Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Nov. 8, 2023, 10:02 a.m.	Nov. 8, 2023, 10:04 a.m.

Size	34.7MB
Type	RAR archive data, v5
MD5	`128e1564f4afaf681a3572f8667f6bd4`
SHA256	`f2498016ed30f0cc216d9ea9810acf21e6f62b63a999ad69941dfacc75d26bb3`
CRC32	`0486BB9D`
ssdeep	`786432:FPPM86ONdg6V+38tuT46ShyuesGuzghb6xhb49aC+YnAJR6wCKcv:FnM8rY6V+stVhjeS6b6xJaagwbcv`
Yara	None matched

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "giIR" C:\Users\test22\AppData\Local\Temp\Launcher_Password_1234.rar
3048
- 7zFM.exe "C:\Program Files (x86)\7-Zip\7zFM.exe" "C:\Users\test22\AppData\Local\Temp\Launcher_Password_1234.rar"
  2188

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 8, 2023, 10:02 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 8, 2023, 10:02 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 8, 2023, 10:02 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74012000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Nov. 8, 2023, 10:02 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x721d3000 process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (38 events)

file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.Windows.Widgets.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.WindowsAppRuntime.Insights.Resource.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\marshal.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.WindowsAppRuntime.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\CoreMessagingXP.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.Windows.ApplicationModel.Resources.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\MRM.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\DwmSceneI.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\WindowsAppSdk.AppxDeploymentExtensions.Desktop.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\sdks\sdk_legacy_steering_wheel_x64.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.UI.Xaml.Phone.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\dwmcorei.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\sdks\sdk_legacy_led_x64.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.UI.Xaml.Internal.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.Internal.FrameworkUdk.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Launcher.exe
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\DWriteCore.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.Graphics.Display.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.Web.WebView2.Core.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\dcompi.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.WindowsAppRuntime.Release.Net.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\sdks\sdk_legacy_steering_wheel_x86.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.ui.xaml.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.InputStateManager.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.WindowsAppRuntime.Bootstrap.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.DirectManipulation.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.UI.Xaml.Controls.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.UI.Input.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\WinUIEdit.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.UI.Composition.OSSupport.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.ui.xaml.resources.common.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\sdks\trueforce_sdk_x86.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\sdks\sdk_legacy_led_x86.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\sdks\trueforce_sdk_x64.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.ui.xaml.resources.19h1.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\PushNotificationsLongRunningTask.ProxyStub.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\Microsoft.UI.Windowing.Core.dll
file	C:\Users\test22\AppData\Local\Temp\7zEC88E25E3\Bin\system_tray\wuceffectsi.dll

File has been identified by one AntiVirus engine on VirusTotal as malicious (1 event)

Skyhigh

Artemis!Trojan

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 8, 2023, 10:02 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1	0
LookupPrivilegeValueW Nov. 8, 2023, 10:02 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1	0

Yara rule detected in process memory (11 events)

description	Escalate priviledges	rule	Escalate_priviledges
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Run a KeyLogger	rule	KeyLogger

Launcher_Password_1234.rar

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All