Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 8, 2023, 6:28 p.m.	Oct. 8, 2023, 6:35 p.m.

Size	2.8MB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`e674688f489f2e6dcfdf18af1ac37858`
SHA256	`2e16414b9a060e10b673f184cb2b09f163c05eb8c3e7cd2d0b87cb7b6f72912c`
CRC32	`B4B9E838`
ssdeep	`49152:KuPKYM3alrj2U+qo8dnKkL1/wKXsWulwToGnMMTbhpS6RIgobKPpmPJQS/GSuyKy:QG1PpBF`
Yara	UPX_Zero - UPX packed file Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature IsPE64 - (no description)

netTimer.exe "C:\Users\test22\AppData\Local\Temp\netTimer.exe"
1968

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Oct. 8, 2023, 6:21 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 8, 2023, 6:21 p.m.			0	0
IsDebuggerPresent Oct. 8, 2023, 6:21 p.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 8, 2023, 6:21 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sdata

Allocates read-write-execute memory (usually to unpack itself) (50 out of 261 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000007a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3641000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cdb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000025c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002770000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3644000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3644000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3644000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3644000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93eba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ecc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe940a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 1581056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe940a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94223000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f96000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ee0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ee0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ee0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ee2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000fd1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000fd1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000fd1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000fd1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000fd1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000fd1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000fd1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000fd1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000fd1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000fd1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 8, 2023, 6:21 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000fd1000 process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

netTimer.exe tried to sleep 203 seconds, actually delayed analysis time by 203 seconds

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00000c00', u'virtual_address': u'0x002ca000', u'entropy': 7.767903725378316, u'name': u'.sdata', u'virtual_size': u'0x00000b98'}

entropy

7.76790372538

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 8, 2023, 6:21 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Enumerates services, possibly for anti-virtualization (1 event)

Time & API	Arguments	Status	Return	Repeated
EnumServicesStatusW Oct. 8, 2023, 6:21 p.m.	service_handle: 0x000000001e08d8f0 service_type: 48 service_status: 3		0	0

Detects the presence of Wine emulator (1 event)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress Oct. 8, 2023, 6:21 p.m.	ordinal: 0 function_address: 0x00000000001bed38 function_name: wine_get_unix_file_name module: KERNEL32 module_address: 0x0000000076fc0000		-1073741511	0

File has been identified by 32 AntiVirus engines on VirusTotal as malicious (32 events)

Bkav	W64.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
FireEye	Generic.mg.e674688f489f2e6d
Skyhigh	BehavesLike.Win64.PUPXAD.vm
Cylance	unsafe
Sangfor	Trojan.Win32.Agent.Vlqc
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Packed:MSIL/DotNetGuard.f9f172a7
VirIT	Trojan.Win64.MSIL_Heur.B
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Packed.DotNetGuard.A suspicious
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Generic
Avast	Win64:TrojanX-gen [Trj]
Tencent	Win32.Trojan.Generic.Vwhl
DrWeb	Trojan.PackedNET.2228
Sophos	Mal/Miner-AX
SentinelOne	Static AI - Malicious PE
Gridinsoft	Ransom.Win64.Wacatac.sa
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan.Win32.Generic
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5501464
McAfee	Artemis!E674688F489F
Panda	Trj/Chgt.AD
Ikarus	Trojan.MSIL.CoinMiner
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win64:TrojanX-gen [Trj]
Cybereason	malicious.3fce86
DeepInstinct	MALICIOUS

netTimer.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All