Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 14, 2024, 10:35 a.m.	Oct. 14, 2024, 10:39 a.m.

Size	3.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`c2e8062052bb2b25d4951b78ba9a5e73`
SHA256	`49a48e879f7480238d2fe17520ac19afe83685aac0b886719f9e1eac818b75cc`
CRC32	`7F36187D`
ssdeep	`98304:m7EROaI2yEbVidvdahm6QAxuE4iLqmzLdtte96g:m4FyMVq4og4iLqmNqMg`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

AutoHotkey_1.1.37.02_setup.exe "C:\Users\test22\AppData\Local\Temp\AutoHotkey_1.1.37.02_setup.exe"
1460
- setup.exe C:\Users\test22\AppData\Local\Temp\7z8C39F5B4\setup.exe
  940

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 14, 2024, 10:35 a.m.		1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (50 out of 58 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b10000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b10000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b10000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b10000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b10000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b10000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b10000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b10000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b13000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b14000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b14000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b14000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b14000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b14000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b14000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b14000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b14000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b14000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b14000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b14000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b14000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b15000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b15000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b15000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (5 events)

file	C:\Users\test22\AppData\Local\Temp\7z8C39F5B4\setup.exe
file	C:\Users\test22\AppData\Local\Temp\7z8C39F5B4\AutoHotkeyA32.exe
file	C:\Users\test22\AppData\Local\Temp\7z8C39F5B4\AutoHotkeyU32.exe
file	C:\Users\test22\AppData\Local\Temp\7z8C39F5B4\Compiler\Ahk2Exe.exe
file	C:\Users\test22\AppData\Local\Temp\7z8C39F5B4\AutoHotkeyU64.exe

Drops an executable to the user AppData folder (6 events)

file	C:\Users\test22\AppData\Local\Temp\7z8C39F5B4\setup.exe
file	C:\Users\test22\AppData\Local\Temp\7z8C39F5B4\Compiler\Ahk2Exe.exe
file	C:\Users\test22\AppData\Local\Temp\7z8C39F5B4\AutoHotkeyA32.exe
file	C:\Users\test22\AppData\Local\Temp\7z8C39F5B4\Compiler\ANSI 32-bit.bin
file	C:\Users\test22\AppData\Local\Temp\7z8C39F5B4\AutoHotkeyU32.exe
file	C:\Users\test22\AppData\Local\Temp\7z8C39F5B4\Compiler\Unicode 32-bit.bin

File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 events)

Cylance	Unsafe
VirIT	Trojan.Win64.Agent.GZO
APEX	Malicious
NANO-Antivirus	Trojan.Win32.BuckBit.kpuuxe
SentinelOne	Static AI - Suspicious SFX
Jiangmin	Trojan.PSW.Disco.gvv
Antiy-AVL	Trojan/Win32.Agent
MaxSecure	Trojan.Malware.250241699.susgen

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 14, 2024, 10:35 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 16 (PAGE_EXECUTE) base_address: 0x05b10000 process_handle: 0xffffffff	1	0	0

AutoHotkey_1.1.37.02_setup.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All