Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 2, 2024, 5:18 p.m.	Aug. 2, 2024, 5:25 p.m.

Size	264.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d0e4beee4073fbe4ffeaf89c052eab2b`
SHA256	`fce63851c1d0a4bf68fb415fac1dae78bcadd13b8fd0e8acb2d4bd84c843b2d3`
CRC32	`208A76E8`
ssdeep	`3072:3TQ+RgPx3Bl6wY6PGrmemXLaQwZz4Iux6Yk2UrMKN4uryMXgVI4bHCm7AmyRctPO:3h6Mmr21v4KSEyVyRSxo`
Yara	ftp_command - ftp command Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE32 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

guardservice.exe "C:\Users\test22\AppData\Local\Temp\guardservice.exe"
496
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
sgz-1302338321.cos.ap-guangzhou.myqcloud.com	A 159.75.57.69 CNAME gz.file.myqcloud.com A 159.75.57.35 A 159.75.57.36	159.75.57.69

IP Address	Status	Action
159.75.57.69	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2050736	ET INFO Tencent Cloud Storage Domain in DNS Lookup (myqcloud .com)	Misc activity
TCP 192.168.56.103:49163 -> 159.75.57.69:443	2050737	ET INFO Observed Tencent Cloud Storage Domain (myqcloud .com in TLS SNI)	Misc activity
TCP 192.168.56.103:49163 -> 159.75.57.69:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49163 -> 159.75.57.69:443	2050737	ET INFO Observed Tencent Cloud Storage Domain (myqcloud .com in TLS SNI)	Misc activity

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49163 159.75.57.69:443	C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G3	C=CN, ST=Guangdong, L=Shenzhen, O=Shenzhen Tencent Computer Systems Company Limited, CN=*.cos.ap-guangzhou.myqcloud.com	92:52:87:fc:ce:db:af:62:b4:ce:28:44:27:01:5e:3d:63:8d:d7:12

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 2, 2024, 5:18 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Aug. 2, 2024, 5:18 p.m.	computer_name: TEST22-PC	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 2, 2024, 5:18 p.m.		1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

Performs some HTTP requests (1 event)

request

GET https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/store_app/Update.exe

Foreign language identified in PE resource (1 event)

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005d058

size

0x00000264

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\guardservice.exe.lnk
file	C:\Users\test22\AppData\Local\Temp\Update.exe

Creates a shortcut to an executable file (2 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\guardservice.exe.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C:\Users\test22\AppData\Local\Temp\guardservice.exe.lnk

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\Update.exe

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (9 events)

Time & API	Arguments	Status	Return
Process32NextW Aug. 2, 2024, 5:18 p.m.	snapshot_handle: 0x00000290 process_name: mobsync.exe process_identifier: 1668	1	1
Process32NextW Aug. 2, 2024, 5:18 p.m.	snapshot_handle: 0x00000290 process_name: sdclt.exe process_identifier: 508	1	1
Process32NextW Aug. 2, 2024, 5:18 p.m.	snapshot_handle: 0x00000290 process_name: taskhost.exe process_identifier: 1508	1	1
Process32NextW Aug. 2, 2024, 5:18 p.m.	snapshot_handle: 0x00000290 process_name: cmd.exe process_identifier: 1488	1	1
Process32NextW Aug. 2, 2024, 5:18 p.m.	snapshot_handle: 0x00000290 process_name: conhost.exe process_identifier: 808	1	1
Process32NextW Aug. 2, 2024, 5:18 p.m.	snapshot_handle: 0x00000290 process_name: SearchProtocolHost.exe process_identifier: 1712	1	1
Process32NextW Aug. 2, 2024, 5:18 p.m.	snapshot_handle: 0x00000290 process_name: SearchFilterHost.exe process_identifier: 1984	1	1
Process32NextW Aug. 2, 2024, 5:18 p.m.	snapshot_handle: 0x00000290 process_name: guardservice.exe process_identifier: 496	1	1
Process32NextW Aug. 2, 2024, 5:18 p.m.	snapshot_handle: 0x00000290 process_name: pw.e糀 process_identifier: 140		0

An executable file was downloaded by the process guardservice.exe (3 events)

Time & API	Arguments	Status	Return
InternetReadFile Aug. 2, 2024, 5:18 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $LôùT#s ^%ju>³Õ>³ràxà6Ï RichPEL?YfààÀ N½ ð@ /P()à-°ð.textçÜà `.rdata^ð`ð@@.dataèP) P)@À.rsrc°à-Àð*@@ request_handle: 0x00cc000c	1	1
InternetReadFile Aug. 2, 2024, 5:18 p.m.	buffer: p»á»°Ê§°Ü!701 ½âÎöURLµØÖ·Ê§°Ü!700 µ±Ç°ÏµÍ³²»Ö§³ÖWinHttp·þÎñ!1 A± AGþ@mAvA:A<AAA&A:-ð¿"#ÒýºÅ=deleted=H¯¼ò×z>SkinH_AttachResComet.WndShadowComet.WndShadow.ColorComet.WndShadow.SizeComet.WndShadow.ProcSysShadowStatic @Àb@Y@p@ð@æMZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $mÕÌÌÌ·cÎOc ÕBw\ÍOw^ÇÌ%úY}úY ±yÍ3_ÍRichÌPEL Mà!àÀ0¢ Ð° ÀP±` ô¯\° ôÿ°»UPX0ÀàUPX1àÐÖ@à.rsrc° Ú@À3.05UPX! ¢d\|þ±ý (Ò¼ &ºÿ·ÿÿ¸è¤ì SWÙÙÔ}ÿ~Z·ÿ¿ÿEVpMÔFøÿvüeü"ØEMkíw)ÍËä6 èmÓ4ìð@PB;ÿu÷ÿÿûØMüÿÛÆOYu®^Mô_[d ÁvûÿÉÂVñ3ÀjNAAiðûÍÆ^ÃÿquYÃW¬?à?@SVWMä[]DìQSþûïÿÿP$3ö;Æ®9uì=4;A{ nð HQèQ\p{ðQVSf(À^àupÎ´üVP°`ðòè$´ÆEüPÍ÷¶M¸"F,Ô %p;3D´ äøkðÛ¸)åYÿ×F;4,r¼ç^éÞàoï;Òàëåÿ1ÿGÃUìÛ ¶$AZ¸$89tþíÿÁÀðrò}t pëÿpëv0÷ÝòÜPQÞÓÜfmcá±-n¾ù3Û9_~/ðö¾¾G4\|@ >u¥}¨X"ëTæQP0ÿâv1C;Z\|Ó^6Ãbt$ö~j Ãþû¹p`<±ËNuñ^pD$Úÿ{w\$IW+sÿ+ÇtHtHu þë ýþp+ÂøÑÿWßÿ3¶+xÞ÷V'G1U;íÿ"I3í9n~j-ÿE;"é1¸`\|îI]J%ØQáñ=LSY/x]aÛÀ\öÄA®¯ »Ý@8]ºu¿fH¨ª}4Ùªù"H"Ðp8jÔØ¢vk°Ø°ÐPÕè$vþkfÇÐ°;ûÆÎ`¨(sØsxëþlC[ü}¨WQÄòºReOÎ¡t\¿«ýP!°hvnÏ3È àÝ Zë5,'oíiºðë¢f®¨& uVfîþÿ;Ãtf=uKf÷ØÀ ä#E°QÙvA»øöìPSìð;óæÛ¢y=9:ä4oûÞ£PÛ×éÇªu#k:d·b9K·ûØº5ØêuÖ¨e[n×´ü4\P°t {²£Óë{FXWê? KÇð¶F¸ëRj<½Q®ÄM\ÀjçU¦ ´ÄÇ 7¬uxYpÄ¿jáab§ÄïWV7 L>AÿP ðÛÿ,¦ ;H2Ñ¨úèýÿÿ!ïûÀmÇëÙÆëÉéÿoúO¨u \|J².t²DL$¤ûÛÿÐâöÚÒ$Â.Q#´Êe$ &%mûÿöØÀa$:DA»~_(f8@ E>ìÍh/PÇlXì°<u?v¿nBøPV,a8®uXûØPW¤m;ãÀ$PÊÿ5J [õ1ÛZ^É×üÔg¸ìxrXët0ëNõül¸e6Y"T{Ðî ¤êéW ¿äpCòð¨þím:ÀäEÈÊüøu{OÑ<¥éW.Ê¢vsuëæÝxÇÓeSà~ìPÙWÖéÝj"Áh¼fjcK¦}c>jN¾§Ûäë#¢gÌØØÇ$GvØÈ?ªÌýðCöéþ\|6_^3ÀíWyàe¨WjDYhÅö]ªó«f«z_¦tVàQòÿ0¨ \PPènG]äèÚÕàû\$äæí>¸kUäRBQ´eè¸êtr}á ÌPÍä2ÀëVÁµÏeè7 QVÃA° _ì l0 «PXÃ+Põòè°$Bujö^áLE÷V,æ¿yk @;Ãhÿÿÿ¹\.l`dXT£^XEò¿Q¾×^Ý"`·ó4¨âMÓ ¤uÖ:,V\|dÇKHìæST!0~`êú~áûÊt0Áè,¶»Ý+`ê!Sÿµzæ¨X#mø¤a°èÖ]¶ª8ÿ¨Î(ú î´,(DÇ<]dnCÜ@ kðP,^îìSnýöûfãæ8 =@üáAqÑì8ÎN²Èv0Wú> ¼bÄðuy;z¦ûú )Zc}Aï½Z Ö¤W¦ð2,f >Ô7½ûRâXÍ¢Ðë¸»£üîu°ëò¦ø æÛV¨à{8{<0[Ñea6W6Ï½±bÀu_9²~TÍ®FÿMÚpëoè\|+Ú9~#·= 0êPFr<kfð²¡í®½\|¬Æ ÔTbøõðWW'«)Y0>2ðþÔàþ6{Õô"ÿ¬eV Ö}q¾î/ÕXO»IP6ÜäÓ~9X4t (0p\ÀÕ `R>ªàQKYälvB\wÚaôè÷TV hõa«´R\|UðÜRÃÓPè0mØ\|:f÷Î3ÒØþÚÓ'ï-^R\è}d @6sE8.G=P/¼AÀ³k¤ýx t3O3Ù=3YD #Õ`{9G;ØÈ_Ï-gxaùèèZ4øi\ IH<2W8 4ð¤t¨\|}PPs$U¬eP¤a°ãDR@ Òîr"UË¦r(àqÈíìdÊÈ ZvdØs<wG<yä°´t0rÃv¤I°È%¤°ËAÒÈP2?[Gñì"ðþ+ýë°¡1¬t¥!a_è3Zu ØKàpTg\|¹pØpÎÄ`¸ü²ÃúHntP¨ óy°g4ÿií¡]³¬°æPÈÌ¦L,VdNO§køtN3püD 6»y`Tp£t3ÌsxmØ¼3{)ÿrÿuìö¸:øt=W¦¢Ï]aC\|ØºßÎÖpÂu ¸oûÖjßÀP¥ÂçQøñêªM$æsØ-l¥uO»H$jÖðâ¹lXuF$(ëriTà¬6V,N.G,0ÐÛð kßt Ejë¬S¼OÈÌ(a\ÇåíÎ×MÔ¬(°\|z?.Y½?~14UþÔGÜð¤uAFèu<e].ítÒ ®·§øEÌu½ëEÐ·B5¤Buðu>nMóþ¡£Ç Pt7ë2ËMÓ. ¬èðÌ<ò5ÈB6t÷Õ^0ÝXÐ.Ý·ÔlîE`T¼æÒ\¬`°dMÓÞ6~E ÌE A65 request_handle: 0x00cc000c	1	1
InternetReadFile Aug. 2, 2024, 5:18 p.m.	buffer: ï0ü0É00eQRW0f0O0`0U0D00(&P) P ¥òÿÿP 2M óÿÿeQRÞ0¹0¯00YY0(&M)PFF2ÿÿOKP}F2ÿÿ0ã0ó0»0ë0ÀÈú¥Õ0¡0¤0ë0n0 NøfM0ºx -ÿ3ÿ 0ÿ´0·0Ã0¯0Px2éÿÿo0D0(&Y)PPx2êÿÿD0D0H0(&N)Px2ëÿÿhQf0 NøfM0(&A)P¾x2ìÿÿhQf0¹00Ã0×0(&S)PiPíÿÿêÕRvk0 TMR0 Yôf(&U)P¾2ÿÿ-Nbk(&Q)P öÿÿP( ÿÿÿÿãÍQHQn0Õ0©0ë0À0k0o0âek0Õ0¡0¤0ë0L0X[(WW0~0Y00P(#3ÿÿÿÿâeX[n0Õ0¡0¤0ë00P(-ÿÿÿPA-´ÿÿ%s ôf°eåeBf: %.4hu/%.2hu/%.2hu %.2hu:%.2hu:%.2hu µ0¤0º0: %I64u Ð0¤0È0P(K_ÿÿÿÿS0n0Õ0¡0¤0ë0h0nM0ÛcH0~0Y0K0ÿP(UÿÿPAU´ÿÿ%s ôf°eåeBf: %.4hu/%.2hu/%.2hu %.2hu:%.2hu:%.2hu µ0¤0º0: %I64u Ð0¤0È0ÀÈSFX-[ -ÿ3ÿ 0ÿ´0·0Ã0¯0P ÿÿÿÿ¿0¤0È0ë0(&T)P nÿÿP (6ÿÿÿÿËYá0Ã0»0ü0¸0(&B)P 2nÿÿP FP ÿÿ¤0ó0¹0È0ü0é00\Ob(&M)P _.ÿÿÿÿ[L³0Þ0ó0É0(&R)P in ÿÿP }+ÿÿÿÿÇ0£0ì0¯0È0ê0(&D)P nÿÿP 6ÿÿÿÿ[LÕ0¡0¤0ë0 T(&E)P ¥nÿÿP ¹Sÿÿÿÿ[LÕ0¡0¤0ë0n0Ñ0é0á0ü0¿0(&X)P ÃnÿÿP ×G ÿÿãÍQ¶rÁl0h:y(&P)P ë2ÿÿOKPEë2ÿÿ0ã0ó0»0ë0(4VS_VERSION_INFO½ïþ ?StringFileInfod041104b0@CommentsCommon Archiver Project's 7-ZIP32.DLL using Igor Pavlov's 7-Zip8FileDescription7-zip328FileVersion9, 22, 0, 12 InternalNameSevenZipd LegalCopyrightCopyright (C) 2002-2014 by Ëy0u z@OriginalFilename7-zip32.dll0ProductName7-zip32<ProductVersion9, 22, 0, 1DVarFileInfo$Translation°MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $EÃWííínò¦íñ£ ínò§ ínò©íåòíåð íí¬¥í7Ë§í7Ë¦IíÆë«íRichíPEL÷hªSààp O`@pxjd`x UPX0pàUPX1àÒ@à.rsrc`Ö@À1.25UPX! JãSü°!ú(ÏÔ& Á²ýÿÿVñNè 13ÉFxNtHöÿËÿÇ@ÇAÆFhÆ^ÂÛÝÿ¹41V3ÀÇF`"FTXo»-\P,&Ã$Áj6ÛmSZNPJ je3ß $^ºk ÿ¶],04p8P(mË¶-L@DH<Öý½T¸Bg${R<ìðxSe/ÿîÿuWùÎ}Ð0ÀMÔ¶ÿîw±ÇEÔXXE´3ÛP]ü°öî·ï?)-ÿu"°ÆEü&ÀÚFuÿÝwÿ];ÃáV]jwÀYt`û¿HØøë3ÿÿmÌtWËöÛíÿPY°j¨GEÙ»·/ K^MIæi¶3M8ðn¡ÙüööuèVWð·»Cf2ff öìÂÖgnè£PÞ·o¯}×Þèd\@PÿQÓÐ~÷`ÿEMÃÜÝPØ¾X%ÿ*5Ìaû^÷èÍXwýë=YdPV ÿwgÿ?tGPP¥öØÀþÀEÛ7u½OxöGtñt¼Ýt &¿h? request_handle: 0x00cc000c	1	1

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\guardservice.exe				reg_value	C:\Users\test22\AppData\Local\Temp\guardservice.exe
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\guardservice.exe.lnk

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.dh
ALYac	Gen:Variant.Fragtor.168812
Cylance	Unsafe
VIPRE	Gen:Variant.Fragtor.168812
Sangfor	Trojan.Win32.Save.BlackMoon
BitDefender	Gen:Variant.Fragtor.168812
Cybereason	malicious.e4073f
Arcabit	Trojan.Fragtor.D2936C
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/CoinMiner.CIB
APEX	Malicious
ClamAV	Win.Dropper.Tiggre-9845940-0
Alibaba	Trojan:Win32/CoinMiner.de1659a4
MicroWorld-eScan	Gen:Variant.Fragtor.168812
Emsisoft	Gen:Variant.Fragtor.168812 (B)
McAfeeD	ti!FCE63851C1D0
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.d0e4beee4073fbe4
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan/Genome.bmrr
Google	Detected
MAX	malware (ai score=80)
Antiy-AVL	Trojan/Win32.Blamon.a
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Win32.Trojan-Stealer.BlackMoon.D
Varist	W32/Tiny.Q.gen!Eldorado
BitDefenderTheta	Gen:NN.ZexaF.36810.qq0@aWX2otjb
DeepInstinct	MALICIOUS
VBA32	BScope.Trojan.Wacatac
Malwarebytes	Generic.Malware.AI.DDS
Ikarus	Trojan.Crypt
Tencent	Backdoor.Win32.Runshell_l.16001193
MaxSecure	Dropper.Dinwod.frindll
Fortinet	W32/CoinMiner.ESFJ!tr
CrowdStrike	win/malicious_confidence_90% (W)

guardservice.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All