Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 24, 2024, 6:51 p.m.	Sept. 24, 2024, 6:53 p.m.

Size	4.7MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`933612be98b1de1b5fb119a6b30e84db`
SHA256	`c94da0cc33cdaa8e70642330bfaa32ab0ec4b800f2b4cd30316dfff41ef45df2`
CRC32	`41A66955`
ssdeep	`49152:2HIMs0/tVdTQrAtbY++2h+sTRuT0U0pItLc8a2n7s+TTCP0VXbpX5Sl35mjAYRGo:2D/PxQh44P7hTbM`
PDB Path	D:\cpuid2\cpu_z\cpu_z_en_vc2008\x64\Release\cpuz_x64.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer ASPack_Zero - ASPack packed file IsPE64 - (no description) Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

cpuz.exe "C:\Users\test22\AppData\Local\Temp\cpuz.exe"
2564

Name	Response	Post-Analysis Lookup
download.cpuid.com	CNAME cpuz01.cpuid.com A 195.154.81.43	195.154.81.43

IP Address	Status	Action
164.124.101.2	Active	Moloch
195.154.81.43	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 195.154.81.43:443 -> 192.168.56.101:49164	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49162 -> 195.154.81.43:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49163 -> 195.154.81.43:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Queries for the computername (9 events)

Time & API	Arguments	Status	Return
GetComputerNameA Sept. 24, 2024, 6:51 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 24, 2024, 6:51 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2024, 6:51 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2024, 6:51 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2024, 6:51 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2024, 6:51 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2024, 6:51 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2024, 6:52 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2024, 6:52 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 24, 2024, 6:51 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

D:\cpuid2\cpu_z\cpu_z_en_vc2008\x64\Release\cpuz_x64.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 24, 2024, 6:51 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

text

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 24, 2024, 6:51 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 24, 2024, 6:52 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000054e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 24, 2024, 6:52 p.m.	process_identifier: 2564 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000055f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

cpuz.exe tried to sleep 620 seconds, actually delayed analysis time by 620 seconds

Creates a shortcut to an executable file (3 events)

file	C:\Users\test22\Links\Desktop.lnk
file	C:\Users\test22\Links\RecentPlaces.lnk
file	C:\Users\test22\Links\Downloads.lnk

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x001f8400', u'virtual_address': u'0x002c3000', u'entropy': 6.843878428251542, u'name': u'.rsrc', u'virtual_size': u'0x001f82d8'}

entropy

6.84387842825

description

A section with a high entropy has been found

entropy

0.421393502559

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Sept. 24, 2024, 6:51 p.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW Sept. 24, 2024, 6:51 p.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW Sept. 24, 2024, 6:51 p.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 24, 2024, 6:51 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Operates on local firewall's policies and settings (1 event)

registry

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile

Created a service where a service was also not started (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW Sept. 24, 2024, 6:51 p.m.	service_start_name: start_type: 3 password: display_name: cpuz159 filepath: C:\Windows\Temp\cpuz159\cpuz159_x64.sys service_name: cpuz159 filepath_r: C:\Windows\temp\cpuz159\cpuz159_x64.sys desired_access: 983551 service_handle: 0x0000000000259f50 error_control: 1 service_type: 1 service_manager_handle: 0x0000000000259ef0	1	2465616	0
CreateServiceW Sept. 24, 2024, 6:51 p.m.	service_start_name: start_type: 3 password: display_name: cpuz152 filepath: C:\Windows\Temp\cpuz152\cpuz152_x64.sys service_name: cpuz152 filepath_r: C:\Windows\temp\cpuz152\cpuz152_x64.sys desired_access: 983551 service_handle: 0x0000000000259ef0 error_control: 1 service_type: 1 service_manager_handle: 0x0000000000259ec0	1	2465520	0

Queries information on disks, possibly for anti-virtualization (2 events)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Sept. 24, 2024, 6:51 p.m.	create_disposition: 1 (FILE_OPEN) file_handle: 0x000000000000044c filepath: \??\PhysicalDrive0 desired_access: 0xc0100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 128 (FILE_ATTRIBUTE_NORMAL) filepath_r: \??\PhysicalDrive0 create_options: 96 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 1 (FILE_OPENED) share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	1	0	0
DeviceIoControl Sept. 24, 2024, 6:51 p.m.	input_buffer: @Ëg control_code: 2954240 () device_handle: 0x000000000000044c output_buffer: (§Lu~$ VBOX HARDDISK 1.0VBOX HARDDISK 1.0 42566234393262373030372d6533656331322036	1	1	0

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 24, 2024, 6:51 p.m.	information_class: 76 (SystemFirmwareTableInformation)		-1073741789	0

cpuz.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All