Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 18, 2024, 6:13 p.m.	June 18, 2024, 6:16 p.m.

Size	375.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`c51e84d4d53678605a1cb5feb6436c84`
SHA256	`14f381c0d75d7477de4bc89012f6916dcf1d373c4ebb23684baa73ddd3bef054`
CRC32	`DC09143A`
ssdeep	`6144:ORjbUHOvGUNIE/FDjBazqjWgR+MSEtvlZTONpRGX5B4PY3mA0O0Gp8NhY5Jod:ejbh9tDjiuT+xEtl0u4w3mAZyxd`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

1.exe "C:\Users\test22\AppData\Local\Temp\1.exe"
1940
- cmd.exe C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\test22\AppData\Local\Temp\1.exe > nul
  2056
  - PING.EXE ping -n 2 127.0.0.1
    2224

Name	Response	Post-Analysis Lookup
gwyk.sp168.tv	A 156.241.4.189	156.241.4.189

IP Address	Status	Action
156.241.4.189	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 18, 2024, 6:13 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

PAGE

The executable uses a known packer (1 event)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (10 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory June 18, 2024, 6:13 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742b1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 18, 2024, 6:13 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756e1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 18, 2024, 6:13 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74281000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 18, 2024, 6:13 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74271000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 18, 2024, 6:13 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74251000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 18, 2024, 6:13 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x758f1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 18, 2024, 6:13 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74231000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 18, 2024, 6:13 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10001000 process_handle: 0xffffffff		3221225713
NtProtectVirtualMemory June 18, 2024, 6:13 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 331776 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10151000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 18, 2024, 6:13 p.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744a1000 process_handle: 0xffffffff	1	0

Creates a service (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceA June 18, 2024, 6:13 p.m.	service_start_name: start_type: 2 password: display_name: Microsoft .NET Framework NGEN v4.0.30319_X866 filepath: C:\Windows\System32\mscorsvww.exe -auto service_name: clr_optimization_v4.0.30319_322 filepath_r: C:\Windows\system32\mscorsvww.exe -auto desired_access: 18 service_handle: 0x00572170 error_control: 0 service_type: 16 service_manager_handle: 0x00572210	1	5710192	0

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\test22\AppData\Local\Temp\1.exe > nul

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\1.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0005d400', u'virtual_address': u'0x00002000', u'entropy': 7.875345001521529, u'name': u'.data', u'virtual_size': u'0x0005d394'}

entropy

7.87534500152

description

A section with a high entropy has been found

entropy

0.997326203209

description

Overall entropy of this PE file is high

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	ping -n 2 127.0.0.1
cmdline	C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\test22\AppData\Local\Temp\1.exe > nul

Installs itself for autorun at Windows startup (1 event)

service_name

clr_optimization_v4.0.30319_322

service_path

C:\Windows\System32\mscorsvww.exe -auto

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1940 resumed a thread in remote process 2056
NtResumeThread June 18, 2024, 6:13 p.m.	thread_handle: 0x00000178 suspend_count: 1 process_identifier: 2056	1	0	0

File has been identified by 66 AntiVirus engines on VirusTotal as malicious (50 out of 66 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Farfli.m!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Backdoor.FarfliPMF.S19352949
Skyhigh	BehavesLike.Win32.PWSZbot.fc
ALYac	Gen:Variant.Zusy.313935
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.313935
Sangfor	Backdoor.Win32.Kryptik.V90w
K7AntiVirus	Trojan ( 0055a5d81 )
BitDefender	Gen:Variant.Zusy.313935
K7GW	Trojan ( 0055a5d81 )
Cybereason	malicious.4d5367
Arcabit	Trojan.Zusy.D4CA4F
VirIT	Trojan.Win32.Genus.KGR
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.EZKJ
APEX	Malicious
McAfee	Trojan-FRMW!C51E84D4D536
Avast	Win32:BackdoorX-gen [Trj]
ClamAV	Win.Trojan.Farfli-9645812-0
Kaspersky	HEUR:Backdoor.Win32.Farfli.vho
Alibaba	Backdoor:Win32/Farfli.bbca2549
NANO-Antivirus	Trojan.Win32.Farfli.gethzp
MicroWorld-eScan	Gen:Variant.Zusy.313935
Rising	Trojan.Win32.FakeFolder.ae (CLASSIC)
Emsisoft	Gen:Variant.Zusy.313935 (B)
F-Secure	Trojan.TR/Kryptik.kenti
DrWeb	Trojan.NtRootKit.20174
Zillya	Trojan.GenKryptik.Win32.36169
TrendMicro	TROJ_GEN.R014C0DFC24
McAfeeD	ti!14F381C0D75D
FireEye	Generic.mg.c51e84d4d5367860
Sophos	Troj/AutoG-KM
Ikarus	Trojan.Win32.Krypt
Jiangmin	Backdoor.Farfli.exu
Google	Detected
Avira	TR/Kryptik.kenti
Antiy-AVL	Trojan/Win32.GenKryptik
Kingsoft	malware.kb.a.999
Gridinsoft	Trojan.Win32.Kryptik.cl
Xcitium	Malware@#1uqdloqyfeqzg
Microsoft	Trojan:Win32/GhostRAT
ViRobot	Trojan.Win.Z.Farfli.384000.K
ZoneAlarm	HEUR:Backdoor.Win32.Farfli.vho
GData	Gen:Variant.Zusy.313935
Varist	W32/Agent.BOB.gen!Eldorado
AhnLab-V3	Trojan/Win32.RL_Farfli.R299612
BitDefenderTheta	Gen:NN.ZexaF.36806.xmW@a0gar3n

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 events)

dead_host	192.168.56.103:49171
dead_host	192.168.56.103:49164
dead_host	192.168.56.103:49172
dead_host	192.168.56.103:49170
dead_host	156.241.4.189:10092

1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All