popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Public Official Property Declaration Form.rar

KeyLogger PWS Escalate priviledges AntiDebug AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 21, 2024, 3:18 p.m. Aug. 21, 2024, 3:21 p.m.
Size 704.6KB
Type RAR archive data, v5
MD5 dfc1a7f27ae2cfbcfe0cea9c1305ce80
SHA256 b2d2380ec8001acfacbba10305c5dd4fe8bd153bfb00377bb6c6a0f94b29e804
CRC32 6DC2031A
ssdeep 12288:8UoBcxf00X8eCnM2VexaFy6tF+Oaj/mYTw9C5m335NTPZu1GLoTI6weqft+K:Gcxf00X8eCnM2VekFgKO5WDhToTI6mh
Yara None matched

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
117.18.232.200 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74062000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x737d3000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\7zE098B65B6\財產申報表.lnk
file C:\Users\test22\AppData\Local\Temp\7zE09881FD6\財產申報表.lnk
file C:\.lnk
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeRestorePrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0
description Escalate priviledges rule Escalate_priviledges
description PWS Memory rule Generic_PWS_Memory_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Run a KeyLogger rule KeyLogger
host 117.18.232.200
dead_host 192.168.56.102:49169