Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 30, 2024, 9:32 a.m.	Sept. 30, 2024, 9:47 a.m.

Size	5.6MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`8ae20294b12f8eaa5551a24b0667a235`
SHA256	`708a473bbcd229fac5dcd38b59415fd39a8a2daf7884be0e3e5967edecbbecb1`
CRC32	`1F79C7A3`
ssdeep	`98304:1Q+wf8md+58pH2pCqJgpiJJ7lMqlbQzRRkFMuhFJqVVxr8BUkXgB82JqFXPdCO9P:1ZY87Ryi37LYYM4JqV3o7XgXJYCZ0`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format

1.exe "C:\Users\test22\AppData\Local\Temp\1.exe"
2624
- 1.tmp "C:\Users\test22\AppData\Local\Temp\is-J1P22.tmp\1.tmp" /SL5="$80178,4689659,161280,C:\Users\test22\AppData\Local\Temp\1.exe"
  2716
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 30, 2024, 9:32 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

Allocates read-write-execute memory (usually to unpack itself) (50 out of 102 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 106496 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 57344 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00425000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73282000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73282000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741b5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02470000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022c3000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741c0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02480000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022c3000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02490000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741bd000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02490000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022c3000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02930000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02930000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022c3000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02940000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02940000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022c3000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02950000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741bd000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02950000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022c3000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02960000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741ba000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02960000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022c3000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02970000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02970000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022c3000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02980000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02980000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:32 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225d000 process_handle: 0xffffffff	1

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-J1P22.tmp\1.tmp

File has been identified by 9 AntiVirus engines on VirusTotal as malicious (9 events)

Bkav	W32.AIDetectMalware
Sangfor	Trojan.Win32.Agent.V8u4
CrowdStrike	win/grayware_confidence_60% (D)
Webroot	W32.Riskware.Repack
Microsoft	HackTool:Win32/Crack!MTB
GData	Win32.Application.Agent.YSY5W7
DeepInstinct	MALICIOUS
Malwarebytes	RiskWare.Repack
Ikarus	PUA.Loderka

Queries for potentially installed applications (1 event)

Time & API	Arguments	Status	Return	Repeated
RegOpenKeyExW Sept. 30, 2024, 9:32 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{F44389E9-EA74-49D1-ADDC-BDBDFA837799}}_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000101 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F44389E9-EA74-49D1-ADDC-BDBDFA837799}}_is1		2	0

1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All