Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 23, 2024, 9:47 a.m.	Aug. 23, 2024, 9:53 a.m.

Size	1012.3KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`dadfa6f51c990b1b4f5520f3a8e2c824`
SHA256	`d43af0c0a5058412c903698b4ac55f150f6a20cac43344b5a596906780dac1f7`
CRC32	`1FD0C103`
ssdeep	`24576:QzZmhskEKg3ADrO2paC5fgNl+ydoqyZH/M9OI9m8toYxILUj1:QchHgm9paCyNl+51Hk93m8aYAE`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

SequencesPassage.exe "C:\Users\test22\AppData\Local\Temp\SequencesPassage.exe"
660
- cmd.exe "C:\Windows\System32\cmd.exe" /k move Publications Publications.cmd & Publications.cmd & exit
  2092
  - findstr.exe findstr /I "wrsa.exe opssvc.exe"
    2240
  - tasklist.exe tasklist
    2204
  - tasklist.exe tasklist
    2372
  - findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
    2420
  - cmd.exe cmd /c md 404587
    2508
  - findstr.exe findstr /V "FiledJanDefinesPpc" Preparing
    2552
  - cmd.exe cmd /c copy /b ..\Affecting + ..\Herb + ..\Shaw + ..\Madison + ..\Benz + ..\Registrar j
    2596
  - Km.pif Km.pif j
    2640
  - choice.exe choice /d y /t 5
    2724

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 23, 2024, 9:47 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Aug. 23, 2024, 9:47 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 23, 2024, 9:47 a.m.			0	0

Command line console output was observed (50 out of 2230 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: 1 file(s) moved. console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: Set console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: Becoming=0 console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: uMBkSalary console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: Acid Contacts Reaching console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: 'uMBkSalary' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: HjTwo console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: Disciplines console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: 'HjTwo' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: RFFjMaple console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: Dj Analyses Themes Reward console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: 'RFFjMaple' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: XOROViruses console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: 'XOROViruses' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: ZWRetrieval console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: 'ZWRetrieval' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: ackaStar console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: Circles Contained Be Beauty Remember Bibliography console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: 'ackaStar' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: nGMysimon console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: Intervention console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: 'nGMysimon' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: dGtHear console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: 'dGtHear' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: sFgeExcitement console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: Surge Avg Php Description Sociology Exports Compaq Lanes console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: 'sFgeExcitement' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: MDSword console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: Ap Reseller Knew Medal Extract console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: 'MDSword' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: Set console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: Valentine=I console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: CvdFoundations console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: Shadows Jews console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: 'CvdFoundations' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 23, 2024, 9:47 a.m.	buffer: jUiRisk console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 23, 2024, 9:47 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\404587\Km.pif

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /k move Publications Publications.cmd & Publications.cmd & exit

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\404587\Km.pif

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\404587\Km.pif

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 23, 2024, 9:47 a.m.	show_type: 0 filepath_r: cmd parameters: /k move Publications Publications.cmd & Publications.cmd & exit filepath: cmd	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 23, 2024, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Aug. 23, 2024, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

tasklist

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 events)

Bkav	W32.AIDetectMalware
Sangfor	Trojan.Win32.Agent.Vzbh
Symantec	Trojan.Gen.MBT
Paloalto	generic.ml
DrWeb	Trojan.PWS.StealC.4
McAfeeD	ti!D43AF0C0A505
Sophos	Mal/Generic-S
Webroot	W32.Malware.Gen
Gridinsoft	Malware.Win32.Stealc.tr
ZoneAlarm	HEUR:Trojan.Win32.Autoit.gen
TrendMicro-HouseCall	TrojanSpy.Win32.STEALC.YXEHVZ
huorong	Trojan/Runner.ba
Fortinet	NSIS/Runner.AV!tr
DeepInstinct	MALICIOUS
CrowdStrike	win/grayware_confidence_60% (D)

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2092 resumed a thread in remote process 2640
NtResumeThread Aug. 23, 2024, 9:47 a.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 2640	1	0	0

SequencesPassage.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All