Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 26, 2023, 10:08 a.m.	June 26, 2023, 10:10 a.m.

Size	1.3MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`ae9991a02aa20ebbc2cc3c0f40924442`
SHA256	`5c38a5dd3703b1c4b8c2466b18ce9f4c45ef4c9bf6c3096bee8b24d20ecd247a`
CRC32	`F5262B44`
ssdeep	`12288:PVon2T2h6bhdoDJdZuQU574H0HNfusW2wvpwSIDMUF3cTOq1Ni:PVT2oPaJfCAKfu1DBwjPcT51s`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature IsPE32 - (no description)

staticlittlesource.exe "C:\Users\test22\AppData\Local\Temp\staticlittlesource.exe"
2052
- InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2196
certreq.exe "C:\Windows\system32\certreq.exe"
2440

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 26, 2023, 10:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 10:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 10:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 10:08 a.m.	computer_name: TEST22-PC	1	1

Command line console output was observed (49 events)

Time & API	Arguments	Status	Return
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: B console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: m console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: b console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: U console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: b console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: h console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: h console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: b console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: h console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: S console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: b console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: x console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: J console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: Q console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: w console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: h console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: h console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: b console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: h console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: G console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: U console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: Outsider console_handle: 0x0000000b	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: C console_handle: 0x0000000b	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: a console_handle: 0x0000000b	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: n console_handle: 0x0000000b	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: c console_handle: 0x0000000b	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: e console_handle: 0x0000000b	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: l console_handle: 0x0000000b	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: o console_handle: 0x0000000b	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: f console_handle: 0x0000000b	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: c console_handle: 0x0000000b	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: a console_handle: 0x0000000b	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: r console_handle: 0x0000000b	1	1
WriteConsoleA June 26, 2023, 10:08 a.m.	buffer: d console_handle: 0x0000000b	1	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.frontb

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 26, 2023, 10 a.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895 stacktrace+0x84 memdup-0x1af @ 0x749a0470 hook_in_monitor+0x45 lde-0x133 @ 0x749942ea New_ntdll_RtlAddVectoredExceptionHandler+0x20 New_ntdll_RtlCompressBuffer-0xed @ 0x749b6340 0x920ee 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x77710895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 2683864 registers.rsi: 20 registers.r10: 0 registers.rbx: 1 registers.rsp: 2685888 registers.r11: 596580 registers.r8: 64 registers.r9: 4280786944 registers.rdx: 2685208 registers.r12: 599640 registers.rbp: 4280786944 registers.rdi: 4280487952 registers.rax: 2683544 registers.r13: 591256	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 26, 2023, 10:08 a.m.	process_identifier: 2196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 53248 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fe0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 10:08 a.m.	process_identifier: 2196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4141056 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fed000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 10:08 a.m.	process_identifier: 2196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77900000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

InstallUtil.exe tried to sleep 172 seconds, actually delayed analysis time by 172 seconds

Executes one or more WMI queries (1 event)

wmi	SELECT * FROM Win32_Processor

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 26, 2023, 10:08 a.m.	process_identifier: 2196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 28672 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00350000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00071200', u'virtual_address': u'0x00036000', u'entropy': 7.995060635322146, u'name': u'.data', u'virtual_size': u'0x00072050'}

entropy

7.99506063532

description

A section with a high entropy has been found

entropy

0.333579063767

description

Overall entropy of this PE file is high

Yara rule detected in process memory (9 events)

description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 7c4b558406f7317baea6dab58e2cde1b3b8730f4

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 26, 2023, 10:08 a.m.	process_identifier: 2196 region_size: 462848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c	1	0	0

Detects Avast Antivirus through the presence of a library (2 events)

Time & API	Arguments	Status	Return	Repeated
LdrGetDllHandle June 26, 2023, 10:08 a.m.	module_name: snxhk.dll module_address: 0x00000000 stack_pivoted: 0		3221225781	0
LdrGetDllHandle June 26, 2023, 10:08 a.m.	module_name: snxhk.dll module_address: 0x00000000 stack_pivoted: 0		3221225781	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2052 called NtSetContextThread to modify thread in remote process 2196
NtSetContextThread June 26, 2023, 10:08 a.m.	registers.eip: 2005598660 registers.esp: 3078588 registers.edi: 0 registers.eax: 4281536 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000020 process_identifier: 2196	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2052 resumed a thread in remote process 2196
NtResumeThread June 26, 2023, 10:08 a.m.	thread_handle: 0x00000020 suspend_count: 1 process_identifier: 2196	1	0	0

Executed a process and injected code into it, probably while unpacking (6 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW June 26, 2023, 10:08 a.m.	thread_identifier: 2200 thread_handle: 0x00000020 process_identifier: 2196 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000002c	1	1
NtGetContextThread June 26, 2023, 10:08 a.m.	thread_handle: 0x00000020	1	0
NtAllocateVirtualMemory June 26, 2023, 10:08 a.m.	process_identifier: 2196 region_size: 462848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c	1	0
NtSetContextThread June 26, 2023, 10:08 a.m.	registers.eip: 2005598660 registers.esp: 3078588 registers.edi: 0 registers.eax: 4281536 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000020 process_identifier: 2196	1	0
NtResumeThread June 26, 2023, 10:08 a.m.	thread_handle: 0x00000020 suspend_count: 1 process_identifier: 2196	1	0
CreateProcessInternalW June 26, 2023, 10:08 a.m.	thread_identifier: 2444 thread_handle: 0x000001e0 process_identifier: 2440 current_directory: filepath: C:\Windows\System32\certreq.exe track: 1 command_line: filepath_r: C:\Windows\system32\certreq.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000198	1	1

staticlittlesource.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All