Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 31, 2023, 10:21 p.m.	May 31, 2023, 10:28 p.m.

Size	328.4KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`e57e1575e0737614cd18c1320b1b1183`
SHA256	`733bf880b95b90976c6e7f066878d5450d4caa2014ef364056997cb6c49d87f8`
CRC32	`4553BAB4`
ssdeep	`6144:eBerKbGa08c3c5ltQ0amlCszWBRJvh6GJxCwvzfYGlmUL:HaGatrvlaRJZ6mvzrmK`
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

IE_CACHE.exe "C:\Users\test22\AppData\Local\Temp\IE_CACHE.exe"
2560

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 31, 2023, 10:21 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 31, 2023, 10:21 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73272000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2023, 10:21 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10004000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2023, 10:21 p.m.	process_identifier: 2560 region_size: 76304384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03530000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\nspF1E2.tmp\System.dll
file	C:\Users\test22\AppData\Local\Temp\Antiapostle108\triptanes\Differentialises\Chalicotherioid\Diglerne\Schuftens\totype.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\nspF1E2.tmp\System.dll

Queries for potentially installed applications (50 out of 271 events)

Time & API	Arguments	Return
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2
RegOpenKeyExA May 31, 2023, 10:21 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\servitutterne	2

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Guloader.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Loader.1512
MicroWorld-eScan	Gen:Variant.Nemesis.23936
Sangfor	Trojan.Win32.Guloader.V4mq
Cybereason	malicious.5e0737
Arcabit	Trojan.Nemesis.D5D80
Cyren	W32/Guloader.XMEZ-2744
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	NSIS/Injector.BWU
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.Win32.Guloader.gen
BitDefender	Gen:Variant.Nemesis.23936
Avast	Win32:Malware-gen
Emsisoft	Gen:Variant.Nemesis.23936 (B)
F-Secure	Trojan.TR/Redcap.habud
TrendMicro	Trojan.Win32.GULOADER.YXDE5Z
McAfee-GW-Edition	Artemis!Trojan
FireEye	Gen:Variant.Nemesis.23936
Sophos	Mal/Generic-S
Avira	TR/Redcap.habud
MAX	malware (ai score=85)
Microsoft	Program:Win32/Wacapew.C!ml
ZoneAlarm	HEUR:Trojan.Win32.Guloader.gen
GData	Gen:Variant.Nemesis.23936
Google	Detected
AhnLab-V3	Downloader/Win.GuLoader.C5435198
McAfee	Artemis!E57E1575E073
Cylance	unsafe
TrendMicro-HouseCall	Trojan.Win32.GULOADER.YXDE5Z
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_70% (W)

IE_CACHE.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All