Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 27, 2024, 3:09 p.m.	Aug. 27, 2024, 3:18 p.m.

Size	1.4MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`a1c95767e2aae895bca002778203b26e`
SHA256	`8b2a33314505781855da6824132f4b392cda4eea4862932b1b887673f656338c`
CRC32	`D99FE926`
ssdeep	`24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8apZtCx7NAumZ2CvYZdqROwKmzOYxrnP:sTvC/MTQYxsWR7apZt6po0ZERlKqXN`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

csrss.exe "C:\Users\test22\AppData\Local\Temp\csrss.exe"
2552
- ddd.exe "C:\Users\test22\AppData\Local\Temp\csrss.exe"
  2692
  - ddd.exe "C:\Users\test22\AppData\Local\directory\ddd.exe"
    2764
    - ddd.exe "C:\Users\test22\AppData\Local\directory\ddd.exe"
      2840
      - ddd.exe "C:\Users\test22\AppData\Local\directory\ddd.exe"
        2920
        
        ddd.exe "C:\Users\test22\AppData\Local\directory\ddd.exe"
        3068
        
        ddd.exe "C:\Users\test22\AppData\Local\directory\ddd.exe"
        2100
        
        ddd.exe "C:\Users\test22\AppData\Local\directory\ddd.exe"
        2228
        
        ddd.exe "C:\Users\test22\AppData\Local\directory\ddd.exe"
        2680
        
        ddd.exe "C:\Users\test22\AppData\Local\directory\ddd.exe"
        1272
        
        ddd.exe "C:\Users\test22\AppData\Local\directory\ddd.exe"
        1812
        
        ddd.exe "C:\Users\test22\AppData\Local\directory\ddd.exe"
        2280
        
        ddd.exe "C:\Users\test22\AppData\Local\directory\ddd.exe"
        2808
        
        ddd.exe "C:\Users\test22\AppData\Local\directory\ddd.exe"
        2984

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (14 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 27, 2024, 3:09 p.m.			0	0
IsDebuggerPresent Aug. 27, 2024, 3:09 p.m.			0	0
IsDebuggerPresent Aug. 27, 2024, 3:09 p.m.			0	0
IsDebuggerPresent Aug. 27, 2024, 3:09 p.m.			0	0
IsDebuggerPresent Aug. 27, 2024, 3:09 p.m.			0	0
IsDebuggerPresent Aug. 27, 2024, 3:10 p.m.			0	0
IsDebuggerPresent Aug. 27, 2024, 3:10 p.m.			0	0
IsDebuggerPresent Aug. 27, 2024, 3:10 p.m.			0	0
IsDebuggerPresent Aug. 27, 2024, 3:10 p.m.			0	0
IsDebuggerPresent Aug. 27, 2024, 3:10 p.m.			0	0
IsDebuggerPresent Aug. 27, 2024, 3:10 p.m.			0	0
IsDebuggerPresent Aug. 27, 2024, 3:10 p.m.			0	0
IsDebuggerPresent Aug. 27, 2024, 3:11 p.m.			0	0
IsDebuggerPresent Aug. 27, 2024, 3:11 p.m.			0	0

Allocates read-write-execute memory (usually to unpack itself) (39 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory Aug. 27, 2024, 3:09 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:09 p.m.	process_identifier: 2552 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 27, 2024, 3:09 p.m.	process_identifier: 2692 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:09 p.m.	process_identifier: 2692 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:09 p.m.	process_identifier: 2692 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Aug. 27, 2024, 3:09 p.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736d2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:09 p.m.	process_identifier: 2764 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:09 p.m.	process_identifier: 2764 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Aug. 27, 2024, 3:09 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73872000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:09 p.m.	process_identifier: 2840 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00de0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:09 p.m.	process_identifier: 2840 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Aug. 27, 2024, 3:09 p.m.	process_identifier: 2920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73872000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 2920 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e10000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 2920 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 3068 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 3068 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73872000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 2100 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bf0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 2100 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73872000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 2228 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 2228 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73872000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 2680 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f70000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 2680 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 1272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73872000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 1272 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 1272 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 1812 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 1812 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00da0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 1812 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Aug. 27, 2024, 3:10 p.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:11 p.m.	process_identifier: 2280 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:11 p.m.	process_identifier: 2280 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Aug. 27, 2024, 3:11 p.m.	process_identifier: 2808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73872000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:11 p.m.	process_identifier: 2808 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00840000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 27, 2024, 3:11 p.m.	process_identifier: 2808 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Aug. 27, 2024, 3:11 p.m.	process_identifier: 2984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73442000 process_handle: 0xffffffff	1	0

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ddd.vbs
file	C:\Users\test22\AppData\Local\directory\ddd.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\directory\ddd.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\directory\ddd.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00091600', u'virtual_address': u'0x000d4000', u'entropy': 7.948300507962653, u'name': u'.rsrc', u'virtual_size': u'0x000915cc'}

entropy

7.94830050796

description

A section with a high entropy has been found

entropy

0.404100069493

description

Overall entropy of this PE file is high

Installs itself for autorun at Windows startup (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ddd.vbs

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win64.Injects.ts93
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
Skyhigh	BehavesLike.Win32.TrojanAitInject.tc
Cylance	Unsafe
Sangfor	Trojan.Win32.Injector.V2vx
K7GW	Trojan ( 005b9a7d1 )
VirIT	Trojan.Win32.AutoIt_Heur.A
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.Autoit.GGU
McAfee	Artemis!A1C95767E2AA
Avast	Win32:Malware-gen
Kaspersky	Backdoor.Win32.Remcos.ynm
Rising	Trojan.Injector!8.C4 (CLOUD)
F-Secure	Trojan.TR/AVI.Remcos.hidzj
TrendMicro	Backdoor.Win32.REMCOS.YXEHZZ
McAfeeD	Real Protect-LS!A1C95767E2AA
FireEye	Generic.mg.a1c95767e2aae895
Sophos	Mal/Generic-S
Webroot	W32.Malware.Gen
Google	Detected
Avira	TR/AVI.Remcos.hidzj
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	Backdoor.Win32.Remcos.ynm
GData	Win32.Backdoor.Remcos.USLQUS
Varist	W32/ABTrojan.RSCH-1070
DeepInstinct	MALICIOUS
VBA32	Trojan.Autoit.F
Malwarebytes	MachineLearning/Anomalous.100%
Ikarus	Trojan.Autoit
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Backdoor.Win32.REMCOS.YXEHZZ
Fortinet	AutoIt/Injector.ZS!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (W)

csrss.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All