Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Nov. 1, 2023, 9:55 a.m.	Nov. 1, 2023, 9:57 a.m.

Size	1.7MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`065f0871b6025b8e61f35a188bca1d5c`
SHA256	`a2ae5e994c0b515cadd425cfda4d4ae33b71893c45b702e1f8c1a495dc1b440f`
CRC32	`F9D54923`
ssdeep	`49152:D2bzQS8PygnTnAJrvdJEiOYsNmRUxpV4Geb:9RnTn6rFJpLsMR6KRb`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE64 - (no description)

questionnaire.exe "C:\Users\test22\AppData\Local\Temp\questionnaire.exe"
3056
- unpack200.exe "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\crs-agent.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\crs-agent.jar"
  2404
- unpack200.exe "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\charsets.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\charsets.jar"
  2432
- unpack200.exe "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\jsse.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\jsse.jar"
  1648
- unpack200.exe "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\ext\jaccess.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\ext\jaccess.jar"
  1652
- unpack200.exe "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\ext\sunpkcs11.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\ext\sunpkcs11.jar"
  1196
- unpack200.exe "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\ext\openjsse.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\ext\openjsse.jar"
  1844
- unpack200.exe "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\ext\legacy8ujsse.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\ext\legacy8ujsse.jar"
  1020
- unpack200.exe "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\ext\cldrdata.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\ext\cldrdata.jar"
  2120
- unpack200.exe "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\ext\access-bridge-64.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\ext\access-bridge-64.jar"
  2576
- unpack200.exe "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\ext\sunmscapi.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\ext\sunmscapi.jar"
  2516
- unpack200.exe "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\rt.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\rt.jar"
  3036
- windowslauncher.exe "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\windowslauncher.exe" "-Xshare:dump"
  2788

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
146.70.149.61	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 1, 2023, 9:56 a.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ Nov. 1, 2023, 9:56 a.m.	stacktrace: 0x53a03b4 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 0x206 exception.instruction_r: 8b 06 48 8d b5 f8 00 00 00 c5 fe 7f 06 c5 fe 7f exception.instruction: mov eax, dword ptr [rsi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x53a03b4 registers.r14: 2 registers.r15: 2 registers.rcx: 3405691582 registers.rsi: 0 registers.r10: 2 registers.rbx: 133120 registers.rsp: 1209568 registers.r11: 1210384 registers.r8: 87688315 registers.r9: 1210016 registers.rdx: 0 registers.r12: 984 registers.rbp: 1953881840 registers.rdi: 1 registers.rax: 6 registers.r13: 48078672	1	0	0
__exception__ Nov. 1, 2023, 9:56 a.m.	stacktrace: 0x3c3704 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 03 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3c3704 registers.r14: 0 registers.r15: 0 registers.rcx: 48 registers.rsi: 2 registers.r10: 0 registers.rbx: 0 registers.rsp: 1239656 registers.r11: 1245072 registers.r8: 2000388492 registers.r9: 0 registers.rdx: 8796092887632 registers.r12: 1 registers.rbp: 1239776 registers.rdi: 7601 registers.rax: 3946240 registers.r13: 2	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 1, 2023, 9:55 a.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory Nov. 1, 2023, 9:56 a.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 2555904 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000053a0000 process_handle: 0xffffffffffffffff	1	0	0

Creates executable files on the filesystem (47 events)

file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\mlib_image.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\jsoundds.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\w2k_lsa_auth.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834935-5-app\jwutils_win32.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\unpack.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\jsdt.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\zip.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\pack200.exe
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\sunmscapi.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\j2pcsc.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\dt_shmem.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\jawt.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\JavaAccessBridge-64.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\jsound.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\jli.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\nio.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\unpack200.exe
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\fontmanager.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\j2pkcs11.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\npt.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\net.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\jdwp.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\java.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834935-5-app\SimpleService.exe
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\windowslauncher.exe
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\JAWTAccessBridge-64.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\awt.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\server\jvm.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\jjs.exe
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\jaas_nt.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\Remote Access.exe
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\hprof.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\dt_socket.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\freetype.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\splashscreen.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\management.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\java-rmi.exe
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834935-5-app\jwutils_win64.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\verify.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\msvcr100.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\sunec.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\javaw.exe
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\lcms.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\java.exe
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\jpeg.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\WindowsAccessBridge-64.dll
file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\bin\instrument.dll

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Nov. 1, 2023, 9:55 a.m.	flags: 15 family: 0		111	0

Communicates with host for which no DNS query was performed (1 event)

host

146.70.149.61

Deletes executed files from disk (1 event)

file	C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1698834936-6-app\lib\ext\jaccess.jar.p2

File has been identified by 13 AntiVirus engines on VirusTotal as malicious (13 events)

Skyhigh	Artemis
Cylance	unsafe
K7AntiVirus	Trojan ( 005acd7b1 )
K7GW	Trojan ( 005acd7b1 )
Kaspersky	not-a-virus:HEUR:RemoteAdmin.Win64.Remsim.gen
Rising	Hacktool.Remsim!8.180EE (CLOUD)
Sophos	Generic Reputation PUA (PUA)
Zillya	Tool.Remsim.Win64.1
Jiangmin	RemoteAdmin.Remsim.b
ZoneAlarm	not-a-virus:HEUR:RemoteAdmin.Win64.Remsim.gen
McAfee	Artemis!065F0871B602
DeepInstinct	MALICIOUS
MaxSecure	Trojan.Malware.207043384.susgen

questionnaire.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All