Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 10, 2023, 7:43 a.m.	Aug. 10, 2023, 7:47 a.m.

Size	1.6MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`18462ea23f4eb50b95c5c3c30674f26c`
SHA256	`fbf003e40568ccf053e2abd44541c8a2da441970e6e59231612de39ee0d0273e`
CRC32	`8DEBD708`
ssdeep	`12288:QNVVsrGvaRlb2nZS1dUpSp3fHdwBhT3eTcS5x:8VTPnZSXUpShfWBhT3ewS5`
PDB Path	f:\builds\vendor\sb_win32bot03_vendor_trunk\build\vendor\xulrunner-1.9.2\mozilla\compiled\xulrunner-release\xulrunner\stub\songbird.pdb
Yara	OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

index.exe "C:\Users\test22\AppData\Local\Temp\index.exe"
1208

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
5.8.18.42	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 10, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1	0

This executable has a PDB path (1 event)

pdb_path

f:\builds\vendor\sb_win32bot03_vendor_trunk\build\vendor\xulrunner-1.9.2\mozilla\compiled\xulrunner-release\xulrunner\stub\songbird.pdb

The executable contains unknown PE section names indicative of a packer (could be a false positive) (6 events)

section	etedse
section	.derek
section	.evangel
section	.arlyn
section	.hemant
section	.emile

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (7 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 10, 2023, 7:43 a.m.	process_identifier: 1208 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2023, 7:43 a.m.	process_identifier: 1208 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2023, 7:43 a.m.	process_identifier: 1208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778bf000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2023, 7:43 a.m.	process_identifier: 1208 region_size: 180224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02820000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2023, 7:43 a.m.	process_identifier: 1208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2023, 7:43 a.m.	process_identifier: 1208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02780000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2023, 7:43 a.m.	process_identifier: 1208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (35 events)

Time & API	Arguments	Status	Return
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: smss.exe process_identifier: 232	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: csrss.exe process_identifier: 308	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: wininit.exe process_identifier: 344	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: csrss.exe process_identifier: 356	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: winlogon.exe process_identifier: 392	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: services.exe process_identifier: 436	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: lsass.exe process_identifier: 452	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: lsm.exe process_identifier: 460	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: svchost.exe process_identifier: 560	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: svchost.exe process_identifier: 636	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: svchost.exe process_identifier: 716	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: svchost.exe process_identifier: 780	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: svchost.exe process_identifier: 824	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: audiodg.exe process_identifier: 896	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: svchost.exe process_identifier: 984	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: svchost.exe process_identifier: 340	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: spoolsv.exe process_identifier: 1060	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: taskhost.exe process_identifier: 1112	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: svchost.exe process_identifier: 1120	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: dwm.exe process_identifier: 1192	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: explorer.exe process_identifier: 1236	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: svchost.exe process_identifier: 1744	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: pw.exe process_identifier: 1888	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: SearchIndexer.exe process_identifier: 1652	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: mobsync.exe process_identifier: 2032	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: pw.exe process_identifier: 1684	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: wsqmcons.exe process_identifier: 880	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: sdclt.exe process_identifier: 2040	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: taskhost.exe process_identifier: 1280	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: SearchProtocolHost.exe process_identifier: 1028	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: cmd.exe process_identifier: 1960	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: conhost.exe process_identifier: 776	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: SearchFilterHost.exe process_identifier: 1688	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: index.exe process_identifier: 1208	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: pw.exe process_identifier: 1488	1	1

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00035200', u'virtual_address': u'0x00110000', u'entropy': 7.982206502601072, u'name': u'etedse', u'virtual_size': u'0x000350de'}

entropy

7.9822065026

description

A section with a high entropy has been found

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (20 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000084 process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000088 process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x0000008c process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000090 process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000094 process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000098 process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x0000009c process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000a0 process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000a4 process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000a8 process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000ac process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000b0 process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000b4 process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000b8 process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000bc process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000c0 process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000c4 process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000c8 process_name: pw.exe process_identifier: 1488		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000cc process_name: pw.exe process_identifier: 1488		0	0

Communicates with host for which no DNS query was performed (1 event)

host

5.8.18.42

Expresses interest in specific running processes (1 event)

process: potential process injection target

explorer.exe

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Roaming\reter.exe:Zone.Identifier

index.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All