Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 3, 2024, 7:51 a.m.	July 3, 2024, 8:04 a.m.

Size	84.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`bc4206081a6f4206dc5b63948b05ef4b`
SHA256	`b771a64bbfce8232710851ea13f5408cc28133ac0537ff1309c749ce85f42633`
CRC32	`6143E9AB`
ssdeep	`1536:yxqjQ+P04wsZLnDrCynM9aR8r8ItiOeF894Fc9U+68OMm:zr8WDrCwM9Ms8ItiOj94Fc9UMOM`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Antivirus - Contains references to security software IsPE32 - (no description) UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format OS_Processor_Check_Zero - OS Processor Check

java_update.exe "C:\Users\test22\AppData\Local\Temp\java_update.exe"
1372
- java_update.exe "C:\Users\test22\AppData\Local\Temp\3582-490\java_update.exe"
  2056

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
142.250.66.142	Active	Moloch
142.251.220.33	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 3, 2024, 7:51 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 3, 2024, 7:51 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 3, 2024, 7:51 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 3, 2024, 7:51 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 3, 2024, 7:51 a.m.			0	0
IsDebuggerPresent July 3, 2024, 7:51 a.m.			0	0
IsDebuggerPresent July 3, 2024, 7:51 a.m.			0	0
IsDebuggerPresent July 3, 2024, 7:51 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey July 3, 2024, 7:51 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b03ff80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 3, 2024, 7:51 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b03fff0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 3, 2024, 7:51 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b03fff0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 3, 2024, 7:51 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

Allocates read-write-execute memory (usually to unpack itself) (50 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ec1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000850000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000008f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c8b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000520000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000580000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e6a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f46000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e7a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e8b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ebc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e8d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f92000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f93000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f94000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f95000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f96000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f97000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e7b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:51 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW July 3, 2024, 7:51 a.m.	total_number_of_free_bytes: 9933221888 free_bytes_available: 9933221888 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Steals private information from local Internet browsers (1 event)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe

Creates executable files on the filesystem (50 out of 194 events)

file	C:\Program Files (x86)\Mozilla Thunderbird\pingsender.exe
file	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE15\OLicenseHeartbeat.exe
file	C:\Program Files (x86)\Hnc\HncUtils\HncUpdate.exe
file	C:\Program Files (x86)\Microsoft Office\Office15\ACCICONS.EXE
file	C:\Program Files (x86)\Mozilla Thunderbird\plugin-container.exe
file	C:\Program Files (x86)\Microsoft Office\Office15\PDFREFLOW.EXE
file	C:\util\curl\curl.exe
file	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe
file	C:\Program Files (x86)\Microsoft Office\Office15\WORDICON.EXE
file	C:\Program Files (x86)\Java\jre1.8.0_131\bin\javaw.exe
file	C:\Program Files (x86)\Google\Update\1.3.36.101\GoogleUpdate.exe
file	C:\Program Files (x86)\Microsoft Office\Office15\GROOVE.EXE
file	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
file	C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssvagent.exe
file	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
file	C:\Program Files (x86)\Google\Update\1.3.36.101\GoogleUpdateBroker.exe
file	C:\Windows\svchost.com
file	C:\Python27\Scripts\easy_install.exe
file	C:\MSOCache\All Users\{91150000-0011-0000-0000-0000000FF1CE}-C\ose.exe
file	C:\ProgramData\Oracle\Java\javapath\java.exe
file	C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.36.102\GoogleUpdateSetup.exe
file	C:\Program Files (x86)\Microsoft Office\Office15\CNFNOT32.EXE
file	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE15\MSOICONS.EXE
file	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE15\Office Setup Controller\ODeploy.exe
file	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE15\LICLUA.EXE
file	C:\Program Files (x86)\Google\Update\1.3.36.101\GoogleCrashHandler64.exe
file	C:\Program Files (x86)\Hnc\Common80\HimTrayIcon.exe
file	C:\Program Files (x86)\Java\jre1.8.0_131\bin\unpack200.exe
file	C:\Program Files (x86)\Microsoft Office\Office15\POWERPNT.EXE
file	C:\Program Files (x86)\Hnc\Hwp80\HwpFinder.exe
file	C:\Program Files (x86)\Hnc\HncUtils\HncInfo.exe
file	C:\Program Files (x86)\EditPlus\editplus.exe
file	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE15\CSISYNCCLIENT.EXE
file	C:\Program Files (x86)\Microsoft Office\Office15\DCF\DATABASECOMPARE.EXE
file	C:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe
file	C:\MSOCache\All Users\{91150000-0011-0000-0000-0000000FF1CE}-C\setup.exe
file	C:\Program Files (x86)\Hnc\Hwp80\HwpPrnMng.exe
file	C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
file	C:\Program Files (x86)\Google\Chrome\Application\chrome_proxy.exe
file	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
file	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE15\FLTLDR.EXE
file	C:\Program Files (x86)\Common Files\Adobe\__ARM\1.0\AdobeARM.exe
file	C:\Program Files (x86)\Mozilla Thunderbird\minidump-analyzer.exe
file	C:\Program Files (x86)\Google\Update\Install\{9946EF02-26CF-4F0D-BC28-8677420F30DD}\GoogleUpdateSetup.exe
file	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\110\SQLDumper.exe
file	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
file	C:\Program Files (x86)\Mozilla Thunderbird\crashreporter.exe
file	C:\Program Files (x86)\Microsoft Office\Office15\OcPubMgr.exe
file	C:\Program Files (x86)\Microsoft Office\Office15\misc.exe
file	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE15\Office Setup Controller\Setup.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\3582-490\java_update.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe
file	C:\Users\test22\AppData\Local\Temp\3582-490\java_update.exe

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 3, 2024, 7:51 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (2 events)

host	142.250.66.142
host	142.251.220.33

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default)

reg_value

C:\Windows\svchost.com "%1" %*

Creates a slightly modified copy of itself (2 events)

description	Possibly a polymorphic version of itself				file	{u'size': 86288, u'yara': [{u'strings': [u'R2V0TW9kdWxlRg=='], u'meta': {u'date': u'2021-03-11', u'description': u'Malicious_Library', u'author': u'r0d'}, u'name': u'Malicious_Library_Zero', u'offsets': {u'o77': [[33240L, 0], [77306L, 0]]}}, {u'strings': [u'TVo='], u'meta': {u'ini_date': u'2020-06-03', u'description': u'PE File Signature', u'author': u'r0d'}, u'name': u'PE_Header_Zero', u'offsets': {u'signature': [[0L, 0]]}}, {u'strings': [], u'meta': {u'description': u'(no description)'}, u'name': u'IsPE32', u'offsets': {}}, {u'strings': [u'Y2Vzc29y'], u'meta': {u'date': u'2021-05-13', u'update': u'2021-06-22', u'description': u'UPX packed file', u'author': u'r0d'}, u'name': u'UPX_Zero', u'offsets': {u's55': [[82477L, 0]]}}, {u'strings': [u'TVpQ'], u'meta': {u'description': u'MZP(Delphi) file format', u'author': u'r0d'}, u'name': u'mzp_file_format', u'offsets': {u'zipmagic': [[0L, 0]]}}], u'sha1': u'6abc08a3f42d045df8d82e8911a08f3aa1659dff', u'name': u'0cb7ce12861ce9bb_eppshellreg32.exe', u'filepath': u'C:\\Program Files (x86)\\EditPlus\\eppshellreg32.exe', u'sha512': u'79ae58d4b1f6e4ba28da1f6bf3d5c5693c25eedc6b138a3e45f795ed32f4dde02b4fe05d1931b084d70b4025c6aef40bd51995dbd7e08377288345caf55c22d1', u'urls': [u'https://www.thawte.com/cps0/', u'http://crl.thawte.com/ThawteTimestampingCA.crl0', u'https://www.thawte.com/repository0', u'http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(', u'http://crl.thawte.com/ThawtePCA.crl0', u'http://ocsp.thawte.com0', u'http://th.symcb.com/th.crt0', u'http://ts-aia.ws.symantec.com/tss-ca-g2.cer0', u'http://www.editplus.com/0', u'http://th.symcd.com0', u'http://th.symcb.com/th.crl0', u'http://ts-ocsp.ws.symantec.com07'], u'crc32': u'A6D2D323', u'path': u'/home/cuckoo/.cuckoo/storage/analyses/51361/files/0cb7ce12861ce9bb_eppshellreg32.exe', u'ssdeep': u'1536:yxqjQ+P04wsZLnDrCGAEvZUGhIPUJ+HHt:zr8WDrCGAAJ+nt', u'sha256': u'0cb7ce12861ce9bbd42f7de7f94d86e49bf2423613ecf4b82109f9b87d181c65', u'type': u'PE32 executable (GUI) Intel 80386, for MS Windows', u'pids': [1372], u'md5': u'35726345f5b69e03d2272f434698024c', u'virustotal': {u'summary': {u'error': u'resource has not been scanned yet'}}}
description	Possibly a polymorphic version of itself				file	{u'size': 85248, u'yara': [{u'strings': [u'R2V0TW9kdWxlRg=='], u'meta': {u'date': u'2021-03-11', u'description': u'Malicious_Library', u'author': u'r0d'}, u'name': u'Malicious_Library_Zero', u'offsets': {u'o77': [[33240L, 0], [76582L, 0]]}}, {u'strings': [u'TVo='], u'meta': {u'ini_date': u'2020-06-03', u'description': u'PE File Signature', u'author': u'r0d'}, u'name': u'PE_Header_Zero', u'offsets': {u'signature': [[0L, 0]]}}, {u'strings': [], u'meta': {u'description': u'(no description)'}, u'name': u'IsPE32', u'offsets': {}}, {u'strings': [u'TVpQ'], u'meta': {u'description': u'MZP(Delphi) file format', u'author': u'r0d'}, u'name': u'mzp_file_format', u'offsets': {u'zipmagic': [[0L, 0]]}}], u'sha1': u'093cd08207c9b5342996b4003d896cbf15777836', u'name': u'b3f64ec94340b1e4_eppie.exe', u'filepath': u'C:\\Program Files (x86)\\EditPlus\\eppie.exe', u'sha512': u'9b762aa825e126fa7ea29b1f4449c35a5d8188eceeed5d7e242a04c9e9e82bcebf81ce7151fc72d0a5b268105123afed96cf2841ef8730aa1db768fed713e124', u'urls': [u'http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(', u'http://th.symcb.com/th.crt0', u'http://crl.thawte.com/ThawteTimestampingCA.crl0', u'https://www.thawte.com/repository0', u'https://www.thawte.com/cps0/', u'http://crl.thawte.com/ThawtePCA.crl0', u'http://ocsp.thawte.com0', u'http://ts-aia.ws.symantec.com/tss-ca-g2.cer0', u'http://www.editplus.com/0', u'http://th.symcd.com0', u'http://th.symcb.com/th.crl0', u'http://ts-ocsp.ws.symantec.com07'], u'crc32': u'ED3280FD', u'path': u'/home/cuckoo/.cuckoo/storage/analyses/51361/files/b3f64ec94340b1e4_eppie.exe', u'ssdeep': u'768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJfnXWWQ3N+0d+v1Ge8jM/q9gPWBpl:yxqjQ+P04wsZLnDrCkGWuUtPW0A+U', u'sha256': u'b3f64ec94340b1e4a5d8b28266e9c61a3f65e9b4af5a187857dfa1698e8502c5', u'type': u'PE32 executable (GUI) Intel 80386, for MS Windows', u'pids': [1372], u'md5': u'24baedabc817cb48f8b2d7363221c1f9', u'virustotal': {u'summary': {u'error': u'resource has not been scanned yet'}}}

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (1 event)

Time & API	Arguments	Status	Return	Repeated
CryptHashData July 3, 2024, 7:51 a.m.	buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x0000000000506620 flags: 0	1	1	0

java_update.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All