popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

66bf3574eb3f2_FocusesAttempted.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 26, 2024, 10:48 a.m. Aug. 26, 2024, 10:51 a.m.
Size 1.5MB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 635508b01c2a8f9ceb1ab024c149b020
SHA256 baa3581920b2e641a504d5b7d2f1637d456244adbc66790de991b88650bcbd09
CRC32 1E7DA364
ssdeep 24576:kzZNMQ47A3TuY7IldB+yIh+DYVvSHugA2RcPB+bamgqvrgK4KMYb8cVDfkO80i8x:kgx7queqBFq0YVMDdKoLlp8uk5lWH/pl
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: 1 file(s) moved.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Diagnosis=c
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: KvQPmid
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Electro Xp Organisations Consumer Placement Empirical
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'KvQPmid' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: EGHAfraid
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Acne This Analytical Manage Resistance
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'EGHAfraid' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: snVVerzeichnis
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Two Trail
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'snVVerzeichnis' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: xldLUndefined
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Pictures Drums Offers Sku Promise Paso
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'xldLUndefined' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: XtIyOutreach
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Mall Surgeons Folk Attractions Separated Utilize Vehicles Japan
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'XtIyOutreach' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Crest=C
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: eKgUChange
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Download Tragedy Waste Receipt Folder Rebel Drums Courts
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'eKgUChange' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: yNzzConstitution
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Years Enable
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'yNzzConstitution' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: UwiRu
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Reaction Instructions Incoming Leo
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'UwiRu' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: OqaApproximate
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Unemployment Gentleman Communities Worldsex Time Compared Catholic
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'OqaApproximate' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SXComparison
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Between Spouse Listprice Separately Appears Gtk Toolbar
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'SXComparison' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TqCattle
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Dense Dom Touch Creek Phases Hydrogen
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
file C:\Users\test22\AppData\Local\Temp\277532\Forestry.pif
cmdline "C:\Windows\System32\cmd.exe" /k move Shaped Shaped.cmd & Shaped.cmd & exit
file C:\Users\test22\AppData\Local\Temp\277532\Forestry.pif
file C:\Users\test22\AppData\Local\Temp\277532\Forestry.pif
wmi SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /k move Shaped Shaped.cmd & Shaped.cmd & exit
filepath: cmd
1 1 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x0000012c
process_name: SearchFilterHost.exe
process_identifier: 1096
1 1 0

Process32NextW

 snapshot_handle: 0x0000012c
process_name: inject-x86.exe
process_identifier: 2680
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
cmdline tasklist
Bkav W32.AIDetectMalware
Skyhigh Artemis!Trojan
McAfee Artemis!635508B01C2A
Kaspersky HEUR:Backdoor.Win32.Agent.gen
DrWeb Trojan.Siggen29.29642
McAfeeD ti!BAA3581920B2
Kingsoft Win32.Troj.Unknown.a
Gridinsoft Trojan.Win32.Agent.oa!s1
Microsoft Trojan:Win32/Casdet!rfn
ZoneAlarm HEUR:Backdoor.Win32.Agent.gen
huorong Trojan/Runner.ba
Fortinet NSIS/Runner.AV!tr
CrowdStrike win/grayware_confidence_70% (W)
Process injection Process 2084 resumed a thread in remote process 2624
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000084
suspend_count: 0
process_identifier: 2624
1 0 0