Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 27, 2024, 9:40 a.m.	Sept. 27, 2024, 9:43 a.m.

Size	4.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`4f3ddd6692d604ecf2bd37d93d0f2387`
SHA256	`1d50b6e42d9edb6d7ee41781f32972349ecc4ec2eaaef4692e994c858fb8551d`
CRC32	`86179882`
ssdeep	`98304:9BkNhx7tr/K0pB+km2inP8I0zJDd0TfuBUR8/Rg:9BkNVbiP8fDd0yBUy/q`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

66f5a3dbd9df9_ParentingContractor.exe#angry "C:\Users\test22\AppData\Local\Temp\66f5a3dbd9df9_ParentingContractor.exe#angry"
2556
- cmd.exe "C:\Windows\System32\cmd.exe" /c move Minolta Minolta.bat & Minolta.bat
  2684
  - tasklist.exe tasklist
    2756
  - findstr.exe findstr /I "wrsa opssvc"
    2792
  - tasklist.exe tasklist
    2904
  - findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
    2940
  - cmd.exe cmd /c md 159317
    3016
  - findstr.exe findstr /V "THOROUGHLYSURPLUSABILITYSOMEBODY" Vii
    3060
  - cmd.exe cmd /c copy /b ..\Plants + ..\Computers + ..\Lbs + ..\Analyze + ..\Examines + ..\Dc + ..\Doc + ..\Dam + ..\Senator + ..\Dump + ..\Reading + ..\Advantages + ..\Contributed + ..\Hamilton + ..\Detailed + ..\Baghdad + ..\Investigator + ..\Percent + ..\Opt + ..\Ext + ..\Premier + ..\Sony + ..\Profession + ..\Candidate + ..\Detected + ..\Los + ..\Innovative + ..\Temporary + ..\Constitutes + ..\Downloads + ..\Mysimon + ..\Publication + ..\Judges + ..\Kitchen + ..\Beverly + ..\Empty + ..\Freight + ..\Prime + ..\Glance + ..\Mai + ..\Gr w
    940
  - Fly.pif Fly.pif w
    1728
  - cmd.exe cmd /c copy /b ..\Breaks + ..\Brad + ..\Patricia + ..\Implied + ..\Payroll + ..\Coins + ..\Promotion p
    2188
  - Fly.pif Fly.pif p
    2260
  - choice.exe choice /d y /t 5
    2444

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 27, 2024, 9:40 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Sept. 27, 2024, 9:40 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 27, 2024, 9:40 a.m.			0	0
IsDebuggerPresent Sept. 27, 2024, 9:40 a.m.			0	0

Command line console output was observed (50 out of 1506 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: 1 file(s) moved. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: Set console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: Receiving=I console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: HJBible console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: Wells Pete Amplifier Walter Possession Percent console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: 'HJBible' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: RaZUUnexpected console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: Departure Avatar console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: 'RaZUUnexpected' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: mXlAdded console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: Volvo Animals Nr Below console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: 'mXlAdded' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: AIBiz console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: Crime Egg Disciplinary Dimensional console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: 'AIBiz' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: CmTCompetitors console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: Frequency Framing Suits Clinical Stretch Hosting console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: 'CmTCompetitors' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: gArProcesses console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: Jesse Cases Bathroom Adipex Oils Horizon console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: 'gArProcesses' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: nitaSaid console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: Neither Wound console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: 'nitaSaid' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: SAuFAl console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: Competent console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: 'SAuFAl' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: yTNOffer console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: Cut Characterized Hang Houses Living console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: 'yTNOffer' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: Set console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: Ultram=o console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: cgJoke console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: Beans Agenda Sm Relating Horrible Senior Expertise Failures console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: 'cgJoke' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: NqKZBadge console_handle: 0x00000007	1	1
WriteConsoleW Sept. 27, 2024, 9:40 a.m.	buffer: Sensor console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 27, 2024, 9:40 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 27, 2024, 9:40 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 9:40 a.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 9:40 a.m.	process_identifier: 2260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d2000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\159317\Fly.pif

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /c move Minolta Minolta.bat & Minolta.bat

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\159317\Fly.pif

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\159317\Fly.pif

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 27, 2024, 9:40 a.m.	show_type: 0 filepath_r: cmd parameters: /c move Minolta Minolta.bat & Minolta.bat filepath: cmd	1	1	0

File has been identified by 7 AntiVirus engines on VirusTotal as malicious (7 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
McAfeeD	ti!1D50B6E42D9E
Antiy-AVL	Trojan/Win32.Leonem
Kingsoft	malware.kb.a.701
Microsoft	Program:Win32/Wacapew.C!ml
huorong	HEUR:Trojan/Runner.b

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 27, 2024, 9:40 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 27, 2024, 9:40 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (50 out of 66 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Hijack network configuration	rule	Hijack_Network
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win
description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Hijack network configuration	rule	Hijack_Network
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	tasklist
cmdline	cmd /c move Minolta Minolta.bat & Minolta.bat
cmdline	"C:\Windows\System32\cmd.exe" /c move Minolta Minolta.bat & Minolta.bat

Checks presence of mIRC Chat Client (1 event)

file	C:\mIRC\mirc.ini

Drops 51 unknown file mime types indicative of ransomware writing encrypted files back to disk (50 out of 51 events)

file	C:\Users\test22\AppData\Local\Temp\Dump
file	C:\Users\test22\AppData\Local\Temp\Plants
file	C:\Users\test22\AppData\Local\Temp\Publication
file	C:\Users\test22\AppData\Local\Temp\Glance
file	C:\Users\test22\AppData\Local\Temp\Sony
file	C:\Users\test22\AppData\Local\Temp\Dc
file	C:\Users\test22\AppData\Local\Temp\Profession
file	C:\Users\test22\AppData\Local\Temp\159317\w
file	C:\Users\test22\AppData\Local\Temp\Mai
file	C:\Users\test22\AppData\Local\Temp\Empty
file	C:\Users\test22\AppData\Local\Temp\Gr
file	C:\Users\test22\AppData\Local\Temp\Breaks
file	C:\Users\test22\AppData\Local\Temp\Investigator
file	C:\Users\test22\AppData\Local\Temp\Constitutes
file	C:\Users\test22\AppData\Local\Temp\Reading
file	C:\Users\test22\AppData\Local\Temp\Dam
file	C:\Users\test22\AppData\Local\Temp\159317\p
file	C:\Users\test22\AppData\Local\Temp\Doc
file	C:\Users\test22\AppData\Local\Temp\Temporary
file	C:\Users\test22\AppData\Local\Temp\Analyze
file	C:\Users\test22\AppData\Local\Temp\Senator
file	C:\Users\test22\AppData\Local\Temp\Opt
file	C:\Users\test22\AppData\Local\Temp\Payroll
file	C:\Users\test22\AppData\Local\Temp\Hamilton
file	C:\Users\test22\AppData\Local\Temp\Implied
file	C:\Users\test22\AppData\Local\Temp\Advantages
file	C:\Users\test22\AppData\Local\Temp\Patricia
file	C:\Users\test22\AppData\Local\Temp\Computers
file	C:\Users\test22\AppData\Local\Temp\Freight
file	C:\Users\test22\AppData\Local\Temp\Beverly
file	C:\Users\test22\AppData\Local\Temp\Detected
file	C:\Users\test22\AppData\Local\Temp\Lbs
file	C:\Users\test22\AppData\Local\Temp\Mysimon
file	C:\Users\test22\AppData\Local\Temp\Vii
file	C:\Users\test22\AppData\Local\Temp\Promotion
file	C:\Users\test22\AppData\Local\Temp\Judges
file	C:\Users\test22\AppData\Local\Temp\Candidate
file	C:\Users\test22\AppData\Local\Temp\Ext
file	C:\Users\test22\AppData\Local\Temp\Downloads
file	C:\Users\test22\AppData\Local\Temp\Detailed
file	C:\Users\test22\AppData\Local\Temp\Examines
file	C:\Users\test22\AppData\Local\Temp\Los
file	C:\Users\test22\AppData\Local\Temp\Lighting
file	C:\Users\test22\AppData\Local\Temp\Percent
file	C:\Users\test22\AppData\Local\Temp\Baghdad
file	C:\Users\test22\AppData\Local\Temp\Coins
file	C:\Users\test22\AppData\Local\Temp\Kitchen
file	C:\Users\test22\AppData\Local\Temp\Brad
file	C:\Users\test22\AppData\Local\Temp\Innovative
file	C:\Users\test22\AppData\Local\Temp\Premier

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2684 resumed a thread in remote process 1728
Process injection	Process 2684 resumed a thread in remote process 2260
NtResumeThread Sept. 27, 2024, 9:40 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 1728	1	0	0
NtResumeThread Sept. 27, 2024, 9:40 a.m.	thread_handle: 0x00000098 suspend_count: 0 process_identifier: 2260	1	0	0

66f5a3dbd9df9_ParentingContractor.exe#angry

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All