Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 16, 2024, 9:55 a.m.	June 16, 2024, 10 a.m.

Size	1.6MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`ceb1b42233ced601bf691ffa63a305a9`
SHA256	`bf892a94620bece558842677c54b6921d3b22c65f5d18992e660a46989eaa6e8`
CRC32	`37CB316A`
ssdeep	`24576:wnsJ39LyjbJkQFMhmC+6GD99kNi5jF4ySAD5gXtY9+c+bLG2:wnsHyjtk2MYC5GD/kNYrS5tYt+P`
Yara	Malicious_Packer_Zero - Malicious Packer Malicious_Library_Zero - Malicious_Library DllRegisterServer_Zero - execute regsvr32.exe PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware mzp_file_format - MZP(Delphi) file format OS_Processor_Check_Zero - OS Processor Check

ey.exe "C:\Users\test22\AppData\Local\Temp\ey.exe"
1460
- ._cache_ey.exe "C:\Users\test22\AppData\Local\Temp\._cache_ey.exe"
  2180
- Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2240

Name	Response	Post-Analysis Lookup
docs.google.com	A 172.217.27.14	172.217.161.238
xred.mooo.com
drive.usercontent.google.com	A 142.251.130.1	142.250.206.193
www.dropbox.com	CNAME www-env.dropbox-dns.com A 162.125.84.18	162.125.84.18
freedns.afraid.org	A 69.42.215.252	69.42.215.252

IP Address	Status	Action
142.251.130.1	Active	Moloch
162.125.84.18	Active	Moloch
164.124.101.2	Active	Moloch
172.217.27.14	Active	Moloch
69.42.215.252	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2015633	ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com	Misc activity
TCP 192.168.56.103:49173 -> 162.125.84.18:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49172 -> 142.251.130.1:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49171 -> 172.217.27.14:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49174 -> 162.125.84.18:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49171 172.217.27.14:443	C=US, O=Google Trust Services, CN=WR2	CN=*.google.com	4c:c8:6f:b2:95:94:9b:85:9d:cd:50:8c:dc:35:70:a9:fa:1c:63:f0
TLSv1 192.168.56.103:49172 142.251.130.1:443	C=US, O=Google Trust Services, CN=WR2	CN=*.usercontent.google.com	71:e8:8e:94:b7:3e:87:37:f2:40:e5:6d:db:4c:22:85:e4:ea:4d:63

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA June 16, 2024, 9:56 a.m.	computer_name: TEST22-PC	1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ June 16, 2024, 9:56 a.m.	stacktrace: synaptics+0x7bda4 @ 0x47bda4 synaptics+0x7bcf2 @ 0x47bcf2 synaptics+0x7bcb3 @ 0x47bcb3 synaptics+0x845fd @ 0x4845fd synaptics+0x959fc @ 0x4959fc BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 54066652 registers.edi: 54066840 registers.eax: 54066652 registers.ebp: 54066732 registers.edx: 0 registers.ebx: 4703484 registers.esi: 11001 registers.ecx: 7	1
__exception__ June 16, 2024, 9:56 a.m.	stacktrace: synaptics+0x7bda4 @ 0x47bda4 synaptics+0x7bcf2 @ 0x47bcf2 synaptics+0x7bcb3 @ 0x47bcb3 synaptics+0x845fd @ 0x4845fd synaptics+0x95a83 @ 0x495a83 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 54064464 registers.edi: 54064652 registers.eax: 54064464 registers.ebp: 54064544 registers.edx: 0 registers.ebx: 4703484 registers.esi: 11004 registers.ecx: 7	1
__exception__ June 16, 2024, 9:56 a.m.	stacktrace: synaptics+0x7bda4 @ 0x47bda4 synaptics+0x7bcf2 @ 0x47bcf2 synaptics+0x7bcb3 @ 0x47bcb3 synaptics+0x845fd @ 0x4845fd synaptics+0x95b0a @ 0x495b0a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 54062276 registers.edi: 54062464 registers.eax: 54062276 registers.ebp: 54062356 registers.edx: 0 registers.ebx: 4703484 registers.esi: 11001 registers.ecx: 7	1

Connects to a Dynamic DNS Domain (1 event)

domain

xred.mooo.com

Performs some HTTP requests (5 events)

request	GET http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
request	GET https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
request	GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
request	GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
request	GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 16, 2024, 9:55 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 16, 2024, 9:56 a.m.	process_identifier: 2240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Foreign language identified in PE resource (12 events)

name

RT_ICON

language

LANG_TURKISH

filetype

dBase IV DBT of @.DBF, block length 8192, next free block index 40

sublanguage

SUBLANG_DEFAULT

offset

0x000b39f8

size

0x000010a8

name

RT_ICON

language

LANG_TURKISH

filetype

dBase IV DBT of @.DBF, block length 8192, next free block index 40

sublanguage

SUBLANG_DEFAULT

offset

0x000b39f8

size

0x000010a8

name

RT_RCDATA

language

LANG_TURKISH

filetype

Microsoft Excel 2007+

sublanguage

SUBLANG_DEFAULT

offset

0x0019d1b8

size

0x000047d3

name

RT_RCDATA

language

LANG_TURKISH

filetype

Microsoft Excel 2007+

sublanguage

SUBLANG_DEFAULT

offset

0x0019d1b8

size

0x000047d3

name

RT_RCDATA

language

LANG_TURKISH

filetype

Microsoft Excel 2007+

sublanguage

SUBLANG_DEFAULT

offset

0x0019d1b8

size

0x000047d3

name

RT_RCDATA

language

LANG_TURKISH

filetype

Microsoft Excel 2007+

sublanguage

SUBLANG_DEFAULT

offset

0x0019d1b8

size

0x000047d3

name

RT_RCDATA

language

LANG_TURKISH

filetype

Microsoft Excel 2007+

sublanguage

SUBLANG_DEFAULT

offset

0x0019d1b8

size

0x000047d3

name

RT_RCDATA

language

LANG_TURKISH

filetype

Microsoft Excel 2007+

sublanguage

SUBLANG_DEFAULT

offset

0x0019d1b8

size

0x000047d3

name

RT_RCDATA

language

LANG_TURKISH

filetype

Microsoft Excel 2007+

sublanguage

SUBLANG_DEFAULT

offset

0x0019d1b8

size

0x000047d3

name

RT_RCDATA

language

LANG_TURKISH

filetype

Microsoft Excel 2007+

sublanguage

SUBLANG_DEFAULT

offset

0x0019d1b8

size

0x000047d3

name

RT_GROUP_ICON

language

LANG_TURKISH

filetype

data

sublanguage

SUBLANG_DEFAULT

offset

0x001a1a18

size

0x00000014

name

RT_VERSION

language

LANG_TURKISH

filetype

data

sublanguage

SUBLANG_DEFAULT

offset

0x001a1a2c

size

0x00000304

Downloads a file or document from Google Drive (1 event)

domain

docs.google.com

Creates executable files on the filesystem (2 events)

file	C:\ProgramData\Synaptics\Synaptics.dll
file	C:\Users\test22\AppData\Local\Temp\._cache_ey.exe

Looks up the Dropbox cloud service (1 event)

domain

www.dropbox.com

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\10916687\TemporaryFile\TemporaryFile

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (7 events)

Time & API	Arguments	Status	Return
Process32NextW June 16, 2024, 9:56 a.m.	snapshot_handle: 0x000000f4 process_name: wsqmcons.exe process_identifier: 932	1	1
Process32NextW June 16, 2024, 9:56 a.m.	snapshot_handle: 0x000000f4 process_name: cmd.exe process_identifier: 1608	1	1
Process32NextW June 16, 2024, 9:56 a.m.	snapshot_handle: 0x000000f4 process_name: SearchProtocolHost.exe process_identifier: 1708	1	1
Process32NextW June 16, 2024, 9:56 a.m.	snapshot_handle: 0x000000f4 process_name: conhost.exe process_identifier: 316	1	1
Process32NextW June 16, 2024, 9:56 a.m.	snapshot_handle: 0x000000f4 process_name: ey.exe process_identifier: 1460	1	1
Process32NextW June 16, 2024, 9:56 a.m.	snapshot_handle: 0x000000f4 process_name: schtasks.exe process_identifier: 2156	1	1
Process32NextW June 16, 2024, 9:56 a.m.	snapshot_handle: 0x000000f4 process_name: conhost.exe process_identifier: 2164	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 16, 2024, 9:56 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver				reg_value	C:\ProgramData\Synaptics\Synaptics.exe
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\systeamst				reg_value	C:\Users\test22\AppData\Local\Temp\._cache_ey.exe

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExA June 16, 2024, 9:56 a.m.	thread_identifier: 0 callback_function: 0x02223540 hook_identifier: 2 (WH_KEYBOARD) module_address: 0x02220000	1	197101	0

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Network activity contains more than one unique useragent (2 events)

process	Synaptics.exe				useragent	MyApp
process	Synaptics.exe				useragent	Synaptics.exe

File has been identified by 67 AntiVirus engines on VirusTotal as malicious (50 out of 67 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.DarkKomet.m!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Sus.Nocivo.E0011
Skyhigh	BehavesLike.Win32.Synaptics.th
ALYac	Win32.Comet.A
Cylance	Unsafe
VIPRE	Win32.Comet.A
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Virus ( 005b18a71 )
BitDefender	Win32.Comet.A
K7GW	Virus ( 005b18a71 )
Cybereason	malicious.233ced
Arcabit	HEUR.VBA.Trojan.d
Symantec	W32.Zorex
ESET-NOD32	Win32/Delf.NBX
APEX	Malicious
McAfee	W32/Synaptics
Avast	Win32:TrojanX-gen [Trj]
ClamAV	Win.Trojan.Emotet-9850453-0
Kaspersky	Backdoor.Win32.DarkKomet.hqxy
Alibaba	Backdoor:Win32/DarkKomet.353
NANO-Antivirus	Trojan.Win32.DarkKomet.fazbwq
MicroWorld-eScan	Win32.Comet.A
Rising	Virus.Synaptics!1.E51C (CLASSIC)
Emsisoft	Win32.Comet.A (B)
F-Secure	Malware.W2000M/Dldr.Agent.17651006
DrWeb	Win32.HLLW.Siggen.10555
Zillya	Trojan.Delf.Win32.76144
TrendMicro	Virus.Win32.NAPWHICH.B
McAfeeD	ti!BF892A94620B
FireEye	Generic.mg.ceb1b42233ced601
Sophos	ElReceptor Keyboard Hook (PUA)
Ikarus	Virus.Win32.Delf
Jiangmin	Win32/Synaptics.Gen
Webroot	W32.Malware.gen
Google	Detected
Avira	TR/Dldr.Agent.SH
MAX	malware (ai score=89)
Antiy-AVL	Virus/Win32.DarkKomet.a
Kingsoft	Win32.Infected.AutoInfector.a
Gridinsoft	Trojan.Win32.Downloader.mz!n
Xcitium	Virus.Win32.Agent.DE@74b38h
Microsoft	Worm:Win32/AutoRun!atmn
ViRobot	Win32.Zorex.A
ZoneAlarm	Backdoor.Win32.DarkKomet.hqxy
GData	Win32.Backdoor.Agent.AXS
Varist	W32/Backdoor.OAZM-5661
AhnLab-V3	Win32/Zorex.X1799

ey.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All