popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

proposal%20report.exe

Gen1 Formbook Process Kill Suspicious_Script_Bin Generic Malware UPX CryptGenKey Malicious Library FindFirstVolume
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 9, 2024, 9:10 a.m. June 9, 2024, 9:17 a.m.
Size 1.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 092cd26903ed79eb7da016adbb7c928d
SHA256 65faa8e4546890c7052df20e18d9452f7af742cfc7ee10ab3e127d3d5bdf6c86
CRC32 C059F191
ssdeep 24576:/AHnh+eWsN3skA4RV1Hom2KXMmHaA4EzWJmYFBXVogy1w5:ih+ZkldoPK8YaA4GW8aBqg9
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Process_Snapshot_Kill_Zero - Process Kill Zero
  • PE_Header_Zero - PE File Signature
  • FindFirstVolume_Zero - FindFirstVolume Zero
  • CryptGenKey_Zero - CryptGenKey Zero
  • Device_Check_Zero - Device Check Zero
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49178 -> 202.172.28.202:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49180 -> 116.50.37.244:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49182 -> 46.30.213.191:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49189 -> 195.110.124.133:80 2045975 ET INFO HTTP Request to a *.zip Domain Misc activity
UDP 192.168.56.101:52753 -> 8.8.8.8:53 2045759 ET INFO Observed DNS Query to .zip TLD Misc activity
TCP 192.168.56.101:49184 -> 85.159.66.93:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49188 -> 66.29.149.46:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49190 -> 195.110.124.133:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49190 -> 195.110.124.133:80 2045975 ET INFO HTTP Request to a *.zip Domain Misc activity
TCP 192.168.56.101:49170 -> 154.215.72.110:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49186 -> 91.195.240.94:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
request POST http://www.3xfootball.com/fo8o/
request GET http://www.3xfootball.com/fo8o/?mRfW=IhZyPQIGe6uK3zPwwQVGm4hCASyaX3xlW2eS79Xk6ut4afzj0LiRHBqZsEmyTx+18GfGhVOagMos+c9dx/PGjLGAfpOvJ7U3hUqpnKd0zHv/hQdGhX4G3JlCydyJ23yerjxn4r8=&SM4k=DX6TxPgI
request GET http://www.sqlite.org/2021/sqlite-dll-win32-x86-3340000.zip
request GET http://www.sqlite.org/2020/sqlite-dll-win32-x86-3310000.zip
request POST http://www.kasegitai.tokyo/fo8o/
request GET http://www.kasegitai.tokyo/fo8o/?mRfW=0LNqIGaAWMhMIMLOr1FzuAu+QFTp+Isr9lFre+yu3/9GvRNYi1uHghhDsQ/pqDAQ+wkUrFUIurr7TLyDqzId9vCn3h40hICDSYZjejM1bTxHHnFMxARLyMCZMUhSp6GMEGHL0HI=&SM4k=DX6TxPgI
request POST http://www.goldenjade-travel.com/fo8o/
request GET http://www.goldenjade-travel.com/fo8o/?mRfW=LFKqyrcu7g1NCa8bIVnmntQ0zrEKrQSprIMLtaWgKJ9bBKQr4dsn0J7ZoYUgIJ+R6Sel8OhXEcHhC7LyM9bkgjIIu2U6i6kbe5asCJcEX28JEcHJIWfCjODnuc7OiogdzaMrHf8=&SM4k=DX6TxPgI
request POST http://www.antonio-vivaldi.mobi/fo8o/
request GET http://www.antonio-vivaldi.mobi/fo8o/?mRfW=PTl5gU/3CD/Xhg5KAVLGoeqWcilDUK5FTZuVmm6gfrwSjnBrSraU5xyBGUoA1k9xMbAGIU7PLJqf1PTsNd74L3d6+NgzbyGN2pTsiSyIeh1B8hC/nFfIu9UZrk9ku3J39HvVUu8=&SM4k=DX6TxPgI
request POST http://www.magmadokum.com/fo8o/
request GET http://www.magmadokum.com/fo8o/?mRfW=qL3nKp+YSjoaTomnND+fiETGbzpIgkHGMW8DXsDTZ4AADrD7Wpn1kxM1jYW2/C2WhyBblBh5NUSWrO5bZjyCcVkJYbxxq5QITB2h2xAyEikjbcoqZSmDOCeIE8A+B7hyBKIW8mw=&SM4k=DX6TxPgI
request POST http://www.rssnewscast.com/fo8o/
request GET http://www.rssnewscast.com/fo8o/?mRfW=x3jV/ECx7FuzXOI+6CNaISj98UIEn47HyCIVaqWvGMMqpfz0YC5wNp/pxM1zEFNKv4nPeGfT8/lZrDaJmccs4488pD+gaHK32CxgTEs5a2vdBlM4hQBa8nlaMF5vesFSU19kJNk=&SM4k=DX6TxPgI
request POST http://www.techchains.info/fo8o/
request GET http://www.techchains.info/fo8o/?mRfW=vefd0teQh+kbruh+iKW53cdcsQD4oFyRDgCUoL90YCYLczV+Hcc/VZ2eVbboy/u5EgiS3CnxBclKZHyNJ/4ALr08/A/SWk5lVGufGp2P4fG4f3GonqE4cYuaa0/JNC0RZIlRWrU=&SM4k=DX6TxPgI
request POST http://www.elettrosistemista.zip/fo8o/
request GET http://www.elettrosistemista.zip/fo8o/?mRfW=bO1UBvtoHFNUmlWB73HniX/lRhcpQxU1qF418M7UHpKKa2cgLZsmK6mwaSCrivds7LXL3uoK+MTOMGhYNdwtdjBMQu6yx1bfgOYvdpbzJPd/eSD2kHjCkD+QxgbYBRdZBXmxn1k=&SM4k=DX6TxPgI
request POST http://www.3xfootball.com/fo8o/
request POST http://www.kasegitai.tokyo/fo8o/
request POST http://www.goldenjade-travel.com/fo8o/
request POST http://www.antonio-vivaldi.mobi/fo8o/
request POST http://www.magmadokum.com/fo8o/
request POST http://www.rssnewscast.com/fo8o/
request POST http://www.techchains.info/fo8o/
request POST http://www.elettrosistemista.zip/fo8o/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2556
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734c2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00770000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x736d2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2644
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00870000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2696
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008d0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2812
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009a0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004160000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
description netbtugc.exe tried to sleep 154 seconds, actually delayed analysis time by 154 seconds
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file C:\Users\test22\AppData\Local\Chromium\User Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.vbs
file C:\Users\test22\AppData\Local\directory\.exe
file C:\Users\test22\AppData\Local\directory\.exe
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file C:\Users\test22\AppData\Local\directory\.exe
section {u'size_of_data': u'0x0005ca00', u'virtual_address': u'0x000c8000', u'entropy': 7.896311483647067, u'name': u'.rsrc', u'virtual_size': u'0x0005c8b8'} entropy 7.89631148365 description A section with a high entropy has been found
entropy 0.314249363868 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2700
thread_handle: 0x00000144
process_identifier: 2696
current_directory:
filepath: C:\Windows\System32\svchost.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\proposal%20report.exe"
filepath_r: C:\Windows\System32\svchost.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000013c
1 1 0
file C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file C:\Users\test22\AppData\Local\AVG\Browser\User Data
Process injection Process 2644 called NtSetContextThread to modify thread in remote process 2696
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 2947288
registers.edi: 0
registers.eax: 4199888
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000144
process_identifier: 2696
1 0 0
Lionic Trojan.Win32.AutoIt.l!c
CAT-QuickHeal Trojan.AgentSM.S6640043
Skyhigh BehavesLike.Win32.TrojanAitInject.tc
ALYac Trojan.GenericKD.73055996
Cylance Unsafe
VIPRE Trojan.GenericKD.73055996
Sangfor Trojan.Win32.Injector.Vmk9
BitDefender Trojan.GenericKD.73055996
Arcabit Trojan.Generic.D45ABEFC
VirIT Trojan.Win32.AutoIt_Heur.A
Symantec Trojan.Gen.2
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Injector.Autoit.GBF
APEX Malicious
McAfee Artemis!092CD26903ED
Avast Win32:Malware-gen
Kaspersky Trojan-Spy.Win32.Noon.bgnk
MicroWorld-eScan Trojan.GenericKD.73055996
Emsisoft Trojan.GenericKD.73055996 (B)
McAfeeD ti!65FAA8E45468
FireEye Trojan.GenericKD.73055996
Sophos Troj/AutoIt-DGJ
Ikarus Trojan.Autoit
Google Detected
MAX malware (ai score=86)
Kingsoft Win32.Trojan-Spy.Noon.bgnk
Microsoft Trojan:Win32/DorkBot.DU
ZoneAlarm Trojan-Spy.Win32.Noon.bgnk
GData Trojan.GenericKD.73055996
Varist W32/AutoIt.YE.gen!Eldorado
AhnLab-V3 Trojan/Win.Injector.C5639377
DeepInstinct MALICIOUS
VBA32 Trojan-Downloader.Autoit.gen
Malwarebytes Malware.AI.314447254
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.F0D1C00F724
MaxSecure Trojan.Malware.255249326.susgen
Fortinet AutoIt/Injector.GBC!tr
AVG Win32:Malware-gen
Paloalto generic.ml
alibabacloud Trojan[spy]:Win/Noon.bkfu