Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 10, 2024, 9:43 a.m.	March 10, 2024, 9:57 a.m.

Size	404.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`573ac709bae3d9e95d795220a778d3a2`
SHA256	`a8773dcb9829d8a6e41bba1de6f8ce14a008fd811336657f5489b65b8af15acc`
CRC32	`E0842A1F`
ssdeep	`6144:sjJeKScBVOCB6+3wLYVscDymE/7HmAUZFkHkYTrpxu+bUzIcg+geP2ZK5UXt2QU:sjJeKbBg+sVmEZCoBxPPVfo5y`
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) anti_vm_detect - Possibly employs anti-virtualization techniques

CNN.exe "C:\Users\test22\AppData\Local\Temp\CNN.exe"
1984

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 10, 2024, 9:43 a.m.			0	0
IsDebuggerPresent March 10, 2024, 9:43 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 10, 2024, 9:43 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (25 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00392000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0039a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 241664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0039c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02090000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02150000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02160000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02170000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Possibly employs anti-virtualization techniques	rule	vmdetect
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 2120 region_size: 270336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000230		3221225496	0

Manipulates memory of a non-child process indicative of process injection (3 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 1984 manipulating memory of non-child process 2120
NtUnmapViewOfSection March 10, 2024, 9:43 a.m.	base_address: 0x00400000 region_size: 774144 process_identifier: 2120 process_handle: 0x00000230	3221225497	0
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 2120 region_size: 270336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000230	3221225496	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1984 injected into non-child 2120
WriteProcessMemory March 10, 2024, 9:43 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2120 process_handle: 0x00000230	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1984 called NtSetContextThread to modify thread in remote process 2120
NtSetContextThread March 10, 2024, 9:43 a.m.	registers.eip: 2005598660 registers.esp: 4980532 registers.edi: 0 registers.eax: 4441342 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000234 process_identifier: 2120	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1984 resumed a thread in remote process 2120
NtResumeThread March 10, 2024, 9:43 a.m.	thread_handle: 0x00000234 suspend_count: 1 process_identifier: 2120	1	0	0

Executed a process and injected code into it, probably while unpacking (14 events)

Time & API	Arguments	Status	Return
NtResumeThread March 10, 2024, 9:43 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1984	1	0
NtResumeThread March 10, 2024, 9:43 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 1984	1	0
NtResumeThread March 10, 2024, 9:43 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 1984	1	0
CreateProcessInternalW March 10, 2024, 9:43 a.m.	thread_identifier: 2124 thread_handle: 0x00000234 process_identifier: 2120 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\CNN.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\CNN.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000230	1	1
NtUnmapViewOfSection March 10, 2024, 9:43 a.m.	base_address: 0x00400000 region_size: 774144 process_identifier: 2120 process_handle: 0x00000230		3221225497
NtAllocateVirtualMemory March 10, 2024, 9:43 a.m.	process_identifier: 2120 region_size: 270336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000230		3221225496
WriteProcessMemory March 10, 2024, 9:43 a.m.	buffer: base_address: 0x00400000 process_identifier: 2120 process_handle: 0x00000230		0
WriteProcessMemory March 10, 2024, 9:43 a.m.	buffer: base_address: 0x00402000 process_identifier: 2120 process_handle: 0x00000230		0
WriteProcessMemory March 10, 2024, 9:43 a.m.	buffer: base_address: 0x0043e000 process_identifier: 2120 process_handle: 0x00000230		0
WriteProcessMemory March 10, 2024, 9:43 a.m.	buffer: base_address: 0x00440000 process_identifier: 2120 process_handle: 0x00000230		0
NtGetContextThread March 10, 2024, 9:43 a.m.	thread_handle: 0x00000234	1	0
WriteProcessMemory March 10, 2024, 9:43 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2120 process_handle: 0x00000230	1	1
NtSetContextThread March 10, 2024, 9:43 a.m.	registers.eip: 2005598660 registers.esp: 4980532 registers.edi: 0 registers.eax: 4441342 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000234 process_identifier: 2120	1	0
NtResumeThread March 10, 2024, 9:43 a.m.	thread_handle: 0x00000234 suspend_count: 1 process_identifier: 2120	1	0

File has been identified by 40 AntiVirus engines on VirusTotal as malicious (40 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Disco.i!c
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.Generic.gh
Cylance	unsafe
VIPRE	Trojan.GenericKD.71889977
Sangfor	Infostealer.Msil.Agent.Veci
BitDefender	Trojan.GenericKD.71889977
Arcabit	Trojan.Generic.D448F439
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	MSIL/Spy.AgentTesla.I
APEX	Malicious
McAfee	Artemis!573AC709BAE3
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan-PSW.MSIL.Disco.gen
MicroWorld-eScan	Trojan.GenericKD.71889977
Rising	Malware.Obfus/MSIL@AI.87 (RDM.MSIL2:AXknGmJftY1raDWdAnlN3A)
Emsisoft	Trojan.GenericKD.71889977 (B)
TrendMicro	TrojanSpy.Win32.NEGASTEAL.YXECIZ
FireEye	Generic.mg.573ac709bae3d9e9
Sophos	Mal/Generic-S
Google	Detected
MAX	malware (ai score=82)
Antiy-AVL	Trojan[PSW]/MSIL.Disco
Kingsoft	malware.kb.c.999
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	HackTool:Win64/Mimikatz.A
ViRobot	Trojan.Win.Z.Wacatac.413696
GData	MSIL.Trojan-Stealer.AgentTesla.297JJ7
Varist	W32/MSIL_Kryptik.KRK.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.C5571186
BitDefenderTheta	Gen:NN.ZemsilF.36802.zm0@aabVrUk
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware/Suspicious
TrendMicro-HouseCall	TrojanSpy.Win32.NEGASTEAL.YXECIZ
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenKryptik.GSWO!tr
AVG	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

CNN.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All