Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 10, 2023, 7:43 a.m.	Aug. 10, 2023, 7:49 a.m.

Size	1.6MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`eb11d76f4db6786d48ef7ae3f6c3ad9a`
SHA256	`4ceab10c2d3cdb9ae245f25c67fe95e5349d3c632d3b9140112e7d77720b5252`
CRC32	`0CEEF632`
ssdeep	`12288:8NVVyrGvaRlb2nZS1dUpSp3fHdSF9e+dy0p1i3v7fjAu1X:IVNPnZSXUpShf2c+dF1BuR`
PDB Path	f:\builds\vendor\sb_win32bot03_vendor_trunk\build\vendor\xulrunner-1.9.2\mozilla\compiled\xulrunner-release\xulrunner\stub\songbird.pdb
Yara	OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

defense.exe "C:\Users\test22\AppData\Local\Temp\defense.exe"
884

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
5.8.18.42	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 10, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1	0

This executable has a PDB path (1 event)

pdb_path

f:\builds\vendor\sb_win32bot03_vendor_trunk\build\vendor\xulrunner-1.9.2\mozilla\compiled\xulrunner-release\xulrunner\stub\songbird.pdb

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	kbwkmd
section	.eda\x00\x00a
section	.fanchon

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (7 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 10, 2023, 7:43 a.m.	process_identifier: 884 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2023, 7:43 a.m.	process_identifier: 884 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2023, 7:43 a.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778bf000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2023, 7:43 a.m.	process_identifier: 884 region_size: 180224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e70000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2023, 7:43 a.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d10000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2023, 7:43 a.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ea0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2023, 7:43 a.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00eb0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (11 events)

Time & API	Arguments	Status	Return
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: mobsync.exe process_identifier: 1952	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: pw.exe process_identifier: 288	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: wsqmcons.exe process_identifier: 804	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: taskhost.exe process_identifier: 2004	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: sdclt.exe process_identifier: 1836	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: SearchProtocolHost.exe process_identifier: 160	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: cmd.exe process_identifier: 496	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: conhost.exe process_identifier: 300	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: SearchFilterHost.exe process_identifier: 1740	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: defense.exe process_identifier: 884	1	1
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: pw.exe process_identifier: 1268	1	1

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00034600', u'virtual_address': u'0x00110000', u'entropy': 7.989650723307753, u'name': u'kbwkmd', u'virtual_size': u'0x000345c6'}

entropy

7.98965072331

description

A section with a high entropy has been found

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (20 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000080 process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000084 process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000088 process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x0000008c process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000090 process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000094 process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x00000098 process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x0000009c process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000a0 process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000a4 process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000a8 process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000ac process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000b0 process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000b4 process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000b8 process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000bc process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000c0 process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000c4 process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000c8 process_name: pw.exe process_identifier: 1268		0	0
Process32NextW Aug. 10, 2023, 7:43 a.m.	snapshot_handle: 0x000000cc process_name: pw.exe process_identifier: 1268		0	0

Communicates with host for which no DNS query was performed (1 event)

host

5.8.18.42

Expresses interest in specific running processes (1 event)

process: potential process injection target

explorer.exe

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Roaming\loreen.exe:Zone.Identifier

defense.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All