Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 26, 2024, 12:05 p.m.	Sept. 26, 2024, 12:10 p.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`0f57f5b88b9a03374586de8eb21201b8`
SHA256	`1b8d094c512cb958ef2c25e970b99ec1e278cc785e1b3787d210d7eb2901c3cd`
CRC32	`DC070322`
ssdeep	`24576:c9hcsx62Jut39gKHA0urTqKxeOFUwvN+BrVMXtWHwaC1Gsr8z:cLcs02JuZ36qKxeSUwvNWVMXtWQa+GRz`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

ArchitectureTvs.exe "C:\Users\test22\AppData\Local\Temp\ArchitectureTvs.exe"
2552
- cmd.exe "C:\Windows\System32\cmd.exe" /c move Front Front.bat & Front.bat
  2656
  - tasklist.exe tasklist
    2752
  - findstr.exe findstr /I "wrsa opssvc"
    2788
  - tasklist.exe tasklist
    2900
  - findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
    2936
  - cmd.exe cmd /c md 390438
    3008
  - findstr.exe findstr /V "furthermorechartssheweddings" Glen
    3052
  - cmd.exe cmd /c copy /b ..\Assistance + ..\Task + ..\Copies + ..\Ge + ..\Sv + ..\Purchased B
    2056
  - Germany.pif Germany.pif B
    1404
  - choice.exe choice /d y /t 5
    2200

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 26, 2024, 12:05 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Sept. 26, 2024, 12:05 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 26, 2024, 12:05 p.m.			0	0

Command line console output was observed (50 out of 2399 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: 1 file(s) moved. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: Set console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: Faith=s console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: RzUfRoses console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: Exhibitions Juice Valve Staff Membership console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: 'RzUfRoses' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: HvYOrganizations console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: Columnists Empty Pl Shipments console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: 'HvYOrganizations' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: uVTools console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: Alpha Cut Look console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: 'uVTools' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: jlwMagnet console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: Lens Saint Joint Shoppercom Controllers Qt Harvard Holidays console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: 'jlwMagnet' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: FEOProtocol console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: Temple Fuzzy Rhythm console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: 'FEOProtocol' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: WpKjViolence console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: Rapidly Related Biol Vintage Follow Nov Fish Initiated console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: 'WpKjViolence' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: UnLiBigger console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: Viagra Gulf Promotion console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: 'UnLiBigger' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: dNuFPara console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: Creates Ja Institute Believes console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: 'dNuFPara' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: Set console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: Sara=v console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: oZxCompiler console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: Reliance Tyler Layout Sys Continue Vote Obtained console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: 'oZxCompiler' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: dBogCarrier console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: Mysql Compiled Admissions Cylinder Applying Our Photographic Comfortable console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: 'dBogCarrier' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: OFjReplaced console_handle: 0x00000007	1	1
WriteConsoleW Sept. 26, 2024, 12:05 p.m.	buffer: Intl Most Madonna console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 26, 2024, 12:05 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 26, 2024, 12:05 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73342000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Sept. 26, 2024, 12:05 p.m.	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73342000 process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\390438\Germany.pif

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /c move Front Front.bat & Front.bat

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\390438\Germany.pif

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\390438\Germany.pif

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 26, 2024, 12:05 p.m.	show_type: 0 filepath_r: cmd parameters: /c move Front Front.bat & Front.bat filepath: cmd	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 26, 2024, 12:05 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 26, 2024, 12:05 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	tasklist
cmdline	cmd /c move Front Front.bat & Front.bat
cmdline	"C:\Windows\System32\cmd.exe" /c move Front Front.bat & Front.bat

Checks presence of mIRC Chat Client (1 event)

file	C:\mIRC\mirc.ini

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2656 resumed a thread in remote process 1404
NtResumeThread Sept. 26, 2024, 12:05 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 1404	1	0	0

File has been identified by 43 AntiVirus engines on VirusTotal as malicious (43 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Autoruns.4!c
tehtris	Generic.Malware
Cynet	Malicious (score: 99)
ALYac	Trojan.Autoruns.GenericKD.101
Cylance	Unsafe
VIPRE	Trojan.Autoruns.GenericKD.101
Sangfor	PUP.Win32.Agent.Vden
CrowdStrike	win/grayware_confidence_60% (D)
BitDefender	Trojan.Autoruns.GenericKD.101
K7GW	Trojan ( 005bad8e1 )
K7AntiVirus	Trojan ( 005bad8e1 )
Arcabit	Trojan.Autoruns.Generic.101
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	NSIS/Runner.BP
APEX	Malicious
Avast	Win32:Malware-gen
Alibaba	Trojan:Win32/Runner.34bd1ba1
MicroWorld-eScan	Trojan.Autoruns.GenericKD.101
Emsisoft	Trojan.Autoruns.GenericKD.101 (B)
F-Secure	Trojan.TR/AutoIt.edqcp
McAfeeD	ti!1B8D094C512C
CTX	exe.trojan.runner
Sophos	Generic Reputation PUA (PUA)
FireEye	Generic.mg.0f57f5b88b9a0337
Google	Detected
Avira	TR/AutoIt.edqcp
Antiy-AVL	Trojan/Win32.AdLoad.bh
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Ransom.Win32.Bladabindi.cl
Microsoft	Trojan:Win32/Stealer!MTB
GData	Trojan.Autoruns.GenericKD.101
McAfee	Artemis!0F57F5B88B9A
DeepInstinct	MALICIOUS
Ikarus	Trojan.NSIS.Runner
Tencent	Win32.Trojan.Autoit.Wmhl
huorong	HEUR:Trojan/Runner.b
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Runner.BP!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml
alibabacloud	Trojan:Win/Caypnamer.A9nj

ArchitectureTvs.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All