Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 25, 2024, 7:52 a.m.	June 25, 2024, 7:54 a.m.

Size	4.7MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ba354d029f0e09cb6b02a4c196524da4`
SHA256	`e70dcf3f915087251224a7db3850669c000a6da68ef2b55e3e2eda196cb01fc3`
CRC32	`30E7B471`
ssdeep	`98304:GkYNNP4ya1yMLo/NDRhzEdPPi2HuzH/zVhRpfR7pIy/unY5p8riqnzQ2ye:GkYN6yacM8/bhzEZDYHhhz57Gy/sQi02`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

288c47bbc1871b439df19ff4df68f00076.exe "C:\Users\test22\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f00076.exe"
792
- ISetup4.exe "C:\Users\test22\AppData\Local\Temp\ISetup4.exe"
  2176
- 288c47bbc1871b439df19ff4df68f076.exe "C:\Users\test22\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
  2228

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 25, 2024, 7:52 a.m.			0	0
IsDebuggerPresent June 25, 2024, 7:52 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 25, 2024, 7:52 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (17 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 792 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00370000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 792 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a90000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00412000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 237568 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031e000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 2176 region_size: 454656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4161536 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a10000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:52 a.m.	process_identifier: 2228 region_size: 9351168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
file	C:\Users\test22\AppData\Local\Temp\ISetup4.exe

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\ISetup4.exe
file	C:\Users\test22\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\ISetup4.exe
file	C:\Users\test22\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x004a9000', u'virtual_address': u'0x00002000', u'entropy': 7.942969178122597, u'name': u'.text', u'virtual_size': u'0x004a8e74'}

entropy

7.94296917812

description

A section with a high entropy has been found

entropy

0.999581064097

description

Overall entropy of this PE file is high

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.ShortLoader.a!c
Skyhigh	BehavesLike.Win32.Generic.rc
ALYac	Gen:Variant.Jalapeno.293
Cylance	Unsafe
VIPRE	Gen:Variant.Jalapeno.293
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Ransomware ( 005a8b921 )
BitDefender	Gen:Variant.Jalapeno.293
K7GW	Ransomware ( 005a8b921 )
Cybereason	malicious.29f0e0
Arcabit	Trojan.Jalapeno.293
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Agent.UZA
APEX	Malicious
McAfee	GenericRXOO-YN!BA354D029F0E
Avast	Win32:DropperX-gen [Drp]
ClamAV	Win.Packed.Msilzilla-10018301-0
Kaspersky	HEUR:Trojan-Downloader.MSIL.ShortLoader.gen
Alibaba	Backdoor:Win32/Mokes.ff54e00a
NANO-Antivirus	Trojan.Win32.ShortLoader.kkwacj
MicroWorld-eScan	Gen:Variant.Jalapeno.293
Emsisoft	Gen:Variant.Jalapeno.293 (B)
F-Secure	Heuristic.HEUR/AGEN.1365025
DrWeb	Trojan.MulDropNET.43
Zillya	Trojan.Agent.Win32.3902388
TrendMicro	TrojanSpy.Win32.STEALC.YXEC2Z
McAfeeD	Real Protect-LS!BA354D029F0E
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.ba354d029f0e09cb
Sophos	Troj/ILAgent-I
Ikarus	Trojan.MSIL.Krypt
Google	Detected
Avira	HEUR/AGEN.1365025
Kingsoft	MSIL.Trojan-Downloader.ShortLoader.gen
Gridinsoft	Trojan.Win32.Downloader.sa
Xcitium	Malware@#2ei4a9zvezn13
Microsoft	Backdoor:Win32/Mokes.GXY!MTB
ViRobot	Trojan.Win.Z.Shortloader.4889088
ZoneAlarm	HEUR:Trojan-Downloader.MSIL.ShortLoader.gen
GData	Gen:Variant.Jalapeno.293
Varist	W32/MSIL_Kryptik.FFY.gen!Eldorado
AhnLab-V3	Malware/Win.Generic.C4478643
BitDefenderTheta	Gen:NN.ZemsilF.36806.@p0@a0Fgcup
DeepInstinct	MALICIOUS
VBA32	Trojan.MSIL.Injector.gen
Malwarebytes	Trojan.Crypt.MSIL.Generic
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TrojanSpy.Win32.STEALC.YXEC2Z

288c47bbc1871b439df19ff4df68f00076.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All