Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 15, 2024, 4:37 p.m.	July 15, 2024, 4:39 p.m.

Size	836.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`a849c8e77640b84fb11c61c2caeaef24`
SHA256	`50e6f55976a9523622a8800986307d009cfcb437b5c3d1cd16af01bc80f14778`
CRC32	`066FD948`
ssdeep	`12288:JiLZhlSvNp0B6oswKscYIiKAsp7VrXMA2FXaIuzmM7Kzd6lVG9NdzX:qWvNpBVw1Tnjszr8lF5YmMA6lyPzX`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

buildz.exe "C:\Users\test22\AppData\Local\Temp\buildz.exe"
1740
- buildz.exe "C:\Users\test22\AppData\Local\Temp\buildz.exe"
  2280
  - icacls.exe icacls "C:\Users\test22\AppData\Local\c957d5fd-ca44-4a8b-977c-6872b6d96dbb" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    2528
  - buildz.exe "C:\Users\test22\AppData\Local\Temp\buildz.exe" --Admin IsNotAutoStart IsNotTask
    2620
    - buildz.exe "C:\Users\test22\AppData\Local\Temp\buildz.exe" --Admin IsNotAutoStart IsNotTask
      2820

Name	Response	Post-Analysis Lookup
cajgtus.com	A 109.98.58.98 A 201.119.21.50 A 217.219.131.81 A 148.230.249.9 A 131.255.215.165 A 211.168.53.110 A 187.152.15.89 A 211.181.24.133 A 189.61.54.32 A 211.181.24.132	181.123.219.23
api.2ip.ua	A 104.21.65.24 A 172.67.139.220	172.67.139.220

IP Address	Status	Action
131.255.215.165	Active	Moloch
164.124.101.2	Active	Moloch
172.67.139.220	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2027026	ET POLICY External IP Address Lookup DNS Query (2ip .ua)	Device Retrieving External IP Address Detected
TCP 192.168.56.103:49171 -> 172.67.139.220:443	2033214	ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)	Potentially Bad Traffic
TCP 192.168.56.103:49171 -> 172.67.139.220:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49164 -> 172.67.139.220:443	2033214	ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)	Potentially Bad Traffic
TCP 192.168.56.103:49164 -> 172.67.139.220:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49172 -> 131.255.215.165:80	2002400	ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)	A Network Trojan was detected
TCP 192.168.56.103:49172 -> 131.255.215.165:80	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	A Network Trojan was detected
TCP 131.255.215.165:80 -> 192.168.56.103:49172	2036335	ET MALWARE Win32/Filecoder.STOP Variant Public Key Download	A Network Trojan was detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49171 172.67.139.220:443	C=US, O=Google Trust Services, CN=WE1	CN=2ip.ua	ff:79:da:c4:72:a8:32:8f:28:1d:c9:7f:3a:b0:c3:0e:3f:7e:7e:a1
TLSv1 192.168.56.103:49164 172.67.139.220:443	C=US, O=Google Trust Services, CN=WE1	CN=2ip.ua	ff:79:da:c4:72:a8:32:8f:28:1d:c9:7f:3a:b0:c3:0e:3f:7e:7e:a1

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 15, 2024, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 4:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 4:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 4:38 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 15, 2024, 4:37 p.m.			0	0
IsDebuggerPresent July 15, 2024, 4:38 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.jorivo
section	.viw

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (2 events)

request	GET http://cajgtus.com/lancer/get.php?pid=06280D9CD13939E9B7E95CDCAA6A83CC&first=true
request	GET https://api.2ip.ua/geo.json

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 15, 2024, 4:37 p.m.	process_identifier: 1740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 593920 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03a30000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 4:37 p.m.	process_identifier: 1740 region_size: 1159168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2024, 4:38 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 593920 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023f0000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 4:38 p.m.	process_identifier: 2620 region_size: 1159168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0009f200', u'virtual_address': u'0x00001000', u'entropy': 7.883590631692135, u'name': u'.text', u'virtual_size': u'0x0009f1de'}

entropy

7.88359063169

description

A section with a high entropy has been found

entropy

0.761819269898

description

Overall entropy of this PE file is high

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://www.openssl.org/support/faq.html

Yara rule detected in process memory (40 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Match Windows Inet API call	rule	Str_Win32_Internet_API

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 15, 2024, 4:37 p.m.	process_identifier: 2280 region_size: 1273856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000a8	1	0	0
NtAllocateVirtualMemory July 15, 2024, 4:38 p.m.	process_identifier: 2820 region_size: 1273856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000a8	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper

reg_value

"C:\Users\test22\AppData\Local\c957d5fd-ca44-4a8b-977c-6872b6d96dbb\buildz.exe" --AutoStart

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 15, 2024, 4:37 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2280 process_handle: 0x000000a8	1	1	0
WriteProcessMemory July 15, 2024, 4:38 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2820 process_handle: 0x000000a8	1	1	0

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1740 called NtSetContextThread to modify thread in remote process 2280
Process injection	Process 2620 called NtSetContextThread to modify thread in remote process 2820
NtSetContextThread July 15, 2024, 4:37 p.m.	registers.eip: 2005598660 registers.esp: 1638384 registers.edi: 0 registers.eax: 4342081 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000a4 process_identifier: 2280	1	0	0
NtSetContextThread July 15, 2024, 4:38 p.m.	registers.eip: 2005598660 registers.esp: 1638384 registers.edi: 0 registers.eax: 4342081 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000a4 process_identifier: 2820	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1740 resumed a thread in remote process 2280
Process injection	Process 2280 resumed a thread in remote process 2620
Process injection	Process 2620 resumed a thread in remote process 2820
NtResumeThread July 15, 2024, 4:37 p.m.	thread_handle: 0x000000a4 suspend_count: 1 process_identifier: 2280	1	0	0
NtResumeThread July 15, 2024, 4:38 p.m.	thread_handle: 0x000002c8 suspend_count: 1 process_identifier: 2620	1	0	0
NtResumeThread July 15, 2024, 4:38 p.m.	thread_handle: 0x000000a4 suspend_count: 1 process_identifier: 2820	1	0	0

Uses suspicious command line tools or Windows utilities (1 event)

cmdline

icacls "C:\Users\test22\AppData\Local\c957d5fd-ca44-4a8b-977c-6872b6d96dbb" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Executed a process and injected code into it, probably while unpacking (17 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW July 15, 2024, 4:37 p.m.	thread_identifier: 2284 thread_handle: 0x000000a4 process_identifier: 2280 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\buildz.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\buildz.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\buildz.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000a8	1	1
NtGetContextThread July 15, 2024, 4:37 p.m.	thread_handle: 0x000000a4	1	0
NtUnmapViewOfSection July 15, 2024, 4:37 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2280 process_handle: 0x000000a8	1	0
NtAllocateVirtualMemory July 15, 2024, 4:37 p.m.	process_identifier: 2280 region_size: 1273856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000a8	1	0
WriteProcessMemory July 15, 2024, 4:37 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2280 process_handle: 0x000000a8	1	1
NtSetContextThread July 15, 2024, 4:37 p.m.	registers.eip: 2005598660 registers.esp: 1638384 registers.edi: 0 registers.eax: 4342081 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000a4 process_identifier: 2280	1	0
NtResumeThread July 15, 2024, 4:37 p.m.	thread_handle: 0x000000a4 suspend_count: 1 process_identifier: 2280	1	0
CreateProcessInternalW July 15, 2024, 4:37 p.m.	thread_identifier: 2532 thread_handle: 0x00000318 process_identifier: 2528 current_directory: filepath: track: 1 command_line: icacls "C:\Users\test22\AppData\Local\c957d5fd-ca44-4a8b-977c-6872b6d96dbb" /deny *S-1-1-0:(OI)(CI)(DE,DC) filepath_r: stack_pivoted: 0 creation_flags: 72 (DETACHED_PROCESS\|IDLE_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000500	1	1
CreateProcessInternalW July 15, 2024, 4:37 p.m.	thread_identifier: 2624 thread_handle: 0x000002c8 process_identifier: 2620 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\buildz.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\buildz.exe" --Admin IsNotAutoStart IsNotTask filepath_r: C:\Users\test22\AppData\Local\Temp\buildz.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002d0	1	1
NtResumeThread July 15, 2024, 4:38 p.m.	thread_handle: 0x000002c8 suspend_count: 1 process_identifier: 2620	1	0
CreateProcessInternalW July 15, 2024, 4:38 p.m.	thread_identifier: 2824 thread_handle: 0x000000a4 process_identifier: 2820 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\buildz.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\buildz.exe" --Admin IsNotAutoStart IsNotTask filepath_r: C:\Users\test22\AppData\Local\Temp\buildz.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000a8	1	1
NtGetContextThread July 15, 2024, 4:38 p.m.	thread_handle: 0x000000a4	1	0
NtUnmapViewOfSection July 15, 2024, 4:38 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2820 process_handle: 0x000000a8	1	0
NtAllocateVirtualMemory July 15, 2024, 4:38 p.m.	process_identifier: 2820 region_size: 1273856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000a8	1	0
WriteProcessMemory July 15, 2024, 4:38 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2820 process_handle: 0x000000a8	1	1
NtSetContextThread July 15, 2024, 4:38 p.m.	registers.eip: 2005598660 registers.esp: 1638384 registers.edi: 0 registers.eax: 4342081 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000a4 process_identifier: 2820	1	0
NtResumeThread July 15, 2024, 4:38 p.m.	thread_handle: 0x000000a4 suspend_count: 1 process_identifier: 2820	1	0

buildz.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All