Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 21, 2024, 7:41 a.m.	June 21, 2024, 7:43 a.m.

Size	4.9MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`1474c5d842d1a4ba2c592930a42c3a80`
SHA256	`1c9e36b4d27228bcec7c18944a66270a93c8e030c911bf8ff07b30d7fcc769e5`
CRC32	`E18BD5F7`
ssdeep	`98304:mln9CPsrHDI8ksDtHnEvHohXESl1QGMFFEit915vL5Jk2IVMJcll:MnkBJsdnlhUSl1SlUfll`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format

crt.exe "C:\Users\test22\AppData\Local\Temp\crt.exe"
2548
- crt.tmp "C:\Users\test22\AppData\Local\Temp\is-PGLV2.tmp\crt.tmp" /SL5="$80178,4863554,54272,C:\Users\test22\AppData\Local\Temp\crt.exe"
  2600
  - starsaudioconverter32.exe "C:\Users\test22\AppData\Local\OrangeStars Audio Converter\starsaudioconverter32.exe" -i
    2712
  - starsaudioconverter32.exe "C:\Users\test22\AppData\Local\OrangeStars Audio Converter\starsaudioconverter32.exe" -s
    2756

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA June 21, 2024, 7:41 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 21, 2024, 7:41 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 21, 2024, 7:41 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 21, 2024, 7:41 a.m.	stacktrace: crt+0x40de2 @ 0x440de2 crt+0x42c27 @ 0x442c27 crt+0x482f0 @ 0x4482f0 crt+0x3e1f5 @ 0x43e1f5 crt+0x3d12b @ 0x43d12b crt+0x8f580 @ 0x48f580 crt+0x7b8be @ 0x47b8be crt+0x93309 @ 0x493309 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 06 c7 45 fc fe ff ff ff 85 db 0f 85 97 34 00 exception.symbol: WNetCloseEnum+0x14 WNetOpenEnumW-0x11c mpr+0x2dea exception.instruction: mov eax, dword ptr [esi] exception.module: mpr.dll exception.exception_code: 0xc0000005 exception.offset: 11754 exception.address: 0x74162dea registers.esp: 1637612 registers.edi: 7037628 registers.eax: 1637640 registers.ebp: 1637656 registers.edx: 44 registers.ebx: 0 registers.esi: 44 registers.ecx: 0	1	0	0
__exception__ June 21, 2024, 7:41 a.m.	stacktrace: crt+0x3dd1a @ 0x43dd1a crt+0x3d12b @ 0x43d12b crt+0x8f580 @ 0x48f580 crt+0x7b8be @ 0x47b8be crt+0x93309 @ 0x493309 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: f7 37 89 06 e9 dd 07 00 00 8b 06 33 d2 8a 17 8b exception.symbol: crt+0x3b00f exception.instruction: div dword ptr [edi] exception.module: crt.tmp exception.exception_code: 0xc0000094 exception.offset: 241679 exception.address: 0x43b00f registers.esp: 1637784 registers.edi: 7033020 registers.eax: 33654530 registers.ebp: 1637864 registers.edx: 0 registers.ebx: 1 registers.esi: 7033012 registers.ecx: 7033020	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 21, 2024, 7:41 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2024, 7:41 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 40960 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2024, 7:41 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2024, 7:41 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 21, 2024, 7:41 a.m.	process_identifier: 2600 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 21, 2024, 7:41 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\is-I2IL9.tmp\_isetup\_iscrypt.dll
file	C:\Users\test22\AppData\Local\OrangeStars Audio Converter\starsaudioconverter32.exe
file	C:\Users\test22\AppData\Local\Temp\is-I2IL9.tmp\_isetup\_shfoldr.dll

Drops an executable to the user AppData folder (4 events)

file	C:\Users\test22\AppData\Local\Temp\is-PGLV2.tmp\crt.tmp
file	C:\Users\test22\AppData\Local\Temp\is-I2IL9.tmp\_isetup\_shfoldr.dll
file	C:\Users\test22\AppData\Local\Temp\is-I2IL9.tmp\_isetup\_iscrypt.dll
file	C:\Users\test22\AppData\Local\Temp\is-I2IL9.tmp\_isetup\_RegDLL.tmp

Queries for potentially installed applications (4 events)

Time & API	Arguments	Return
RegOpenKeyExA June 21, 2024, 7:41 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\OrangeStars Audio Converter_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\OrangeStars Audio Converter_is1	2
RegOpenKeyExA June 21, 2024, 7:41 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\OrangeStars Audio Converter_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\OrangeStars Audio Converter_is1	2
RegOpenKeyExA June 21, 2024, 7:41 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\OrangeStars Audio Converter_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000008 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\OrangeStars Audio Converter_is1	2
RegOpenKeyExA June 21, 2024, 7:41 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\OrangeStars Audio Converter_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000008 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\OrangeStars Audio Converter_is1	2

File has been identified by 18 AntiVirus engines on VirusTotal as malicious (18 events)

Elastic	malicious (moderate confidence)
VIPRE	Gen:Heur.Munp.1
BitDefender	Gen:Variant.Doina.74764
Arcabit	Trojan.Munp.1
ESET-NOD32	a variant of Win32/TrojanDropper.Agent.SLC
Avast	Win32:AdwareX-gen [Adw]
MicroWorld-eScan	Gen:Variant.Doina.74764
Emsisoft	Gen:Variant.Doina.74764 (B)
F-Secure	Heuristic.HEUR/AGEN.1372994
DrWeb	Trojan.MulDrop26.51718
FireEye	Gen:Heur.Munp.1
Ikarus	Trojan.Win32.Crypt
Avira	HEUR/AGEN.1372994
MAX	malware (ai score=85)
Microsoft	Trojan:Win32/Wacatac.H!ml
GData	Gen:Variant.Doina.74764
Malwarebytes	Backdoor.TVRat.Dropper
AVG	Win32:AdwareX-gen [Adw]

crt.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All