Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 18, 2023, 7:34 a.m.	Aug. 18, 2023, 7:41 a.m.

Size	729.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`3e829ce0029df6886e3e865dc44860b0`
SHA256	`0169ca9bc5137b1dc1c57b92fe05db758e34ee1aeb5b8fda0f3896a5e6be0df5`
CRC32	`0249B5A9`
ssdeep	`12288:LMrCy90aBW4N/tcVnbtkNWRUVu1vDdWXVJGiAomL9vVItdalKJqe7auzKR5FXyp5:Ny/W4QVnJkQRXdIQiANZNgwOB7aIKzFa`
PDB Path	wextract.pdb
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature CAB_file_format - CAB archive file Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet IsPE32 - (no description)

foto4055.exe "C:\Users\test22\AppData\Local\Temp\foto4055.exe"
2548
- x4256563.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\x4256563.exe
  2600
  - x6293952.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\x6293952.exe
    2668
    - x6435238.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\x6435238.exe
      2724
      - g2839529.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\g2839529.exe
        2768
        
        cmd.exe "C:\Windows\System32\cmd.exe" /k shutdown -s -t 0
        2828
        
        shutdown.exe shutdown -s -t 0
        2892

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Aug. 18, 2023, 7:34 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP003.TMP> console_handle: 0x00000007	1	1	0

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 18, 2023, 7:34 a.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

Allocates read-write-execute memory (usually to unpack itself) (13 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 18, 2023, 7:34 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 7:34 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73261000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 7:34 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 7:34 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 7:34 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 7:34 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73261000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 7:34 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 7:34 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 7:34 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 7:34 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 7:34 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 7:34 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75b71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2023, 7:34 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d01000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (8 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW Aug. 18, 2023, 7:34 a.m.	number_of_free_clusters: 3252038 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Aug. 18, 2023, 7:34 a.m.	number_of_free_clusters: 3252038 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Aug. 18, 2023, 7:34 a.m.	number_of_free_clusters: 3251862 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Aug. 18, 2023, 7:34 a.m.	number_of_free_clusters: 3251862 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Aug. 18, 2023, 7:34 a.m.	number_of_free_clusters: 3251719 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Aug. 18, 2023, 7:34 a.m.	number_of_free_clusters: 3251719 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Aug. 18, 2023, 7:34 a.m.	number_of_free_clusters: 3251605 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Aug. 18, 2023, 7:34 a.m.	number_of_free_clusters: 3251605 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1

Creates executable files on the filesystem (8 events)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\k3103353.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\x6435238.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\h3613909.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\x6293952.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\j8810269.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\g2839529.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\x4256563.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\i5731604.exe

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /k shutdown -s -t 0

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 18, 2023, 7:34 a.m.	show_type: 0 filepath_r: cmd parameters: /k shutdown -s -t 0 filepath: cmd	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000ade00', u'virtual_address': u'0x0000c000', u'entropy': 7.92777150370099, u'name': u'.rsrc', u'virtual_size': u'0x000ae000'}

entropy

7.9277715037

description

A section with a high entropy has been found

entropy

0.955357142857

description

Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	"C:\Windows\System32\cmd.exe" /k shutdown -s -t 0
cmdline	shutdown -s -t 0
cmdline	cmd /k shutdown -s -t 0

Installs itself for autorun at Windows startup (4 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP002.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP003.TMP\"

foto4055.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All