Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 30, 2024, 9:29 a.m.	Sept. 30, 2024, 9:43 a.m.

Size	1.4MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`755d92751331e3bce93a9d0ce25a8f6a`
SHA256	`a740e88f638d68db3f83af8493e1bbe18297b003397ef701a16c7007bb100c05`
CRC32	`69C5B822`
ssdeep	`24576:UUNxvqF6FGYJf6yjNQpNONZNlTX5PlGPgquLEIWxUc7N11QaSYx7GqtQCsmezUbu:UUNxvC6FGYJf6yjNQpNONZnTX5PlGPg/`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file

naver.exe "C:\Users\test22\AppData\Local\Temp\naver.exe"
2552

Name	Response	Post-Analysis Lookup
weather.yahooapis.com

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (35 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 30, 2024, 9:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:24 a.m.	computer_name: TEST22-PC	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 30, 2024, 9:22 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	text
section	data

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 30, 2024, 9:22 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (18 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW Sept. 30, 2024, 9:22 a.m.	total_number_of_free_bytes: 13320069120 free_bytes_available: 13320069120 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:22 a.m.	total_number_of_free_bytes: 13320069120 free_bytes_available: 13320069120 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:23 a.m.	total_number_of_free_bytes: 13319991296 free_bytes_available: 13319991296 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:23 a.m.	total_number_of_free_bytes: 13319991296 free_bytes_available: 13319991296 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:23 a.m.	total_number_of_free_bytes: 13319991296 free_bytes_available: 13319991296 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:23 a.m.	total_number_of_free_bytes: 13319991296 free_bytes_available: 13319991296 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:23 a.m.	total_number_of_free_bytes: 13320040448 free_bytes_available: 13320040448 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:23 a.m.	total_number_of_free_bytes: 13320040448 free_bytes_available: 13320040448 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:23 a.m.	total_number_of_free_bytes: 13320040448 free_bytes_available: 13320040448 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:23 a.m.	total_number_of_free_bytes: 13320040448 free_bytes_available: 13320040448 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:23 a.m.	total_number_of_free_bytes: 13319512064 free_bytes_available: 13319512064 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:23 a.m.	total_number_of_free_bytes: 13319512064 free_bytes_available: 13319512064 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:23 a.m.	total_number_of_free_bytes: 13319487488 free_bytes_available: 13319487488 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:23 a.m.	total_number_of_free_bytes: 13319487488 free_bytes_available: 13319487488 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:24 a.m.	total_number_of_free_bytes: 13319483392 free_bytes_available: 13319483392 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:24 a.m.	total_number_of_free_bytes: 13319483392 free_bytes_available: 13319483392 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:24 a.m.	total_number_of_free_bytes: 13319483392 free_bytes_available: 13319483392 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Sept. 30, 2024, 9:24 a.m.	total_number_of_free_bytes: 13319483392 free_bytes_available: 13319483392 root_path: C:\ total_number_of_bytes: 34252779520	1	1

Executes one or more WMI queries (1 event)

wmi	SELECT * FROM Win32_Process

File has been identified by 5 AntiVirus engines on VirusTotal as malicious (5 events)

VirIT	Trojan.Win64.Agent.GZO
Zillya	Trojan.Crysan.Win64.10
Jiangmin	Trojan.Diztakun.ewn
Google	Detected
Ikarus	Trojan.Win32.AHK

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 30, 2024, 9:22 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Installs an hook procedure to monitor for mouse events (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExW Sept. 30, 2024, 9:22 a.m.	thread_identifier: 0 callback_function: 0x0000000140006b60 hook_identifier: 14 (WH_MOUSE_LL) module_address: 0x0000000140000000	1	262585	0

naver.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All