Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 22, 2024, 1:23 p.m.	May 22, 2024, 1:25 p.m.

Size	1.7KB
Type	ASCII text, with CRLF line terminators
MD5	`ce802b6e8add0c59b4c1ceea614bafa3`
SHA256	`419010826148482cca4ad662fdbdc8eac445b4b6181e4a1f4b62d7eb7783f4e2`
CRC32	`03684316`
ssdeep	`48:3T9KLhHbYOCTRAY726lsu5ltuur8lYva9KCm0gYZn0jH:BNfRAwry9ROjH`
Yara	None matched

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "HnbFriUQm" C:\Users\test22\AppData\Local\Temp\dr.bat
2548
- cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\dr.bat
  2620
  - mshta.exe mshta vbscript:createobject("wscript.shell").run("""e:\net\dr\dr.bat"" h",0)(window.close)
    2708

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 22, 2024, 1:23 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW May 22, 2024, 1:23 p.m.	buffer: if console_handle: 0x00000007	1	1
WriteConsoleW May 22, 2024, 1:23 p.m.	buffer: "" == "h" console_handle: 0x00000007	1	1
WriteConsoleW May 22, 2024, 1:23 p.m.	buffer: goto console_handle: 0x00000007	1	1
WriteConsoleW May 22, 2024, 1:23 p.m.	buffer: begin console_handle: 0x00000007	1	1
WriteConsoleW May 22, 2024, 1:23 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW May 22, 2024, 1:23 p.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW May 22, 2024, 1:23 p.m.	buffer: mshta vbscript:createobject("wscript.shell").run("""e:\net\dr\dr.bat"" h",0)(window.close) console_handle: 0x00000007	1	1
WriteConsoleW May 22, 2024, 1:23 p.m.	buffer: exit console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 22, 2024, 1:23 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (16 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03da0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03da0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03da0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03da0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03da0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03da0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03da0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03da1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03da1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03da1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03da2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03da2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03da2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03da2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03da2000 process_handle: 0xffffffff	1

Creates a suspicious process (1 event)

cmdline

mshta vbscript:createobject("wscript.shell").run("""e:\net\dr\dr.bat"" h",0)(window.close)

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW May 22, 2024, 1:23 p.m.	show_type: 0 filepath_r: e:\net\dr\dr.bat parameters: h filepath: e:\net\dr\dr.bat		0	0

File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 events)

Kaspersky	HEUR:Trojan-Downloader.BAT.Generic
ZoneAlarm	HEUR:Trojan-Downloader.BAT.Generic

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 22, 2024, 1:23 p.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 16 (PAGE_EXECUTE) base_address: 0x03da0000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (50 out of 62 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win
description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

e:\net\dr\dr.bat h

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2620 resumed a thread in remote process 2708
NtResumeThread May 22, 2024, 1:23 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2708	1	0	0

dr.bat

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All