Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 2, 2024, 3:42 p.m.	July 2, 2024, 3:44 p.m.

Size	7.8MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`52070a9adf4787ece9b80af208603030`
SHA256	`c41e5e851e0d62fe837b2b44ec114ae83a2dde3ef3943fbe37efaec94b0b6202`
CRC32	`2DE36732`
ssdeep	`196608:u288p8RT3OgtMwVajd4nXhE7OUGCZvb+CV4i8JRzY6SKg:u288+T3O6I2nXhE7OUGClb+CV4vDc`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

Content_497179.exe "C:\Users\test22\AppData\Local\Temp\Content_497179.exe"
2564
- setup.exe .\setup.exe
  2700

Name	Response	Post-Analysis Lookup
codeonicinc.com	A 104.26.8.6 A 172.67.69.54 A 104.26.9.6	104.26.8.6

IP Address	Status	Action
104.26.9.6	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49164 -> 104.26.9.6:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49167 -> 104.26.9.6:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.101:49164 104.26.9.6:443	C=US, O=Google Trust Services, CN=WE1	CN=codeonicinc.com	86:da:8b:36:46:21:b9:cf:2c:38:f1:8a:de:64:e9:75:47:0f:ee:47
TLS 1.2 192.168.56.101:49167 104.26.9.6:443	C=US, O=Google Trust Services, CN=WE1	CN=codeonicinc.com	86:da:8b:36:46:21:b9:cf:2c:38:f1:8a:de:64:e9:75:47:0f:ee:47

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 2, 2024, 3:42 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 2, 2024, 3:42 p.m.		1	1	0

Starts servers listening (6 events)

Time & API	Arguments	Status	Return
bind July 2, 2024, 3:42 p.m.	ip_address: 127.0.0.1 socket: 488 port: 0	1	0
listen July 2, 2024, 3:42 p.m.	socket: 488 backlog: 1	1	0
accept July 2, 2024, 3:42 p.m.	ip_address: socket: 488 port: 0	1	496
bind July 2, 2024, 3:42 p.m.	ip_address: 127.0.0.1 socket: 468 port: 0	1	0
listen July 2, 2024, 3:42 p.m.	socket: 468 backlog: 1	1	0
accept July 2, 2024, 3:42 p.m.	ip_address: socket: 468 port: 0	1	496

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header

suspicious_request

POST https://codeonicinc.com/

Performs some HTTP requests (1 event)

request

POST https://codeonicinc.com/

Sends data using the HTTP POST Method (1 event)

request

POST https://codeonicinc.com/

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 2, 2024, 3:42 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73562000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 2, 2024, 3:42 p.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73562000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 2, 2024, 3:42 p.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73305000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\nshFB1B.tmp\nsDialogs.dll
file	C:\Users\test22\AppData\Local\Temp\7zS40ADCD0F\setup.exe
file	C:\Users\test22\AppData\Local\Temp\nshFB1B.tmp\System.dll
file	C:\Users\test22\AppData\Local\Temp\nshFB1B.tmp\UAC.dll

Drops an executable to the user AppData folder (4 events)

file	C:\Users\test22\AppData\Local\Temp\nshFB1B.tmp\UAC.dll
file	C:\Users\test22\AppData\Local\Temp\nshFB1B.tmp\nsDialogs.dll
file	C:\Users\test22\AppData\Local\Temp\7zS40ADCD0F\setup.exe
file	C:\Users\test22\AppData\Local\Temp\nshFB1B.tmp\System.dll

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (7 events)

Time & API	Arguments	Status	Return
Process32NextW July 2, 2024, 3:42 p.m.	snapshot_handle: 0x000001b4 process_name: mobsync.exe process_identifier: 2284	1	1
Process32NextW July 2, 2024, 3:42 p.m.	snapshot_handle: 0x000001b4 process_name: pw.exe process_identifier: 2328	1	1
Process32NextW July 2, 2024, 3:42 p.m.	snapshot_handle: 0x000001b4 process_name: taskhost.exe process_identifier: 2380	1	1
Process32NextW July 2, 2024, 3:42 p.m.	snapshot_handle: 0x000001b4 process_name: sdclt.exe process_identifier: 2388	1	1
Process32NextW July 2, 2024, 3:42 p.m.	snapshot_handle: 0x000001b4 process_name: Content_497179.exe process_identifier: 2564	1	1
Process32NextW July 2, 2024, 3:42 p.m.	snapshot_handle: 0x000001b4 process_name: schtasks.exe process_identifier: 2628	1	1
Process32NextW July 2, 2024, 3:42 p.m.	snapshot_handle: 0x000001b4 process_name: conhost.exe process_identifier: 2636	1	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 2, 2024, 3:42 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 458752 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x10001000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0008e800', u'virtual_address': u'0x0013f000', u'entropy': 7.997112804313907, u'name': u'.data', u'virtual_size': u'0x00091b7c'}

entropy

7.99711280431

description

A section with a high entropy has been found

entropy

0.30587603971

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 2, 2024, 3:42 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 2, 2024, 3:42 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Enumerates services, possibly for anti-virtualization (1 event)

Time & API	Arguments	Status	Return	Repeated
EnumServicesStatusA July 2, 2024, 3:42 p.m.	service_handle: 0x00273130 service_type: 11 service_status: 3		0	0

Creates known SpyNet files, registry changes and/or mutexes. (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet

Detects the presence of Wine emulator (2 events)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress July 2, 2024, 3:42 p.m.	ordinal: 0 function_address: 0x1007d5c8 function_name: wine_get_version module: ntdll module_address: 0x76f10000		3221225785	0
LdrGetProcedureAddress July 2, 2024, 3:42 p.m.	ordinal: 0 function_address: 0x1007d5c8 function_name: wine_get_version module: ntdll module_address: 0x76f10000		3221225785	0

Content_497179.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All