Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 17, 2024, 10:13 p.m.	Aug. 17, 2024, 10:23 p.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`bbe6311c3e2fab459f729dc8cd6e3519`
SHA256	`95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874`
CRC32	`EB9B703D`
ssdeep	`24576:HzZyi0Kg1ySDKr8TP/4xDVMRy5MxcTCLA8dUtp+FPlDha1edx/M2:H0iTezbe9jp+FPlEoHR`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

MePaxil.exe "C:\Users\test22\AppData\Local\Temp\MePaxil.exe"
1880
- cmd.exe "C:\Windows\System32\cmd.exe" /k move Offensive Offensive.cmd & Offensive.cmd & exit
  2064
  - findstr.exe findstr /I "wrsa.exe opssvc.exe"
    2208
  - tasklist.exe tasklist
    2172
  - tasklist.exe tasklist
    2320
  - findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
    2356
  - cmd.exe cmd /c md 543648
    2428
  - findstr.exe findstr /V "BiddingVeRoutinesFilms" Bowling
    2472
  - cmd.exe cmd /c copy /b ..\Suzuki + ..\Major + ..\Tit + ..\Adjust + ..\Invest + ..\Severe + ..\Sony + ..\Prefers E
    2516
  - Legend.pif Legend.pif E
    2564
  - choice.exe choice /d y /t 15
    2652

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
104.16.184.241	Active	Moloch
104.21.44.66	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 17, 2024, 10:13 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Aug. 17, 2024, 10:13 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 17, 2024, 10:13 p.m.			0	0

Command line console output was observed (50 out of 864 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: 1 file(s) moved. console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: Set console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: Jessica=s console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: VzBless console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: Rail Reunion Yeah Surgeon Forums Fred Msn console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: 'VzBless' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: tyHAdmissions console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: Eating Ala Branches Bucks Runtime Dramatic console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: 'tyHAdmissions' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: YVCuUpdating console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: Write Perfume Cindy Monday console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: 'YVCuUpdating' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: vFwkTreatment console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: Debian Secrets Rankings Atmosphere Soon Nextel console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: 'vFwkTreatment' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: tPSupervision console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: Initially Coalition Xbox Carrying Bobby Awarded Cancel console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: 'tPSupervision' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: kSccTvs console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: Harassment Likewise Evans console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: 'kSccTvs' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: Set console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: Cw=S console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: rgpUMed console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: Radios Carriers Exclusion Heating Arm Plants Cf Businesses console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: 'rgpUMed' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: ZEExpect console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: Lucy These Higher Lit Asking console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: 'ZEExpect' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: zauvShowtimes console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: 'zauvShowtimes' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: HPPoBottles console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: Chevy Mattress Flashing Ye Johnson Sg Short Reed console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: 'HPPoBottles' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: hLUnable console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: Plan Timeline Nv console_handle: 0x00000007	1	1
WriteConsoleW Aug. 17, 2024, 10:13 p.m.	buffer: 'hLUnable' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 17, 2024, 10:13 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\543648\Legend.pif

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /k move Offensive Offensive.cmd & Offensive.cmd & exit

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\543648\Legend.pif

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\543648\Legend.pif

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 17, 2024, 10:13 p.m.	show_type: 0 filepath_r: cmd parameters: /k move Offensive Offensive.cmd & Offensive.cmd & exit filepath: cmd	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (40 events)

Time & API	Arguments	Status	Return
Process32FirstW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: [System Process] process_identifier: 0	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: System process_identifier: 4	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: smss.exe process_identifier: 232	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: csrss.exe process_identifier: 308	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: wininit.exe process_identifier: 344	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: csrss.exe process_identifier: 356	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: winlogon.exe process_identifier: 392	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: services.exe process_identifier: 436	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: lsass.exe process_identifier: 452	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: lsm.exe process_identifier: 460	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: svchost.exe process_identifier: 560	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: svchost.exe process_identifier: 636	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: svchost.exe process_identifier: 716	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: svchost.exe process_identifier: 780	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: svchost.exe process_identifier: 824	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: audiodg.exe process_identifier: 896	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: svchost.exe process_identifier: 984	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: svchost.exe process_identifier: 340	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: spoolsv.exe process_identifier: 1060	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: taskhost.exe process_identifier: 1112	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: svchost.exe process_identifier: 1120	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: dwm.exe process_identifier: 1192	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: explorer.exe process_identifier: 1236	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: svchost.exe process_identifier: 1744	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: pw.exe process_identifier: 1888	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: SearchIndexer.exe process_identifier: 1652	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: mobsync.exe process_identifier: 1664	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: pw.exe process_identifier: 1944	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: taskhost.exe process_identifier: 932	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: cmd.exe process_identifier: 652	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: SearchProtocolHost.exe process_identifier: 1212	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: conhost.exe process_identifier: 496	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: SearchFilterHost.exe process_identifier: 1504	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: MePaxil.exe process_identifier: 1880	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: pw.exe process_identifier: 880	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: cmd.exe process_identifier: 2064	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: conhost.exe process_identifier: 2100	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: WmiPrvSE.exe process_identifier: 2280	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: Legend.pif process_identifier: 2564	1	1
Process32NextW Aug. 17, 2024, 10:13 p.m.	snapshot_handle: 0x00000130 process_name: inject-x86.exe process_identifier: 2620	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 17, 2024, 10:13 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Aug. 17, 2024, 10:13 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

tasklist

Communicates with host for which no DNS query was performed (2 events)

host	104.16.184.241
host	104.21.44.66

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2064 resumed a thread in remote process 2564
NtResumeThread Aug. 17, 2024, 10:13 p.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 2564	1	0	0

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Autoit.4!c
Cynet	Malicious (score: 99)
Skyhigh	Artemis!Trojan
Sangfor	Trojan.Win32.Agent.Vfo2
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Generik.LPRPMJE
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Autoit.gen
BitDefender	Trojan.Generic.36719005
MicroWorld-eScan	Trojan.Generic.36719005
Emsisoft	Trojan.Generic.36719005 (B)
F-Secure	Trojan.TR/AutoIt.mzmdi
DrWeb	Trojan.Siggen29.22510
TrendMicro	Trojan.Win32.AMADEY.YXEHOZ
McAfeeD	ti!95FB9CA82017
FireEye	Trojan.Generic.36719005
Sophos	Mal/Generic-S
Webroot	W32.Trojan.Gen
Avira	TR/AutoIt.mzmdi
MAX	malware (ai score=84)
Kingsoft	Win32.Trojan.Autoit.gen
Gridinsoft	Malware.Win32.RedLine.tr
ZoneAlarm	HEUR:Trojan.Win32.Autoit.gen
GData	Win32.Trojan.Agent.SNHWGA
McAfee	Artemis!BBE6311C3E2F
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Agent.NSIS
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXEHOZ
Tencent	Win32.Trojan.FalseSign.Fkjl
huorong	Trojan/Injector.btr
Fortinet	NSIS/Runner.AM!tr
Panda	Trj/Chgt.AD
CrowdStrike	win/malicious_confidence_70% (W)
alibabacloud	Trojan:Win/Autoit.gyf

MePaxil.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All