Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 7, 2023, 5:36 a.m.	June 7, 2023, 5:38 a.m.

Size	3.9MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`6156028337e0510bd3535c891ed15029`
SHA256	`a370b1ab9d006b851888b3f1993602813694ba7248a8137e0018895cdd6bbf17`
CRC32	`71286341`
ssdeep	`24576:QVvnZSXUpShfGnZSXUpShfGnZSXUpShfeF3J5CX3uIua:QVfwEwswEwswEwed/CXfua`
PDB Path	f:\builds\vendor\sb_win32bot03_vendor_trunk\build\vendor\xulrunner-1.9.2\mozilla\compiled\xulrunner-release\xulrunner\stub\songbird.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

ddsc.exe "C:\Users\test22\AppData\Local\Temp\ddsc.exe"
2564
- pipanel.exe "C:\Users\test22\AppData\Local\Temp\ddsc.exe"
  2724

Name	Response	Post-Analysis Lookup
mmnedgeggrrva.com	A 153.92.126.196	153.92.126.196

IP Address	Status	Action
153.92.126.196	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

f:\builds\vendor\sb_win32bot03_vendor_trunk\build\vendor\xulrunner-1.9.2\mozilla\compiled\xulrunner-release\xulrunner\stub\songbird.pdb

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section	.berti
section	.arif
section	.ag
section	.bennie

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 7, 2023, 5:36 a.m.	process_identifier: 2564 region_size: 503808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2023, 5:36 a.m.	process_identifier: 2564 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 7, 2023, 5:36 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

pipanel.exe tried to sleep 128 seconds, actually delayed analysis time by 128 seconds

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 7, 2023, 5:36 a.m.	thread_identifier: 2728 thread_handle: 0x00000280 process_identifier: 2724 current_directory: filepath: C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\ddsc.exe" filepath_r: C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000284	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (6 events)

Time & API	Arguments	Status	Return
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x00000064 process_name: mobsync.exe process_identifier: 2288	1	1
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x00000064 process_name: pw.exe process_identifier: 2332	1	1
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x00000064 process_name: taskhost.exe process_identifier: 2380	1	1
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x00000064 process_name: ddsc.exe process_identifier: 2564	1	1
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x0000028c process_name: dllhost.exe process_identifier: 2676	1	1
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x0000028c process_name: pipanel.exe process_identifier: 2724	1	1

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00085c00', u'virtual_address': u'0x00124000', u'entropy': 7.836869265673295, u'name': u'.idata', u'virtual_size': u'0x00086000'}

entropy

7.83686926567

description

A section with a high entropy has been found

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (20 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x00000064 process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x00000068 process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x0000006c process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x00000070 process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x00000074 process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x00000078 process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x0000007c process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x00000080 process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x00000084 process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x00000088 process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x0000008c process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x00000090 process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x00000094 process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x00000098 process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x0000009c process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x000000a0 process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x000000a4 process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x000000a8 process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x000000ac process_name: ddsc.exe process_identifier: 2564		0	0
Process32NextW June 7, 2023, 5:36 a.m.	snapshot_handle: 0x000000b0 process_name: ddsc.exe process_identifier: 2564		0	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Users\test22\AppData\Local\Temp\ddsc.exe"

Allocates execute permission to another process indicative of possible code injection (4 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 7, 2023, 5:36 a.m.	process_identifier: 2724 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000284	1
NtProtectVirtualMemory June 7, 2023, 5:36 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0x00000284	1
NtAllocateVirtualMemory June 7, 2023, 5:36 a.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000284	1
NtAllocateVirtualMemory June 7, 2023, 5:36 a.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000284	1

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory June 7, 2023, 5:36 a.m.	buffer: C:\Users\test22\AppData\Roaming\ffp.exe base_address: 0x000b0000 process_identifier: 2724 process_handle: 0x00000284	1	1
WriteProcessMemory June 7, 2023, 5:36 a.m.	buffer: base_address: 0x77010234 process_identifier: 2724 process_handle: 0x00000284	1	1
WriteProcessMemory June 7, 2023, 5:36 a.m.	buffer: base_address: 0x77010230 process_identifier: 2724 process_handle: 0x00000284	1	1

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Roaming\ffp.exe:Zone.Identifier

Executed a process and injected code into it, probably while unpacking (8 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW June 7, 2023, 5:36 a.m.	thread_identifier: 2728 thread_handle: 0x00000280 process_identifier: 2724 current_directory: filepath: C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\ddsc.exe" filepath_r: C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000284	1	1
NtGetContextThread June 7, 2023, 5:36 a.m.	thread_handle: 0x00000280	1	0
NtAllocateVirtualMemory June 7, 2023, 5:36 a.m.	process_identifier: 2724 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000284	1	0
NtAllocateVirtualMemory June 7, 2023, 5:36 a.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000284	1	0
NtAllocateVirtualMemory June 7, 2023, 5:36 a.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000284	1	0
WriteProcessMemory June 7, 2023, 5:36 a.m.	buffer: C:\Users\test22\AppData\Roaming\ffp.exe base_address: 0x000b0000 process_identifier: 2724 process_handle: 0x00000284	1	1
WriteProcessMemory June 7, 2023, 5:36 a.m.	buffer: base_address: 0x77010234 process_identifier: 2724 process_handle: 0x00000284	1	1
WriteProcessMemory June 7, 2023, 5:36 a.m.	buffer: base_address: 0x77010230 process_identifier: 2724 process_handle: 0x00000284	1	1

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Shellcode.4!c
MicroWorld-eScan	Trojan.GenericKD.67378831
FireEye	Generic.mg.6156028337e0510b
ALYac	Trojan.GenericKD.67378831
Cylance	unsafe
Zillya	Exploit.ShellCode.Win32.979
Sangfor	Exploit.Win32.Remcos.Vql4
K7AntiVirus	Trojan ( 005a6a7c1 )
Alibaba	Exploit:Win32/Shellcode.a4f24a9e
K7GW	Trojan ( 005a6a7c1 )
Cybereason	malicious.1cacce
Cyren	W32/ABRisk.HGGE-2926
Symantec	Trojan.Gen.2
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/GenKryptik.GKKV
APEX	Malicious
Kaspersky	HEUR:Exploit.Win32.Shellcode.gen
BitDefender	Trojan.GenericKD.67378831
NANO-Antivirus	Exploit.Win32.Shellcode.jvgund
Avast	FileRepMalware [Misc]
Tencent	Malware.Win32.Gencirc.10bdb360
Sophos	Mal/Generic-S
DrWeb	BackDoor.Remcos.361
VIPRE	Trojan.GenericKD.67378831
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Trojan.GenericKD.67378831 (B)
Webroot	W32.Trojan.GenKD
Google	Detected
Microsoft	Trojan:Win32/Remcos!MTB
Gridinsoft	Trojan.Win32.Remcos.bot
Arcabit	Trojan.Generic.D4041E8F
ZoneAlarm	HEUR:Exploit.Win32.Shellcode.gen
GData	Win32.Backdoor.Remcos.9VNCID
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C5395892
McAfee	Artemis!6156028337E0
MAX	malware (ai score=89)
Malwarebytes	Trojan.ShellCode
Panda	Trj/Chgt.AD
Rising	Trojan.Generic@AI.91 (RDML:RuldCE6oDkMGxJN31zhBww)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/PossibleThreat
AVG	FileRepMalware [Misc]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 events)

dead_host	153.92.126.196:333
dead_host	192.168.56.101:49169
dead_host	192.168.56.101:49174

ddsc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All