Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 11, 2023, 6:35 p.m.	May 11, 2023, 6:48 p.m.

Size	1.9MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`bec821cc9ca7762dd50f48d0cf4344cd`
SHA256	`a0dbde558656175e2713fc50f6d1a49bf2c5a5150b7100c1c3f2d6ce28db967a`
CRC32	`B456EB2C`
ssdeep	`49152:7BuZrEUMykYhbgNT0klNgZ+dbW/MJGlLjRZ:NkLMybgl5laZIbWOIfRZ`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check mzp_file_format - MZP(Delphi) file format Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

SecHorST.exe "C:\Users\test22\AppData\Local\Temp\SecHorST.exe"
496
- SecHorST.tmp "C:\Users\test22\AppData\Local\Temp\is-6T6H7.tmp\SecHorST.tmp" /SL5="$30028,1045945,780288,C:\Users\test22\AppData\Local\Temp\SecHorST.exe"
  2124
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 11, 2023, 6:35 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.itext
section	.didata

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 11, 2023, 6:35 p.m.	process_identifier: 496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 11, 2023, 6:35 p.m.	process_identifier: 496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 745472 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 11, 2023, 6:35 p.m.	process_identifier: 496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 11, 2023, 6:35 p.m.	process_identifier: 496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c6000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 6:35 p.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00940000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 11, 2023, 6:28 p.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000044f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW May 11, 2023, 6:35 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 0 root_path: C:\Program Files (x86)\SecureHorizons\ total_number_of_bytes: 70683793256		0	0
GetDiskFreeSpaceExW May 11, 2023, 6:35 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 9930735616 root_path: C:\Program Files (x86)\ total_number_of_bytes: 34252779520	1	1	0

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-6T6H7.tmp\SecHorST.tmp

Queries for potentially installed applications (2 events)

Time & API	Arguments	Status	Return	Repeated
RegOpenKeyExW May 11, 2023, 6:35 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{0D21D3D0-0C3E-45EC-B4C1-52261415A4B8}_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0D21D3D0-0C3E-45EC-B4C1-52261415A4B8}_is1		2	0
RegOpenKeyExW May 11, 2023, 6:35 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{0D21D3D0-0C3E-45EC-B4C1-52261415A4B8}_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0D21D3D0-0C3E-45EC-B4C1-52261415A4B8}_is1		2	0

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Gen:Heur.MSIL.Krypt.6
FireEye	Gen:Heur.MSIL.Krypt.6
McAfee	Artemis!BEC821CC9CA7
Cylance	unsafe
Sangfor	Trojan.Win32.Agent.Vaz5
K7AntiVirus	Trojan ( 0050bedf1 )
K7GW	Trojan ( 0050bedf1 )
Arcabit	Trojan.MSIL.Krypt.6
Cyren	W32/MSIL_Troj.C.gen!Eldorado
ESET-NOD32	a variant of MSIL/Injector.LOS
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan.Win32.Generic
BitDefender	Gen:Heur.MSIL.Krypt.6
Avast	Win32:InjectorX-gen [Trj]
Tencent	Win32.Trojan.Generic.Cflw
VIPRE	Gen:Heur.MSIL.Krypt.6
McAfee-GW-Edition	BehavesLike.Win32.Trojan.tc
Trapmine	malicious.moderate.ml.score
Emsisoft	Gen:Heur.MSIL.Krypt.6 (B)
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Heur.MSIL.Krypt.6
Google	Detected
AhnLab-V3	Trojan/Win.Krypt.C5423478
ALYac	Gen:Heur.MSIL.Krypt.6
MAX	malware (ai score=85)
Malwarebytes	Malware.AI.4284685569
Rising	Trojan.Generic!8.C3 (CLOUD)
Ikarus	Trojan.MSIL.Injector
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:InjectorX-gen [Trj]
DeepInstinct	MALICIOUS

SecHorST.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All