popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ConsiderableWinners.exe

Suspicious_Script_Bin Generic Malware UPX Malicious Library PE64 PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 12, 2024, 8:50 a.m. Aug. 12, 2024, 9:12 a.m.
Size 1.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a23837debdc8f0e9fce308bff036f18f
SHA256 848260ba966228c4db251cfbcc0e02d6ca70523a86b56e5c21f55098cec92479
CRC32 BB3E38F8
ssdeep 24576:F5OnmONUzLJq/wjcOVe+/O6B9ZdIadBjfZF/KIu4LtaXLKBTfME0gG3vdSCUxXT:CnmONUzL0/wjtVe+19Zrn/kw9T0uG3vq
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: 1 file(s) moved.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Temporal=U
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: hMOHRec
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Behalf Scheduling Plus Preston Explore Suggested Attribute
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'hMOHRec' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: KDUnable
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Tie Tigers Territory Regulations Enter Importantly Humans
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'KDUnable' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: vmSunrise
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Madrid Dildo Maple Flood Apollo
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'vmSunrise' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: HFPRate
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'HFPRate' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: EYIgnore
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Crazy Real Governor Wicked Revelation Garlic Won
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'EYIgnore' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Commit=5
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: bskEdward
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Nearby Cuisine Shareware Childhood
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'bskEdward' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: dLEducators
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'dLEducators' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: kuSpChester
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Expressed Mh Yang Bankruptcy Purposes Bm
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'kuSpChester' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: yogMadison
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Lighter Whale Establishing
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'yogMadison' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: gNuSafety
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Skirt Shore Broker Lb Proper Blood As Lycos
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'gNuSafety' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: uqGage
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'uqGage' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: OkMonthly
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2084
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\217412\Possibly.pif
cmdline "C:\Windows\System32\cmd.exe" /k move Dk Dk.cmd & Dk.cmd & exit
file C:\Users\test22\AppData\Local\Temp\217412\Possibly.pif
wmi SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /k move Dk Dk.cmd & Dk.cmd & exit
filepath: cmd
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
cmdline cmd /c copy /b Mailing + Violin + Ethernet + Operated + Lunch + Useful 217412\N
cmdline tasklist
Process injection Process 2664 resumed a thread in remote process 2084
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000001c
suspend_count: 0
process_identifier: 2084
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Autoit.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 99)
Skyhigh Artemis!Trojan
ALYac Trojan.GenericKD.73779926
Cylance Unsafe
VIPRE Trojan.GenericKD.73779926
Sangfor Trojan.Win32.Znyonm.V39l
K7AntiVirus Trojan ( 005b84ae1 )
BitDefender Trojan.GenericKD.73779926
K7GW Trojan ( 005b84ae1 )
ESET-NOD32 a variant of Win32/Packed.NSIS.F suspicious
McAfee Artemis!A23837DEBDC8
Avast Win32:Malware-gen
Kaspersky HEUR:Trojan.Win32.Autoit.gen
Alibaba Trojan:Win32/Znyonm.cbc61094
MicroWorld-eScan Trojan.GenericKD.73779926
Emsisoft Trojan.GenericKD.73779926 (B)
F-Secure Trojan.TR/Dropper.Gen
DrWeb Trojan.Siggen29.12542
Zillya Trojan.AutoIT.Win32.189459
TrendMicro TROJ_GEN.R002C0DH624
McAfeeD ti!848260BA9662
FireEye Trojan.GenericKD.73779926
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
Webroot W32.Autoit
Google Detected
Avira TR/Dropper.Gen
MAX malware (ai score=82)
Antiy-AVL Trojan/Win32.Autoit
Kingsoft Win32.Trojan.Autoit.gen
Microsoft Trojan:Win32/Znyonm
ZoneAlarm HEUR:Trojan.Win32.Autoit.gen
GData Trojan.GenericKD.73779926
AhnLab-V3 Trojan/Win.Znyonm.C5657037
DeepInstinct MALICIOUS
VBA32 Backdoor.CobaltStrike
Ikarus Trojan.NSIS.Runner
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002C0DH624
Tencent Win32.Trojan.FalseSign.Iajl
huorong Trojan/Runner.az
MaxSecure Trojan.Malware.7176537.susgen
Fortinet Riskware/Application
AVG Win32:Malware-gen
Paloalto generic.ml
CrowdStrike win/malicious_confidence_60% (W)
alibabacloud Trojan:Win/Autoit.gyf