Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 28, 2023, 1:42 p.m.	May 28, 2023, 1:45 p.m.

Size	127.8KB
Type	DOS batch file, ASCII text
MD5	`0502d1878cc372e6118bd37951132d6d`
SHA256	`ed615609958a9d76ede2c830ed944edce994904db2f833ab79b6c83814544da1`
CRC32	`2B790C25`
ssdeep	`3072:CQSKPHaTWo5hnKYTVkhEaACk/3P82BwX3YVePZM4MU:CQyTZ50oVaEMm363YVeBZn`
Yara	None matched

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "rWzKnoaMZVOkFHg" C:\Users\test22\AppData\Local\Temp\KRILL_YOURSELF.cmd
912
- cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\KRILL_YOURSELF.cmd
  2168
  - cscript.exe cscript x.js
    2308
  - QSO J1228+3128.exe "C:\Users\test22\AppData\Roaming\QSO J1228+3128.exe"
    2444
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW May 28, 2023, 1:42 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1	0

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 28, 2023, 1:42 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02fd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory May 28, 2023, 1:35 p.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000006a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Roaming\QSO J1228+3128.exe
file	C:\Users\test22\AppData\Local\Temp\x.js

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (27 events)

Time & API	Arguments	Status	Return
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: smss.exe process_identifier: 232	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: csrss.exe process_identifier: 308	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: csrss.exe process_identifier: 356	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: winlogon.exe process_identifier: 392	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: services.exe process_identifier: 436	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: lsass.exe process_identifier: 452	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: svchost.exe process_identifier: 560	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: svchost.exe process_identifier: 636	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: svchost.exe process_identifier: 716	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: svchost.exe process_identifier: 780	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: audiodg.exe process_identifier: 896	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: svchost.exe process_identifier: 984	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: svchost.exe process_identifier: 340	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: spoolsv.exe process_identifier: 1060	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: taskhost.exe process_identifier: 1112	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: svchost.exe process_identifier: 1120	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: svchost.exe process_identifier: 1744	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: pw.exe process_identifier: 1888	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: SearchIndexer.exe process_identifier: 1652	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: taskhost.exe process_identifier: 1516	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: SearchFilterHost.exe process_identifier: 1076	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: cmd.exe process_identifier: 912	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: conhost.exe process_identifier: 2136	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: cmd.exe process_identifier: 2168	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: conhost.exe process_identifier: 2496	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: svchost.exe process_identifier: 2712	1	1
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: mscorsvw.exe process_identifier: 2788	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 28, 2023, 1:42 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (18 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000d4 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000d4 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000d4 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000d4 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000d4 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000d4 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000d4 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000d4 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000d4 process_name: sppsvc.exe process_identifier: 2832		0	0
Process32NextW May 28, 2023, 1:42 p.m.	snapshot_handle: 0x000000c8 process_name: sppsvc.exe process_identifier: 2832		0	0

Yara rule detected in process memory (50 out of 66 events)

description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Steal credential	rule	local_credential_Steal
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Communications over P2P network	rule	Network_P2P_Win
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Take ScreenShot	rule	ScreenShot
description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Steal credential	rule	local_credential_Steal
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Communications over P2P network	rule	Network_P2P_Win
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active

Installs itself for autorun at Windows startup (21 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64a.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PartAssit.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Security Task Manager.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msedge.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\edge.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brave.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger	reg_value	winlogon.exeDebuggerNOT FOR EPILEPSY!UnVubmluZyB0aGlzIG1hbH

Expresses interest in specific running processes (1 event)

process: potential process injection target

csrss.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2168 resumed a thread in remote process 2444
NtResumeThread May 28, 2023, 1:42 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2444	1	0	0

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

Sangfor	Trojan.Generic-Script.Save.fae3e500
Cyren	BAT/Agent.AGE
ESET-NOD32	BAT/TrojanDropper.Agent.NCY
Kaspersky	HEUR:Trojan-Dropper.BAT.Generic
BitDefender	Trojan.BAT.Agent.QF
NANO-Antivirus	Trojan.Script.Dropper.hkfymg
MicroWorld-eScan	Trojan.BAT.Agent.QF
Rising	Dropper.Agent/BAT!1.CE50 (CLASSIC)
Emsisoft	Trojan.BAT.Agent.QF (B)
DrWeb	Trojan.KillAll.143
VIPRE	Trojan.BAT.Agent.QF
FireEye	Trojan.BAT.Agent.QF
GData	Trojan.BAT.Agent.QF
Arcabit	Trojan.BAT.Agent.QF
ZoneAlarm	HEUR:Trojan-Dropper.BAT.Generic
Google	Detected
ALYac	Trojan.BAT.Agent.QF
MAX	malware (ai score=87)
Tencent	Unk.Win32.Script.403928
Ikarus	Trojan-Dropper.BAT.Agent

KRILL_YOURSELF.cmd

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All