popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Update_controller.exe

Malicious Library UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 10, 2023, 4:52 p.m. Sept. 10, 2023, 4:54 p.m.
Size 1.1MB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 0787b3b6049ce57921fa6f32fcc33c67
SHA256 c27968c70424a38c6f692921062abcdd71714ad0ab1e6a16abaf28fc44602253
CRC32 51D34ABB
ssdeep 24576:nCpCajB3BZcVYwg1PqwaxMu6eo89TZ4fFq0Y:nu1ghr1P
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "SecurityHandle" has successfully been created.
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 876544
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76f20000
process_handle: 0xffffffff
1 0 0
cmdline schtasks.exe /CREATE /TN "SecurityHandle" /TR "C:\ProgramData\SecurityDump\SecurityUpdate.exe" /SC MINUTE /RL HIGHEST
cmdline c /c powershell Add-MpPreference -ExclusionPath "C:\ProgramData\SecurityDump"
cmdline "C:\Windows\System32\schtasks.exe" /CREATE /TN "SecurityHandle" /TR "C:\ProgramData\SecurityDump\SecurityUpdate.exe" /SC MINUTE /RL HIGHEST
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: schtasks.exe
parameters: /CREATE /TN "SecurityHandle" /TR "C:\ProgramData\SecurityDump\SecurityUpdate.exe" /SC MINUTE /RL HIGHEST
filepath: schtasks.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: c
parameters: /c powershell Add-MpPreference -ExclusionPath "C:\ProgramData\SecurityDump"
filepath: c
0 0
cmdline schtasks.exe /CREATE /TN "SecurityHandle" /TR "C:\ProgramData\SecurityDump\SecurityUpdate.exe" /SC MINUTE /RL HIGHEST
cmdline "C:\Windows\System32\schtasks.exe" /CREATE /TN "SecurityHandle" /TR "C:\ProgramData\SecurityDump\SecurityUpdate.exe" /SC MINUTE /RL HIGHEST
cmdline schtasks.exe /CREATE /TN "SecurityHandle" /TR "C:\ProgramData\SecurityDump\SecurityUpdate.exe" /SC MINUTE /RL HIGHEST
cmdline "C:\Windows\System32\schtasks.exe" /CREATE /TN "SecurityHandle" /TR "C:\ProgramData\SecurityDump\SecurityUpdate.exe" /SC MINUTE /RL HIGHEST
Bkav W32.AIDetectMalware
Cynet Malicious (score: 100)
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
APEX Malicious
Kaspersky UDS:DangerousObject.Multi.Generic
McAfee-GW-Edition Artemis!Trojan
FireEye Generic.mg.0787b3b6049ce579
Jiangmin Trojan.Agent.dmcr
Gridinsoft Ransom.Win32.Wacatac.sa
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Trojan:Win32/Sabsik.FL.B!ml
McAfee Artemis!0787B3B6049C
SentinelOne Static AI - Suspicious PE
DeepInstinct MALICIOUS