Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 16, 2024, 6:34 p.m.	Aug. 16, 2024, 6:36 p.m.

Size	743.0KB
Type	MS Windows HtmlHelp Data
MD5	`55c6005f361c9011182379ba8f7a875f`
SHA256	`8bbce87a664c8a89ab7b420be0a5f9cf0b0e17796069d88ff2703ad1f2053201`
CRC32	`D8A53F31`
ssdeep	`12288:dVdbrng91k2I8/hev+UHZ8oNPe55Z0OKZU4XhzldzVcIXnHO1SG/l2bgpQCs0JYo:Z3gLv/hiQ55Z0G4tloku0SkUQYJoCM6`
Yara	chm_file_format - chm file format

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "ntkaP" C:\Users\test22\AppData\Local\Temp\Mnemonic.chm
2544
- hh.exe "C:\Windows\hh.exe" C:\Users\test22\AppData\Local\Temp\Mnemonic.chm
  2632
  - hh.exe "C:\Windows\hh.exe" -decompile C:\ProgramData\chm C:\Users\test22\AppData\Local\Temp\Mnemonic.chm
    2908
  - cmd.exe "C:\Windows\System32\cmd.exe" /c start /MIN REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v cloud /t REG_SZ /d "%ProgramData%\chm\src\cloud.exe" /f
    2996
    - reg.exe REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v cloud /t REG_SZ /d "C:\ProgramData\chm\src\cloud.exe" /f
      3060

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Aug. 16, 2024, 6:34 p.m.	buffer: The operation completed successfully. console_handle: 0x0000000000000007	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 16, 2024, 6:34 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 16, 2024, 6:34 p.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1	0	0

Creates executable files on the filesystem (1 event)

file	C:\ProgramData\chm\src\cloud.exe

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /c start /MIN REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v cloud /t REG_SZ /d "%ProgramData%\chm\src\cloud.exe" /f

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 16, 2024, 6:34 p.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x000007fffff90000 process_handle: 0xffffffffffffffff	1	0	0

Yara rule detected in process memory (40 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	cmd /c start /MIN REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v cloud /t REG_SZ /d "%ProgramData%\chm\src\cloud.exe" /f
cmdline	"C:\Windows\System32\cmd.exe" /c start /MIN REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v cloud /t REG_SZ /d "%ProgramData%\chm\src\cloud.exe" /f
cmdline	REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v cloud /t REG_SZ /d "C:\ProgramData\chm\src\cloud.exe" /f

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\cloud

reg_value

C:\ProgramData\chm\src\cloud.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2544 resumed a thread in remote process 2632
Process injection	Process 2996 resumed a thread in remote process 3060
NtResumeThread Aug. 16, 2024, 6:34 p.m.	thread_handle: 0x00000284 suspend_count: 1 process_identifier: 2632	1	0	0
NtResumeThread Aug. 16, 2024, 6:34 p.m.	thread_handle: 0x0000000000000060 suspend_count: 0 process_identifier: 3060	1	0	0

File has been identified by 42 AntiVirus engines on VirusTotal as malicious (42 events)

Lionic	Trojan.HTML.Agentb.4!c
Skyhigh	GenericRXMU-CH!27A074CD4F79
ALYac	Trojan.Downloader.CHM
VIPRE	Gen:Variant.Jaik.46584
Sangfor	Trojan.Win32.Save.a
Arcabit	Exploit.CHM-Downloader.Gen [many]
Symantec	Trojan.Gen.NPE
ESET-NOD32	Win32/Ramsay.E
TrendMicro-HouseCall	Mal_ChmDr
McAfee	GenericRXMU-CH!27A074CD4F79
Avast	Other:Malware-gen [Trj]
Cynet	Malicious (score: 99)
Kaspersky	Trojan.Win32.Agentb.jxvi
BitDefender	Exploit.CHM-Downloader.Gen
NANO-Antivirus	Trojan.Win32.DarkHotel.hydexu
Rising	Trojan.MouseJack/HTML!1.BE26 (CLASSIC)
Emsisoft	Exploit.CHM-Downloader.Gen (B)
F-Secure	Heuristic.HEUR/AGEN.1320006
DrWeb	Trojan.Siggen13.46855
Zillya	Trojan.Agent.Win32.1302981
TrendMicro	Mal_ChmDr
FireEye	Exploit.CHM-Downloader.Gen
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Ramsay
Jiangmin	Trojan.Darkhotel.aj
Google	Detected
Avira	HEUR/AGEN.1320006
Kingsoft	malware.kb.a.992
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	HEUR:Trojan.Script.Generic
GData	Gen:Variant.Jaik.46584
Varist	W32/Ramsay.A.gen!Eldorado
AhnLab-V3	Malware/Win32.RL_Generic.R360245
BitDefenderTheta	Gen:NN.ZexaF.36792.8uZ@aaEJMCii
VBA32	BScope.Adware.Caypnamer
Tencent	Malware.Win32.Gencirc.10bd5f0c
Yandex	Trojan.Ramsay!7m2nz5+xRZc
MAX	malware (ai score=83)
MaxSecure	Trojan.W32.redirector.ad
Fortinet	HLP/Agent.G1!tr
AVG	Other:Malware-gen [Trj]
Panda	Trj/CI.A

Mnemonic.chm

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All