Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 20, 2023, 7:24 a.m.	June 20, 2023, 7:28 a.m.

Size	20.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`ad0f1f3418da5e70c0e898a6546128ef`
SHA256	`cd93805d6fee60c8139820c20aca0872881a71f34218f0cb8de68b722cc128f8`
CRC32	`831958B4`
ssdeep	`96:afqAebOyg99JjlslDbL9CCmnpooOUxdPzPyuj8MpEJAI5xwg:UMDW92PAjioOUxdPDxESqxw`
Yara	UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE32 - (no description)

game2.exe "C:\Users\test22\AppData\Local\Temp\game2.exe"
2628
- game1.exe C:\Users\Public\Videos\game1.exe
  2772

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
51.79.49.73	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49162 -> 51.79.49.73:80	2022550	ET MALWARE Possible Malicious Macro DL EXE Feb 2016	A Network Trojan was detected
TCP 192.168.56.101:49162 -> 51.79.49.73:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 51.79.49.73:80 -> 192.168.56.101:49162	2022050	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1	A Network Trojan was detected
TCP 51.79.49.73:80 -> 192.168.56.101:49162	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 51.79.49.73:80 -> 192.168.56.101:49162	2022051	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2	A Network Trojan was detected
TCP 51.79.49.73:80 -> 192.168.56.101:49162	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 20, 2023, 7:24 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1636876 registers.edi: 5856776 registers.eax: 1636876 registers.ebp: 1636956 registers.edx: 0 registers.ebx: 5856776 registers.esi: 5856776 registers.ecx: 2	1	0	0
__exception__ June 20, 2023, 7:24 a.m.	stacktrace: GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75856d3a GetClientRect+0xc5 CallWindowProcW-0xb user32+0x20d27 @ 0x75860d27 CallWindowProcA+0x1b GetClassNameA-0x95 user32+0x2794a @ 0x7586794a game1+0x16a30f @ 0x56a30f game1+0x169a06 @ 0x569a06 EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 game1+0x19da @ 0x4019da RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: f3 a5 0b ca 75 05 5f 5e c2 0c 00 f3 a4 5f 5e c2 exception.symbol: RtlMoveMemory+0x1b RtlFindActivationContextSectionGuid-0x270 ntdll+0x63c5b exception.instruction: movsd dword ptr es:[edi], dword ptr [esi] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 408667 exception.address: 0x76f73c5b registers.esp: 1636972 registers.edi: 39059456 registers.eax: 1995914304 registers.ebp: 1637176 registers.edx: 0 registers.ebx: 2777054 registers.esi: 3670594892 registers.ecx: 62	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://51.79.49.73/crc/game1.exe

Performs some HTTP requests (1 event)

request

GET http://51.79.49.73/crc/game1.exe

Allocates read-write-execute memory (usually to unpack itself) (8 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 20, 2023, 7:24 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 20, 2023, 7:24 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 7:24 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 7:24 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02540000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 7:24 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02550000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 7:24 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02560000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 7:24 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02570000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 7:24 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02580000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW June 20, 2023, 7:24 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13322158080 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ total_number_of_bytes: 0	1	1	0

Creates executable files on the filesystem (1 event)

file	C:\Users\Public\Videos\game1.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 20, 2023, 7:24 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003f0000 process_handle: 0xffffffff	1	0	0

An executable file was downloaded by the process game2.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
recv June 20, 2023, 7:24 a.m.	buffer: HTTP/1.1 200 OK Date: Mon, 19 Jun 2023 22:26:58 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Thu, 15 Jun 2023 13:21:57 GMT ETag: "179e22-5fe2af3dd4740" Accept-Ranges: bytes Content-Length: 1547810 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program MZÿÿ¸@Èº´ Í!¸LÍ!This program cannot be run in DOS mode. $½ªÉù~Äù~Äù~ÄzbÊø~ÄaÍð~ÄaÉø~ÄRichù~ÄPELdà°@ÐÀ@¸c¨(ð8 Ø.textì ° `.data*ÀÀ@À.rsrcðÐ@@¼ç¨^MSVBVM60.DLL received: 1024 socket: 840	1	1024	0
InternetReadFile June 20, 2023, 7:24 a.m.	buffer: MZÿÿ¸@Èº´ Í!¸LÍ!This program cannot be run in DOS mode. $½ªÉù~Äù~Äù~ÄzbÊø~ÄaÍð~ÄaÉø~ÄRichù~ÄPELdà°@ÐÀ@¸c¨(ð8 Ø.textì ° `.data*ÀÀ@À.rsrcðÐ@@¼ç¨^MSVBVM60.DLL request_handle: 0x00cc000c	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

51.79.49.73

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Gen:Variant.Tedy.380556
FireEye	Gen:Variant.Tedy.380556
ALYac	Gen:Variant.Tedy.380556
BitDefenderTheta	Gen:NN.ZevbaCO.36250.bm0@aS3oWghi
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Tedy.380556
Emsisoft	Gen:Variant.Tedy.380556 (B)
VIPRE	Gen:Variant.Tedy.380556
McAfee-GW-Edition	BehavesLike.Win32.PUP.mz
Trapmine	malicious.high.ml.score
Xcitium	TrojWare.Win32.Inject.ALCI@53390z
Arcabit	Trojan.Tedy.D5CE8C
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Gen:Variant.Tedy.380556
McAfee	Artemis!AD0F1F3418DA
MAX	malware (ai score=88)
Cylance	unsafe
Rising	HackTool.VBInject!1.6481 (CLASSIC)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	PossibleThreat.MU
DeepInstinct	MALICIOUS

game2.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All