popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 5992923c30024991_wrap.exe
Submit file
Filepath C:\Windows\Tasks\Wrap.exe
Size 1.0MB
Processes 2872 (migrate.exe)
Type PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5 1006dab1f856d5dd0d143893af79dd96
SHA1 debf139adfb779e519e1d3cb506794989aade417
SHA256 5992923c30024991ab8af2d514224d1f282ce84b84b499dd490ce93f0b60593e
CRC32 6D00CFBA
ssdeep 12288:26Z62zgsfjb/cuepmFXvhziRhVP0mpySpmbZwCs:16Hsf/VeUvhziRDP0mQhwC
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 9e24c7b4604aa302_superfetch.exe
Submit file
Filepath C:\Windows\Tasks\Superfetch.exe
Size 1.6MB
Processes 2872 (migrate.exe)
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 362ffce5c7c480702a615f1847191f62
SHA1 75aceaea1dfba0735212c2ab5cafc49257927f73
SHA256 9e24c7b4604aa3022325b62154ac80dc76533fa96a3418d8e15d28c998fb9c53
CRC32 4A25A4D9
ssdeep 24576:kRaZROMOm8FN7TjsPnzt2heeRhQbJEOeamwdKJeSPu6bMo0E37O9ug+:ikxOm+7TjsPnztyDMmarwJJKZn
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 2348673b4b3eae5e_config.json
Submit file
Filepath C:\Windows\Tasks\config.json
Size 5.9KB
Processes 2872 (migrate.exe)
Type ASCII text
MD5 c00001d33367257e19f43ba962bfa454
SHA1 055c3f1ef9c5ecb710e3f90eb3e2e2cb6596ac63
SHA256 2348673b4b3eae5efa1472af87ae3d1afc3f28e24bdd3573f276363ea7182e95
CRC32 EED17930
ssdeep 96:CtWTGyHTrWBPb1DoCIjYkL6fAu0u7uDugoX8koXjDwdR0Dp:LMbBoCIjYkL0Au0u7uDu/cjDwy
Yara None matched
VirusTotal Search for analysis
Name e2eee92ef0ffc251_migrate.exe
Submit file
Filepath C:\ProgramData\migrate.exe
Size 6.6MB
Processes 1492 (miner.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4d877cab8a19afea517ba4436805ce77
SHA1 7210160bd527a3b726ad0686613bff358823de41
SHA256 e2eee92ef0ffc25134049dd0301d464bf8e7b814ba04b25749dea8c0b7cbc29d
CRC32 27AE9417
ssdeep 196608:fTvHxyelpgrkzqglycCX8SgZgCFjLyR6K5p:rQ25zqg9jSdaiR6Kb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 50ac09332ff9d652_ru.bat
Submit file
Filepath C:\ProgramData\ru.bat
Size 32.0B
Processes 1492 (miner.exe)
Type ASCII text, with no line terminators
MD5 11e08b5abf3f1675f99c96f78c128b23
SHA1 40d6dd08262ef959328aec4dc5ed07532232037c
SHA256 50ac09332ff9d6521244b4f9cf6fd9cc489b3324ed1316e07f6a5904230397e7
CRC32 01E5D0EF
ssdeep 3:Ljn9GRVJRBJ8K:fkzjj
Yara None matched
VirusTotal Search for analysis
Name 0ce9bbb32628125a_d93f411851d7c929.customDestinations-ms~RF15dbad2.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF15dbad2.TMP
Size 7.8KB
Processes 2060 (powershell.exe) 2232 (powershell.exe)
Type data
MD5 f10b7b50b374bce66a33d5c2d8018aee
SHA1 514e6dff2673496ecc0e7cb0b276e732b355e2b9
SHA256 0ce9bbb32628125a7da61befe59f44c9b6f96b4fc1b200adc75b1761024eab7f
CRC32 6572EDCC
ssdeep 96:8tuCeGCPDXBqvsqvJCwohtuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:8tvXohtvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name fe3b52bb7f46d01c_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2672 (powershell.exe)
Type data
MD5 3c08500f08f6f91422e840a9f621d79b
SHA1 630abe62d3b3390a40c484005bd2a6a52ac461b5
SHA256 fe3b52bb7f46d01c387c92851d5969576c2be342b7fd34497691ed5927ee6a80
CRC32 8AF031D8
ssdeep 96:DAtuCeGCPDXBqvsqvJCwouAtuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXohtvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 28ef766146f78228_registry.pol
Submit file
Filepath C:\Windows\System32\GroupPolicy\Machine\Registry.pol
Size 4.5KB
Processes 2376 (1.exe)
Type data
MD5 7e15fb09d71c52d26fc87aff66d1b2f4
SHA1 7edf3494fe4df190a4a795b1aa779c3c463b7406
SHA256 28ef766146f78228c0c522e2043fc41a516e8915f5747812b5bf8774b2ea315c
CRC32 25F07B78
ssdeep 96:6Qlw2wuwtPDfdP74nhvQUelh5KZVnNsNtCFfLH/Y067CcAzoioRoSJ:FlRRCDN74hvoD5KL0+fLfYT7CcAzXEPJ
Yara
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 8a3e46233c6e36c3_autD963.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\autD963.tmp
Size 4.5KB
Processes 2376 (1.exe)
Type data
MD5 548eb787e90beae151893c0916dd083f
SHA1 2bddc7306d317e14e4716e0d90a6586618d42702
SHA256 8a3e46233c6e36c3a6fbc57449aae8960b9c1db34230e637aced6767395becfc
CRC32 193559B4
ssdeep 96:eaujWhGHJldyImBiLlM4WYmxwTPiCwo8wKZ2pFnypMA6tCC/:CWMHJldySBMFxw2Cw5RZ2Dnyavb/
Yara None matched
VirusTotal Search for analysis
Name f3b6ae329f85c9f5_st.bat
Submit file
Filepath C:\ProgramData\st.bat
Size 2.8KB
Processes 1492 (miner.exe)
Type DOS batch file, ASCII text, with CRLF line terminators
MD5 13b7481eb65e2933fbbcfa156898c8bc
SHA1 687a4dcc3b6c6e680be18f9298675d683c72172f
SHA256 f3b6ae329f85c9f5da61136e780e16ec752c940e55a7ae07f2fc55769623bd4e
CRC32 85483B91
ssdeep 48:qk+8hGfVlxlflSl6lqlmll6x6ye+ZhcrzoxvcKewS2y6ye+Zhc7oM7oVoxv0xSG:qllxlflSl6lqlmllRQYrsgPcQY7oM7or
Yara None matched
VirusTotal Search for analysis
Name a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RF15dae9d.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF15dae9d.TMP
Size 7.8KB
Type data
MD5 b0c9ff441742f3847ea27da9dee7f2cd
SHA1 c42a1eb32ba953a0ce5d8635caabf71b5b281495
SHA256 a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4
CRC32 0BBCAB1A
ssdeep 96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 713120bac7807f6f_intelconfigservice.exe
Submit file
Filepath C:\Windows\Tasks\IntelConfigService.exe
Size 1.8MB
Processes 2872 (migrate.exe)
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 58e4115267b276452edc1f541e3a8198
SHA1 ec40b6cce5c9a835563c17da81997e8010ac9cad
SHA256 713120bac7807f6fc0a6050135556c0614a66be2fb476cfe163877f3d03b4d08
CRC32 5362AA6B
ssdeep 49152:CkxOm+7TjsPnztyDMma7hZX228vo41ZUKZn:CJotyDIX228vo41Zt
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 1670a91ec9d1bf2a_mstask.exe
Submit file
Filepath C:\Windows\Tasks\MSTask.exe
Size 4.1MB
Processes 2872 (migrate.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 815ac943fb14eb69d059299c89136de3
SHA1 c4cedd22bf42f46da0dd19f57e0859554c5898e1
SHA256 1670a91ec9d1bf2a75378d3c56c36a069ad628adbd6c8c6d3dd31691a1ca4c4d
CRC32 83BD3DF2
ssdeep 49152:Z5Rhgha1CvEYmAn42jPwkFdy3fLpFm5h+lFxWvJ4pjHZ3RXb0CGJa:Z7X1EjGW5h+cvJk5lUJ
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 644c9745d1d2f679_wmiic.exe
Submit file
Filepath C:\Windows\Tasks\Wmiic.exe
Size 365.0KB
Processes 2872 (migrate.exe)
Type PE32+ executable (console) x86-64, for MS Windows
MD5 a18bfe142f059fdb5c041a310339d4fd
SHA1 8ab2b0ddc897603344de8f1d4cc01af118a0c543
SHA256 644c9745d1d2f679db73fcb717dd37e180e19d5b0fc74575e4cefe4f543f2768
CRC32 C79B435E
ssdeep 6144:OI6VyDGb+HiFr4kchE18dkuCj7jLwcYBQkMH9O1BNI/H9O1BNIgqH9O1BNIVH9Oa:OIJDGb+Hiu9hE18dkxfCMo7I/o7Igqok
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 280e5ccacd1622f6_run.bat
Submit file
Filepath C:\Windows\Tasks\run.bat
Size 338.0B
Processes 2872 (migrate.exe)
Type ASCII text, with CRLF line terminators
MD5 20a377ca25c7fcdff75b3720ba83e11c
SHA1 ad3ceb92df33714c7d3f517a77b1086797d72c47
SHA256 280e5ccacd1622f61cfd675f4ae1204790bd5aea648d0e51145d01a772d792ad
CRC32 847BFB6F
ssdeep 6:/8Vc5CPOI+SL1fooTDE3Ili2Z/QG0J96yto1fooTDE3I7Gto/oNbGKvKLI8:snPOHqfoCE3ot0JUyqfoCE3tt2siNL
Yara None matched
VirusTotal Search for analysis
Name 10ea0c9c8b667a25_rchxzwg
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\rchxzwg
Size 19.9KB
Processes 2376 (1.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 f18cdb271dadc491e7effecedcdf0f9a
SHA1 47cd4b64702ac4f301d1af9368139329e83fb467
SHA256 10ea0c9c8b667a25b6edc462ba32ca2260a805754f36a8266dd3b0c2f367a658
CRC32 C7180FE0
ssdeep 384:MvEsry+t+gAp++Q3xNuu/40iffbyfkVu4hjsvdZZ+:Mcq+INu8JrkLhjsvdZZ+
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name 11bd2c9f9e2397c9_winring0x64.sys
Submit file
Filepath C:\Windows\Tasks\WinRing0x64.sys
Size 14.2KB
Processes 2872 (migrate.exe)
Type PE32+ executable (native) x86-64, for MS Windows
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
CRC32 6B0323EB
ssdeep 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
VirusTotal Search for analysis
Name e3b0c44298fc1c14___tmp_rar_sfx_access_check_22914828
Empty file or file not found
Filepath c:\programdata\__tmp_rar_sfx_access_check_22914828
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 15b1158d806de140_curl.exe
Submit file
Filepath C:\ProgramData\curl.exe
Size 5.2MB
Processes 1492 (miner.exe)
Type PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5 104023cef829fce3e34bf1514daff629
SHA1 b6e7b949109298ec7ff1aa64404a859b5b41ccae
SHA256 15b1158d806de14013fdc3f0e81dca725481d2393249994a122c0a70721ae9f5
CRC32 860E015C
ssdeep 98304:sZAOsqvbnypxMKKzxrirSL+7goHUs5YrZDv:BqvbnI2uIVo/5Yrxv
Yara
  • ftp_command - ftp command
  • Malicious_Library_Zero - Malicious_Library
  • NMap - NMAP
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name dca683e92020e2f4_applicationsframehost.exe
Submit file
Filepath C:\Windows\Tasks\ApplicationsFrameHost.exe
Size 8.4MB
Processes 2872 (migrate.exe)
Type PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5 9e02819c5e84a3d8ff67b8cd8ce46b7a
SHA1 138948b1c856314768a066410800bf76909da4eb
SHA256 dca683e92020e2f44762d4b3eb49e5d000d1f8b30f86b77d4b08ac351dc35637
CRC32 A30816DD
ssdeep 98304:Yf04dMGiyNPzKamCTFPZspSsb49xib1clTc2AehDqsAqJgtDTWYdwa92ww4sxY+j:YfP00WJcYd7B0CE6RhpdsXO1QMfK
Yara
  • Malicious_Library_Zero - Malicious_Library
  • XMRig_Miner_IN - XMRig Miner
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE64 - (no description)
  • CoinMiner_IN - CoinMiner
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 5161a16217b9d8b9_1.exe
Submit file
Filepath C:\ProgramData\1.exe
Size 775.9KB
Processes 1492 (miner.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0442a8479aa5f19dd5a64ddfd677b9f8
SHA1 fa003104e8e8e6646049a49bd517224ba34ac4b6
SHA256 5161a16217b9d8b9817ad1f6e1020e2eb625bbd6ccf82fbf9423077d0c966aa0
CRC32 4621F21B
ssdeep 12288:CaWzgMg7v3qnCiPErQohh0F4uCJ8lnyFQp9QudhzYOeoNTdVmoCihEa:taHMv6CrrjSnyFQc+eoBdVmoCeR
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis