Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 10, 2023, 9:15 a.m.	Sept. 10, 2023, 9:22 a.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`f5f13d296ccbe05f3b4236e58e130ac3`
SHA256	`f7891fb963a90cb5f84fdd754b0c7d1e54c3945c1d84bf52ff989712e5139422`
CRC32	`D96C9A86`
ssdeep	`12288:3aEROK5Ufmy3GeEucfL/y9Iz5+XaQi7BjEd1pxpuB7InioGnhk4bihPMq4cf8D1+:3aqZ53y2rWWz5+10Ezbspnhk5MqDf8J`
Yara	UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) IsPE32 - (no description)

GoogleUpdate.exe "C:\Users\test22\AppData\Local\Temp\GoogleUpdate.exe"
2552

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
54.250.156.221	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Sept. 10, 2023, 9:15 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Sept. 10, 2023, 9:15 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 10, 2023, 9:15 a.m.			0	0
IsDebuggerPresent Sept. 10, 2023, 9:15 a.m.			0	0
IsDebuggerPresent Sept. 10, 2023, 9:15 a.m.			0	0
IsDebuggerPresent Sept. 10, 2023, 9:15 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 10, 2023, 9:15 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (30 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72de2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7341b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02720000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0071c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7334a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00835000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0083b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00837000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0072a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00727000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73251000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0071a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7395f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ffc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ff84000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ffc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00726000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fd01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f1f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:15 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f088000 process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

54.250.156.221

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W32.Common.A1E3402F
Lionic	Trojan.Win32.Inject.1b!c
tehtris	Generic.Malware
DrWeb	Trojan.PackedNET.2275
MicroWorld-eScan	Gen:Variant.Lazy.389202
ALYac	Gen:Variant.MSILHeracles.103489
Malwarebytes	Malware.AI.986202932
VIPRE	Gen:Variant.Lazy.389202
K7AntiVirus	Trojan ( 005aa73a1 )
Alibaba	Trojan:MSIL/Inject.e7da7c01
K7GW	Trojan ( 005aa73a1 )
Arcabit	Trojan.Lazy.D5F052
BitDefenderTheta	Gen:NN.ZemsilF.36662.gn0@aOG@9Xe
Cyren	W32/ABRisk.RYJT-8716
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.AJMR
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.MSIL.Inject.gen
BitDefender	Gen:Variant.Lazy.389202
Avast	Win32:RansomX-gen [Ransom]
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:qXbJGysnwYdcVroHRuNMpQ)
Emsisoft	Gen:Variant.Lazy.389202 (B)
F-Secure	Trojan.TR/Kryptik.kdojo
TrendMicro	TROJ_GEN.R014C0DI823
McAfee-GW-Edition	Artemis!Trojan
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.f5f13d296ccbe05f
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Avira	TR/Kryptik.kdojo
MAX	malware (ai score=89)
Gridinsoft	Trojan.Win32.Packed.sa
Xcitium	Malware@#4iv3wdsz3km3
Microsoft	Trojan:MSIL/DarkTortilla.AAKX!MTB
ZoneAlarm	HEUR:Trojan.MSIL.Inject.gen
GData	Gen:Variant.Lazy.389202
Google	Detected
AhnLab-V3	Trojan/Win.DarkTortilla.C5484051
McAfee	Artemis!F5F13D296CCB
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_GEN.R014C0DI823
Tencent	Msil.Trojan.Inject.Pcnw
Ikarus	Trojan.Inject
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.AJJX!tr
AVG	Win32:RansomX-gen [Ransom]
DeepInstinct	MALICIOUS

GoogleUpdate.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All