Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 24, 2023, 6:02 p.m.	Aug. 24, 2023, 6:10 p.m.

Size	431.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`840006dac67d23b7725020c8441a6a4b`
SHA256	`31fd5ab4ff38fd42399d4d90a19da71b94cd7ba47b0a97ce1bda37958ce97ef6`
CRC32	`245D1D1C`
ssdeep	`6144:xougwOscwOzGNKDazRtZoZdLJufjI3RYOllVn9k/6E9MzKi:oacjzkRfG9OI3799k/6E9M+`
PDB Path	NNJj.pdb
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) ConfuserEx_Zero - Confuser .NET IsPE32 - (no description)

wininit.exe "C:\Users\test22\AppData\Local\Temp\wininit.exe"
1492

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
108.181.20.35	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 24, 2023, 6:02 p.m.			0	0
IsDebuggerPresent Aug. 24, 2023, 6:02 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

NNJj.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 24, 2023, 6:02 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	"1tT\x1b\x10"l
section

Allocates read-write-execute memory (usually to unpack itself) (26 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00660000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0061b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00617000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 249856 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002b2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e53000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00615000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e55000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e56000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00606000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0060a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00607000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e59000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 1492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0003d000', u'virtual_address': u'0x00002000', u'entropy': 7.999345404408391, u'name': u'"1tT\\x1b\\x10"l', u'virtual_size': u'0x0003cf80'}

entropy

7.99934540441

description

A section with a high entropy has been found

entropy

0.566782810685

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 24, 2023, 6:02 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Aug. 24, 2023, 6:02 p.m.	status_code: 0xffffffff process_identifier: 2136 process_handle: 0x0000022c		0	0
NtTerminateProcess Aug. 24, 2023, 6:02 p.m.	status_code: 0xffffffff process_identifier: 2136 process_handle: 0x0000022c	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

108.181.20.35

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 2136 region_size: 200704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000224		3221225496	0

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1492 manipulating memory of non-child process 2136
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 2136 region_size: 200704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000224		3221225496	0

Executed a process and injected code into it, probably while unpacking (10 events)

Time & API	Arguments	Status	Return
NtResumeThread Aug. 24, 2023, 6:02 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1492	1	0
NtResumeThread Aug. 24, 2023, 6:02 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 1492	1	0
NtResumeThread Aug. 24, 2023, 6:02 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 1492	1	0
NtResumeThread Aug. 24, 2023, 6:02 p.m.	thread_handle: 0x000001f4 suspend_count: 1 process_identifier: 1492	1	0
NtGetContextThread Aug. 24, 2023, 6:02 p.m.	thread_handle: 0x000000e8	1	0
NtGetContextThread Aug. 24, 2023, 6:02 p.m.	thread_handle: 0x000000e8	1	0
NtResumeThread Aug. 24, 2023, 6:02 p.m.	thread_handle: 0x000000e8 suspend_count: 1 process_identifier: 1492	1	0
CreateProcessInternalW Aug. 24, 2023, 6:02 p.m.	thread_identifier: 2140 thread_handle: 0x00000220 process_identifier: 2136 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe track: 1 command_line: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe" filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000224	1	1
NtGetContextThread Aug. 24, 2023, 6:02 p.m.	thread_handle: 0x00000220	1	0
NtAllocateVirtualMemory Aug. 24, 2023, 6:02 p.m.	process_identifier: 2136 region_size: 200704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000224		3221225496

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Bkav	W32.Common.72C3C045
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Lazy.377778
FireEye	Generic.mg.840006dac67d23b7
CAT-QuickHeal	Trojan.IGENERIC
McAfee	Artemis!840006DAC67D
Cylance	unsafe
Zillya	Trojan.Noon.Win32.30292
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005a1d701 )
Alibaba	TrojanSpy:MSIL/Kryptik.8af813bf
K7GW	Trojan ( 005a1d701 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.MSILHeracles.D18482
VirIT	Trojan.Win32.GenusT.DPVE
Cyren	W32/Noon.AR.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.AIMG
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan-Spy.MSIL.Noon.gen
BitDefender	Gen:Variant.Lazy.377778
Avast	Win32:CrypterX-gen [Trj]
Tencent	Malware.Win32.Gencirc.13ecb019
Emsisoft	Gen:Variant.Lazy.377778 (B)
F-Secure	Trojan.TR/Kryptik.pgfcg
DrWeb	Trojan.Inject4.60263
VIPRE	Gen:Variant.Lazy.377778
TrendMicro	TROJ_GEN.R002C0XHL23
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Jiangmin	Backdoor.MSIL.NanoBot.t
Avira	TR/Kryptik.pgfcg
Antiy-AVL	Trojan/MSIL.Kryptik
Gridinsoft	Trojan.Heur!.03012281
Microsoft	Trojan:Win32/FormBook.AFK!MTB
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Noon.gen
GData	Gen:Variant.Lazy.377778
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R519514
ALYac	Gen:Variant.Lazy.377778
MAX	malware (ai score=87)
Malwarebytes	Trojan.MalPack
TrendMicro-HouseCall	TROJ_GEN.R002C0XHL23
Rising	Malware.Obfus/MSIL@AI.94 (RDM.MSIL2:5OiQKhvAoHrnzZjd4d+5yQ)
Ikarus	Trojan-Spy.FormBook
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.AIMG!tr

wininit.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All