Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 11, 2024, 10:08 a.m.	Sept. 11, 2024, 10:12 a.m.

Size	1.0MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`5673f47783f3a8e794f6863f1a7c3c7d`
SHA256	`f5dbb1b4280665ed5d85392c1f7050e4c15764ab222ccc2fbb63b0dcd7846507`
CRC32	`FD585BCC`
ssdeep	`24576:i9RYhVXyWZpWlT6m2PgCHFvlVTcgPmK3yPmla77sBhnGP/+fNpBk/rVN:ivRWZpLmn6FNVFmKiea3sLnGF/BN`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

66e08d1814f75_BrickAaron.exe#1 "C:\Users\test22\AppData\Local\Temp\66e08d1814f75_BrickAaron.exe#1"
2072
- cmd.exe "C:\Windows\System32\cmd.exe" /c move Glucose Glucose.bat & Glucose.bat
  2156
  - findstr.exe findstr /I "wrsa opssvc"
    2288
  - tasklist.exe tasklist
    2252
  - tasklist.exe tasklist
    2404
  - findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
    2440
  - cmd.exe cmd /c md 787871
    2512
  - findstr.exe findstr /V "DescriptionRichardsInstrumentalFilm" Plate
    2556
  - cmd.exe cmd /c copy /b ..\Dried + ..\Ultram + ..\Ecological + ..\Weapons + ..\Naughty + ..\Method + ..\Districts A
    2600
  - Trade.pif Trade.pif A
    2644
  - choice.exe choice /d y /t 5
    2768

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 11, 2024, 10:08 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Sept. 11, 2024, 10:08 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 11, 2024, 10:08 a.m.			0	0

Command line console output was observed (50 out of 659 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: 1 file(s) moved. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: Set console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: R=L console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: poQFOther console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: Zoophilia Sonic Albuquerque Cv Athletes console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: 'poQFOther' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: OhOfficial console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: 'OhOfficial' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: WNvHotmail console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: Organisations Faced Festival Hl Flex Seo Foo Independent console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: 'WNvHotmail' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: xpePhotographs console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: Distinct Lat Ist Arabic Upload Bull Core Jpeg console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: 'xpePhotographs' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: YBleRichard console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: Boxing console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: 'YBleRichard' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: uRMBDoors console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: Clubs Drivers Contacts Ix console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: 'uRMBDoors' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: FIwEvident console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: Frank Flood Welding Irc Query Js console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: 'FIwEvident' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: kiDzChildhood console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: Reviews Contacts Powerful Legislation Improve Audience Crime console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: 'kiDzChildhood' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: Set console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: Compute=l console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: kfOMOt console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: Symposium Biographies U Shift Talk console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: 'kfOMOt' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: POHjZinc console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: Longitude Going Tucson Threads Durham console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: 'POHjZinc' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: vgBlanket console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: Cure Warriors Ld Calibration Decision Moves Repair Climbing console_handle: 0x00000007	1	1
WriteConsoleW Sept. 11, 2024, 10:08 a.m.	buffer: 'vgBlanket' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 11, 2024, 10:08 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\787871\Trade.pif

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /c move Glucose Glucose.bat & Glucose.bat

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\787871\Trade.pif

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\787871\Trade.pif

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 11, 2024, 10:08 a.m.	show_type: 0 filepath_r: cmd parameters: /c move Glucose Glucose.bat & Glucose.bat filepath: cmd	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 11, 2024, 10:08 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 11, 2024, 10:08 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	"C:\Windows\System32\cmd.exe" /c move Glucose Glucose.bat & Glucose.bat
cmdline	tasklist
cmdline	cmd /c move Glucose Glucose.bat & Glucose.bat

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2156 resumed a thread in remote process 2644
NtResumeThread Sept. 11, 2024, 10:08 a.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 2644	1	0	0

File has been identified by 21 AntiVirus engines on VirusTotal as malicious (21 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
Skyhigh	BehavesLike.Win32.Dropper.tc
Cylance	Unsafe
Elastic	malicious (high confidence)
APEX	Malicious
Avast	FileRepMalware
Kaspersky	UDS:Trojan-Spy.Win32.Stealer.gen
McAfeeD	ti!F5DBB1B42806
FireEye	Generic.mg.5673f47783f3a8e7
SentinelOne	Static AI - Suspicious PE
Antiy-AVL	Trojan/Win32.AdLoad.bh
Kingsoft	Win32.Troj.Agent.cks
Gridinsoft	Malware.Win32.RedLine.tr
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	UDS:Trojan-Spy.Win32.Stealer.gen
McAfee	Artemis!5673F47783F3
DeepInstinct	MALICIOUS
MaxSecure	Trojan.Malware.121218.susgen
AVG	FileRepMalware
Paloalto	generic.ml

66e08d1814f75_BrickAaron.exe#1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All