Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 25, 2024, 7:43 a.m.	June 25, 2024, 7:48 a.m.

Size	4.7MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`4645adc87acf83b55edff3c5ce2fc28e`
SHA256	`5a03eb8534caf92f4c3d7896d1af7fe61292b5f0995567be8c783ab28c3b74f8`
CRC32	`E9576A7C`
ssdeep	`98304:AkYNNP4ya1yMLo/NDRhzEdPPi2HuzH/zVhRpfR7pIy/unY5p8riqnzQ2ye:AkYN6yacM8/bhzEZDYHhhz57Gy/sQi02`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

288c47bbc1871b439df19ff4df68f000766.exe "C:\Users\test22\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f000766.exe"
1680
- ISetup4.exe "C:\Users\test22\AppData\Local\Temp\ISetup4.exe"
  2084
- 288c47bbc1871b439df19ff4df68f076.exe "C:\Users\test22\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
  2132

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 25, 2024, 7:43 a.m.			0	0
IsDebuggerPresent June 25, 2024, 7:43 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 25, 2024, 7:43 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (17 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 1680 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00980000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 1680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 1680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 1680 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a70000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 237568 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x031be000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 2084 region_size: 454656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00350000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4161536 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a50000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:43 a.m.	process_identifier: 2132 region_size: 9351168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
file	C:\Users\test22\AppData\Local\Temp\ISetup4.exe

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\ISetup4.exe
file	C:\Users\test22\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\ISetup4.exe
file	C:\Users\test22\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x004a9000', u'virtual_address': u'0x00002000', u'entropy': 7.9429713634122, u'name': u'.text', u'virtual_size': u'0x004a8e74'}

entropy

7.94297136341

description

A section with a high entropy has been found

entropy

0.999581064097

description

Overall entropy of this PE file is high

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 events)

Bkav	W32.AIDetectMalware.CS
CAT-QuickHeal	TrojanDownloader.MSIL
Skyhigh	BehavesLike.Win32.Generic.rc
McAfee	GenericRXOO-YN!4645ADC87ACF
Cylance	unsafe
VIPRE	Gen:Variant.Jalapeno.293
Sangfor	Trojan.Win32.Save.a
BitDefender	Gen:Variant.Jalapeno.293
K7GW	Ransomware ( 005a8b921 )
K7AntiVirus	Ransomware ( 005a8b921 )
Arcabit	Trojan.Jalapeno.293
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Agent.UZA
APEX	Malicious
Avast	Win32:DropperX-gen [Drp]
ClamAV	Win.Packed.Msilzilla-10018301-0
Kaspersky	HEUR:Trojan-Downloader.MSIL.ShortLoader.gen
Alibaba	TrojanDownloader:MSIL/Mokes.c0dd014e
NANO-Antivirus	Trojan.Win32.ShortLoader.kkvsqf
MicroWorld-eScan	Gen:Variant.Jalapeno.293
Rising	Trojan.AntiVM!1.CF63 (CLASSIC)
Emsisoft	Gen:Variant.Jalapeno.293 (B)
F-Secure	Heuristic.HEUR/AGEN.1365025
DrWeb	Trojan.MulDropNET.43
Zillya	Trojan.Agent.Win32.3899439
TrendMicro	Trojan.Win32.SMOKELOADER.YXECWZ
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.4645adc87acf83b5
Sophos	Troj/ILAgent-I
Ikarus	Trojan.MSIL.Krypt
Jiangmin	TrojanDownloader.MSIL.aqbz
Webroot	W32.SMOKELOADER.YXECWZ
Google	Detected
Avira	HEUR/AGEN.1365025
MAX	malware (ai score=89)
Kingsoft	MSIL.Trojan-Downloader.ShortLoader.gen
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Trojan:MSIL/Mokes.B!MTB
ViRobot	Trojan.Win.Z.Shortloader.4889088.A
ZoneAlarm	HEUR:Trojan-Downloader.MSIL.ShortLoader.gen
GData	Gen:Variant.Jalapeno.293
Varist	W32/MSIL_Kryptik.FFY.gen!Eldorado
AhnLab-V3	Malware/Win.Generic.C4478643
BitDefenderTheta	Gen:NN.ZemsilF.36804.@p0@aOXy86b
DeepInstinct	MALICIOUS
VBA32	Trojan.MSIL.Injector.gen
Malwarebytes	Trojan.Crypt.MSIL.Generic
Panda	Trj/GdSda.A

288c47bbc1871b439df19ff4df68f000766.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All