_name: win.exe process_identifier: 6619182		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000288 process_name: win.exe process_identifier: 6553715		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x0000028c process_name: win.exe process_identifier: 5046338		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000290 process_name: win.exe process_identifier: 6619246		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000294 process_name: win.exe process_identifier: 6750273		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000298 process_name: win.exe process_identifier: 7471220		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x0000029c process_name: win.exe process_identifier: 7733331		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x000002a0 process_name: win.exe process_identifier: 4980808		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x000002a4 process_name: win.exe process_identifier: 6619251		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x000002a8 process_name: process_identifier: 7733362		0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x000002ac process_name: win.exe process_identifier: 6553705		0

An executable file was downloaded by the process nodd.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile April 22, 2023, 8:42 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÔeÉµù6Éµù6Éµù6 º¦6Èµù6²©õ6Êµù6¦ªò6Èµù6J©÷6Íµù6¦ªó6Âµù6¦ªý6Ëµù6Éµù6Èµù6 º¤6Îµù6Éµø6®µù6!ªò6Ãµù6RichÉµù6PEL\|¾aàP R`@Xdx.textLOP `.dataÌ` `@À request_handle: 0x00cc000c	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00049aa5', u'virtual_address': u'0x000de000', u'entropy': 7.998626335224512, u'name': u'', u'virtual_size': u'0x0004a000'}

entropy

7.99862633522

description

A section with a high entropy has been found

entropy

1.0

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

win.exe

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (50 out of 728 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x0000017c process_name: ��o良㱴直㲣直㓊眙 process_identifier: 2576		0	0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000174 process_name: ��o良㱴直㲣直㓊眙 process_identifier: 2576		0	0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x0000017c process_name: ��o良㱴直㲣直㓊眙 process_identifier: 2576		0	0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000174 process_name: ��o良㱴直㲣直㓊眙 process_identifier: 2576		0	0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x0000017c process_name: ��o良㱴直㲣直㓊眙 process_identifier: 2576		0	0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x00000174 process_name: ��o良㱴直㲣直㓊眙 process_identifier: 2576		0	0
Process32NextW April 22, 2023, 8:42 a.m.	snapshot_handle: 0x0000017c process_name: ��o良㱴直㲣直㓊眙 process_identifier: 2576		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000378 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0
Process32NextW April 22, 2023, 8:43 a.m.	snapshot_handle: 0x00000370 process_name: 蚘p良㱴直㲣直㓊眙 process_identifier: 2708		0	0

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 events)

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Bjlog.lzuS
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Graftor.945714
FireEye	Generic.mg.95c5281f68d37a16
CAT-QuickHeal	Risktool.Flystudio.17324
McAfee	Artemis!95C5281F68D3
Cylance	unsafe
Zillya	Virus.Hupigon.Win32.5
Sangfor	Trojan.Win32.Siscos.Vhvh
CrowdStrike	win/malicious_confidence_70% (W)
Alibaba	Trojan:Win32/Siscos.29afcbae
K7GW	Trojan ( 005257651 )
K7AntiVirus	Trojan ( 005257651 )
Arcabit	Trojan.Graftor.DE6E32
BitDefenderTheta	Gen:NN.ZexaF.36164.smGda8pHmam
Cyren	W32/Downloader.AT.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
Cynet	Malicious (score: 100)
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Siscos.aceq
BitDefender	Gen:Variant.Graftor.945714
NANO-Antivirus	Trojan.Win32.TrjGen.jvhiil
Avast	Win32:TrojanX-gen [Trj]
Tencent	Win32.Trojan.Siscos.Mqil
Emsisoft	Gen:Variant.Graftor.945714 (B)
F-Secure	Heuristic.HEUR/AGEN.1331417
VIPRE	Gen:Variant.Graftor.945714
McAfee-GW-Edition	Artemis!Trojan
Trapmine	malicious.high.ml.score
Sophos	Generic Reputation PUA (PUA)
SentinelOne	Static AI - Malicious PE
Avira	HEUR/AGEN.1331417
Antiy-AVL	Trojan/Win32.FlyStudio.a
Gridinsoft	Pack.Win32.Gen.bot!ep-44128
Xcitium	Backdoor.Win32.Popwin.~IQ@ogvrk
Microsoft	Trojan:Win32/Tiggre!rfn
ViRobot	Trojan.Win.Z.Graftor.302757
ZoneAlarm	Trojan.Win32.Siscos.aceq
GData	Gen:Variant.Graftor.945714
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5229540
Acronis	suspicious
ALYac	Gen:Variant.Graftor.945714
MAX	malware (ai score=84)
Panda	Trj/Chgt.AC
TrendMicro-HouseCall	TROJ_GEN.R002H0CDJ23
Rising	Trojan.MalCert!1.DEC0 (CLOUD)

NODD.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All