Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 2, 2024, 3:51 p.m.	July 2, 2024, 3:53 p.m.

Size	7.8MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`52070a9adf4787ece9b80af208603030`
SHA256	`c41e5e851e0d62fe837b2b44ec114ae83a2dde3ef3943fbe37efaec94b0b6202`
CRC32	`2DE36732`
ssdeep	`196608:u288p8RT3OgtMwVajd4nXhE7OUGCZvb+CV4i8JRzY6SKg:u288+T3O6I2nXhE7OUGClb+CV4vDc`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

Content_497179.exe "C:\Users\test22\AppData\Local\Temp\Content_497179.exe"
3056
- setup.exe .\setup.exe
  1184
  - explorer.exe C:\Windows\Explorer.EXE
    1236
  - foobar2000.exe "C:\Program Files (x86)\foobar2000\foobar2000.exe" /install /quiet /exportshelldata "C:\Users\test22\AppData\Local\Temp\fb2kshelldata.tmp"
    452
  - foobar2000 Shell Associations Updater.exe "C:\Program Files (x86)\foobar2000\foobar2000 Shell Associations Updater.exe" "C:\Users\test22\AppData\Local\Temp\fb2kshelldata.tmp"
    1704
  - foobar2000.exe "C:\Program Files (x86)\foobar2000\foobar2000.exe"
    2516

Name	Response	Post-Analysis Lookup
codeonicinc.com	A 104.26.8.6 A 172.67.69.54 A 104.26.9.6	104.26.8.6

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.69.54	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49167 -> 172.67.69.54:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49164 -> 172.67.69.54:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.102:49167 172.67.69.54:443	C=US, O=Google Trust Services, CN=WE1	CN=codeonicinc.com	86:da:8b:36:46:21:b9:cf:2c:38:f1:8a:de:64:e9:75:47:0f:ee:47
TLS 1.2 192.168.56.102:49164 172.67.69.54:443	C=US, O=Google Trust Services, CN=WE1	CN=codeonicinc.com	86:da:8b:36:46:21:b9:cf:2c:38:f1:8a:de:64:e9:75:47:0f:ee:47

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 2, 2024, 3:51 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 2, 2024, 3:51 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 2, 2024, 3:51 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 2, 2024, 3:51 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 2, 2024, 3:51 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 2, 2024, 3:52 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 2, 2024, 3:52 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 2, 2024, 3:51 p.m.			0	0
IsDebuggerPresent July 2, 2024, 3:51 p.m.			0	0
IsDebuggerPresent July 2, 2024, 3:51 p.m.			0	0
IsDebuggerPresent July 2, 2024, 3:52 p.m.			0	0
IsDebuggerPresent July 2, 2024, 3:52 p.m.			0	0

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	c:\program files\mozilla firefox\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 2, 2024, 3:51 p.m.		1	1	0

Starts servers listening (6 events)

Time & API	Arguments	Status	Return
bind July 2, 2024, 3:51 p.m.	ip_address: 127.0.0.1 socket: 500 port: 0	1	0
listen July 2, 2024, 3:51 p.m.	socket: 500 backlog: 1	1	0
accept July 2, 2024, 3:51 p.m.	ip_address: socket: 500 port: 0	1	508
bind July 2, 2024, 3:51 p.m.	ip_address: 127.0.0.1 socket: 476 port: 0	1	0
listen July 2, 2024, 3:51 p.m.	socket: 476 backlog: 1	1	0
accept July 2, 2024, 3:51 p.m.	ip_address: socket: 476 port: 0	1	508

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header

suspicious_request

POST https://codeonicinc.com/

Performs some HTTP requests (1 event)

request

POST https://codeonicinc.com/

Sends data using the HTTP POST Method (1 event)

request

POST https://codeonicinc.com/

Allocates read-write-execute memory (usually to unpack itself) (10 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 2, 2024, 3:51 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741d2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 2, 2024, 3:51 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74253000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 2, 2024, 3:51 p.m.	process_identifier: 1184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741d2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 2, 2024, 3:51 p.m.	process_identifier: 1184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f05000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 2, 2024, 3:51 p.m.	process_identifier: 1184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74253000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 2, 2024, 3:52 p.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000081e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 2, 2024, 3:51 p.m.	process_identifier: 452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741d2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 2, 2024, 3:52 p.m.	process_identifier: 2516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74402000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 2, 2024, 3:52 p.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 2, 2024, 3:52 p.m.	process_identifier: 2516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73823000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW July 2, 2024, 3:51 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 9109377024 root_path: C:\ total_number_of_bytes: 0	1	1	0
GetDiskFreeSpaceExW July 2, 2024, 3:51 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 9096941568 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1	0

Creates executable files on the filesystem (50 out of 76 events)

file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-sysinfo-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-file-l2-1-0.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-crt-string-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-timezone-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-file-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\msvcp140.dll
file	C:\Program Files (x86)\foobar2000\vccorlib140.dll
file	C:\Program Files (x86)\foobar2000\msvcp140_1.dll
file	C:\Program Files (x86)\foobar2000\foobar2000.exe
file	C:\Program Files (x86)\foobar2000\sqlite3.dll
file	C:\Program Files (x86)\foobar2000\components\foo_fileops.dll
file	C:\Users\test22\AppData\Local\Temp\nsq3332.tmp\UAC.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-localization-l1-2-0.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-heap-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-processthreads-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-rtlsupport-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-datetime-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\msvcp140_atomic_wait.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-processenvironment-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-crt-utility-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\components\foo_unpack.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-crt-process-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\components\foo_dsp_std.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-file-l1-2-0.dll
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\foobar2000.lnk
file	C:\Program Files (x86)\foobar2000\PP-UWP-Interop.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-crt-runtime-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\components\foo_dsp_eq.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-synch-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-debug-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\nsq3332.tmp\System.dll
file	C:\Program Files (x86)\foobar2000\uninstall.exe
file	C:\Program Files (x86)\foobar2000\components\foo_freedb2.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-synch-l1-2-0.dll
file	C:\Users\Public\Desktop\foobar2000.lnk
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-crt-locale-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\avcodec-fb2k-60.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-profile-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-errorhandling-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-console-l1-2-0.dll
file	C:\Program Files (x86)\foobar2000\runtime\ucrtbase.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-crt-conio-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\shared.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-string-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-crt-private-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-util-l1-1-0.dll
file	C:\Program Files (x86)\foobar2000\runtime\api-ms-win-core-processthreads-l1-1-1.dll
file	C:\Program Files (x86)\foobar2000\avutil-fb2k-58.dll
file	C:\Program Files (x86)\foobar2000\components\foo_input_std.dll
file	C:\Users\test22\AppData\Local\Temp\7zS0FB7451D\setup.exe

Creates a shortcut to an executable file (16 events)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\foobar2000.lnk
file	C:\Users\test22\Desktop\foobar2000.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Chrome.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
file	C:\Users\Public\Desktop\foobar2000.lnk

Drops a binary and executes it (1 event)

file	C:\Program Files (x86)\foobar2000\foobar2000.exe

Drops an executable to the user AppData folder (4 events)

file	C:\Users\test22\AppData\Local\Temp\nsq3332.tmp\System.dll
file	C:\Users\test22\AppData\Local\Temp\nsq3332.tmp\UAC.dll
file	C:\Users\test22\AppData\Local\Temp\7zS0FB7451D\setup.exe
file	C:\Users\test22\AppData\Local\Temp\nsq3332.tmp\nsDialogs.dll

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (9 events)

Time & API	Arguments	Status	Return
Process32NextW July 2, 2024, 3:51 p.m.	snapshot_handle: 0x000001c0 process_name: tvnserver.exe process_identifier: 2580	1	1
Process32NextW July 2, 2024, 3:51 p.m.	snapshot_handle: 0x000001c0 process_name: tvnserver.exe process_identifier: 2660	1	1
Process32NextW July 2, 2024, 3:51 p.m.	snapshot_handle: 0x000001c0 process_name: pw.exe process_identifier: 2692	1	1
Process32NextW July 2, 2024, 3:51 p.m.	snapshot_handle: 0x000001c0 process_name: wsqmcons.exe process_identifier: 2756	1	1
Process32NextW July 2, 2024, 3:51 p.m.	snapshot_handle: 0x000001c0 process_name: sdclt.exe process_identifier: 2764	1	1
Process32NextW July 2, 2024, 3:51 p.m.	snapshot_handle: 0x000001c0 process_name: taskhost.exe process_identifier: 2856	1	1
Process32NextW July 2, 2024, 3:51 p.m.	snapshot_handle: 0x000001c0 process_name: conhost.exe process_identifier: 2972	1	1
Process32NextW July 2, 2024, 3:51 p.m.	snapshot_handle: 0x000001c0 process_name: pw.exe process_identifier: 3044	1	1
Process32NextW July 2, 2024, 3:51 p.m.	snapshot_handle: 0x000001c0 process_name: Content_497179.exe process_identifier: 3056	1	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 2, 2024, 3:51 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 458752 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x10001000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0008e800', u'virtual_address': u'0x0013f000', u'entropy': 7.997112804313907, u'name': u'.data', u'virtual_size': u'0x00091b7c'}

entropy

7.99711280431

description

A section with a high entropy has been found

entropy

0.30587603971

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW July 2, 2024, 3:51 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 2, 2024, 3:51 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 2, 2024, 3:52 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 2, 2024, 3:52 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1

Queries for potentially installed applications (3 events)

Time & API	Arguments	Return
RegOpenKeyExW July 2, 2024, 3:51 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\foobar2000 base_handle: 0x00000088 key_handle: 0x00000000 options: 0 access: 0x0002001f regkey: \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\foobar2000	2
RegOpenKeyExW July 2, 2024, 3:51 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\foobar2000 base_handle: 0x00000088 key_handle: 0x00000000 options: 0 access: 0x0002001f regkey: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\foobar2000	2
RegOpenKeyExW July 2, 2024, 3:51 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\foobar2000 base_handle: 0x00000088 key_handle: 0x00000000 options: 0 access: 0x0002001f regkey: \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\foobar2000	2

Enumerates services, possibly for anti-virtualization (1 event)

Time & API	Arguments	Status	Return	Repeated
EnumServicesStatusA July 2, 2024, 3:51 p.m.	service_handle: 0x008150e0 service_type: 11 service_status: 3		0	0

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\fb2kshelldata.tmp

Creates known SpyNet files, registry changes and/or mutexes. (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet

Detects the presence of Wine emulator (2 events)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress July 2, 2024, 3:51 p.m.	ordinal: 0 function_address: 0x1007d5c8 function_name: wine_get_version module: ntdll module_address: 0x77470000		3221225785	0
LdrGetProcedureAddress July 2, 2024, 3:51 p.m.	ordinal: 0 function_address: 0x1007d5c8 function_name: wine_get_version module: ntdll module_address: 0x77470000		3221225785	0

Content_497179.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All