popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Ghost_1.5.11.5.exe

Emotet Gen1 IAmTheKing Family PhysicalDrive Generic Malware UPX Downloader ASPack Antivirus Malicious Library Admin Tool (Sysinternals etc ...) PE File PE32 MSOffice File OS Processor Check dll DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 13, 2024, 1:57 p.m. Nov. 13, 2024, 2:17 p.m.
Size 15.8MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5192f8f21b79c8dc3990cc292f26b687
SHA256 bf0b5d066eff13faa1417861c9355eb7001e634013e6520d22639cb087098341
CRC32 A493A412
ssdeep 393216:Bk6YLfSunp9MeiwRonMyfAA0TW5n8eSbkH3yuQFrA9moDW46A:y6aflnp9MeiCongoGeSbkXAA9mo/
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: 'bcdedit' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0
Time & API Arguments Status Return Repeated

LdrLoadDll

 module_name: faultrep.dll
basename: faultrep
stack_pivoted: 0
flags: 0
module_address: 0x72de0000
1 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
omnifs32+0xeed0c @ 0x4eed0c
omnifs32+0x161c76 @ 0x561c76
omnifs32+0x163ae5 @ 0x563ae5
0x1e7d200

exception.instruction_r: ff 08 8b 46 04 83 38 00 75 1d 8b 0e 85 c9 74 06
exception.symbol: omnifs32+0x14ee60
exception.instruction: dec dword ptr [eax]
exception.module: omnifs32.EXE
exception.exception_code: 0xc0000005
exception.offset: 1371744
exception.address: 0x54ee60
registers.esp: 1635308
registers.edi: 0
registers.eax: 48
registers.ebp: 1635412
registers.edx: 0
registers.ebx: 31969444
registers.esi: 1635356
registers.ecx: 1635356
1 0 0

__exception__

 stacktrace: 
omnifs32+0x1d726 @ 0x41d726
omnifs32+0x7904d @ 0x47904d
omnifs32+0x15e4a5 @ 0x55e4a5
0x1fbd31c

exception.instruction_r: 66 3b 11 75 0d 40 40 41 41 ff 4c 24 0c 75 ee 33
exception.symbol: omnifs32+0xd3b6
exception.instruction: cmp dx, word ptr [ecx]
exception.module: omnifs32.EXE
exception.exception_code: 0xc0000005
exception.offset: 54198
exception.address: 0x40d3b6
registers.esp: 1635844
registers.edi: 0
registers.eax: 33276820
registers.ebp: 1635872
registers.edx: 92
registers.ebx: 18
registers.esi: 33276820
registers.ecx: 1745385215
1 0 0

__exception__

 stacktrace: 
omnifs32+0x1854 @ 0x401854
omnifs32+0x1232dd @ 0x5232dd
omnifs32+0x123413 @ 0x523413
omnifs32+0x123483 @ 0x523483
omnifs32+0x1237eb @ 0x5237eb

exception.instruction_r: 39 50 04 75 0f 8b 52 04 85 d2 89 50 04 74 54 89
exception.symbol: omnifs32+0x154a
exception.instruction: cmp dword ptr [eax + 4], edx
exception.module: omnifs32.EXE
exception.exception_code: 0xc0000005
exception.offset: 5450
exception.address: 0x40154a
registers.esp: 1627296
registers.edi: 33281000
registers.eax: 3898664671
registers.ebp: 1627300
registers.edx: 33281000
registers.ebx: 0
registers.esi: 33281976
registers.ecx: 4294967288
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x733c2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2708
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x733c2000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13276254208
free_bytes_available: 13276254208
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13276254208
free_bytes_available: 13276254208
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13276254208
free_bytes_available: 13276254208
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13276254208
free_bytes_available: 13276254208
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 75362304
free_bytes_available: 75362304
root_path: E:\
total_number_of_bytes: 104853504
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 75362304
free_bytes_available: 75362304
root_path: E:\
total_number_of_bytes: 104853504
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 75362304
free_bytes_available: 75362304
root_path: E:\
total_number_of_bytes: 104853504
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 75362304
free_bytes_available: 75362304
root_path: E:\
total_number_of_bytes: 104853504
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 75362304
free_bytes_available: 75362304
root_path: E:\
total_number_of_bytes: 104853504
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13276254208
free_bytes_available: 13276254208
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13276254208
free_bytes_available: 13276254208
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 75362304
free_bytes_available: 75362304
root_path: E:\
total_number_of_bytes: 104853504
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13276254208
free_bytes_available: 13276254208
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13276254208
free_bytes_available: 13276254208
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 75362304
free_bytes_available: 75362304
root_path: E:\
total_number_of_bytes: 104853504
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13276254208
free_bytes_available: 13276254208
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13276254208
free_bytes_available: 13276254208
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 4953860
sectors_per_cluster: 39796020
bytes_per_sector: 0
root_path: d:\
total_number_of_clusters: 4210987
0 0

GetDiskFreeSpaceW

 number_of_free_clusters: 3241272
sectors_per_cluster: 8
bytes_per_sector: 0
root_path: C:\
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 18399
sectors_per_cluster: 8
bytes_per_sector: 0
root_path: E:\
total_number_of_clusters: 25599
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 3241267
sectors_per_cluster: 8
bytes_per_sector: 0
root_path: C:\
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 18399
sectors_per_cluster: 8
bytes_per_sector: 0
root_path: E:\
total_number_of_clusters: 25599
1 1 0
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000c24ec size 0x0000017c
name RT_MANIFEST language LANG_CHINESE filetype XML 1.0 document, ASCII text, with CRLF line terminators sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000c2668 size 0x00000317
file C:\Windows\SysWOW64\SHOWDRIVE.EXE
file C:\Windows\SysWOW64\omnifs32.EXE
cmdline C:\Windows\system32\cmd.exe /c DSPTW.exe /a /pdr /y>dspt.txt
cmdline C:\Windows\system32\cmd.exe /c omnifs32.exe -nousb -noide info>omnifs.txt
cmdline C:\Windows\system32\cmd.exe /c DSPTW.exe 1 /find:all /ghoststyle /y>dspt1.txt
cmdline C:\Windows\system32\cmd.exe /c bcdedit>C:\Windows\efi.txt
cmdline PECMD.EXE show -1:-1
file C:\Windows\SysWOW64\omnifs32.EXE
file C:\Users\test22\AppData\Local\Temp\autF0BA.tmp
file C:\Users\test22\AppData\Local\Temp\aut398.tmp
file C:\Users\test22\AppData\Local\Temp\SandboxieInstall.exe
registry HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 1 (FILE_OPEN)
file_handle: 0x00000038
filepath: \??\PhysicalDrive0
desired_access: 0x80100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE)
file_attributes: 0 ()
filepath_r: \??\PhysicalDrive0
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 1 (FILE_OPENED)
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
1 0 0

NtCreateFile

 create_disposition: 1 (FILE_OPEN)
file_handle: 0x00000038
filepath: \??\PhysicalDrive0
desired_access: 0x80100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE)
file_attributes: 0 ()
filepath_r: \??\PhysicalDrive0
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 1 (FILE_OPENED)
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
1 0 0

NtCreateFile

 create_disposition: 1 (FILE_OPEN)
file_handle: 0x00000038
filepath: \??\PhysicalDrive0
desired_access: 0x80100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE)
file_attributes: 0 ()
filepath_r: \??\PhysicalDrive0
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 1 (FILE_OPENED)
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
1 0 0

NtCreateFile

 create_disposition: 1 (FILE_OPEN)
file_handle: 0x00000100
filepath: \??\PhysicalDrive0
desired_access: 0x80100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE)
file_attributes: 0 ()
filepath_r: \??\PhysicalDrive0
create_options: 104 (FILE_NON_DIRECTORY_FILE|FILE_NO_INTERMEDIATE_BUFFERING|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 1 (FILE_OPENED)
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
1 0 0

DeviceIoControl

 input_buffer:
control_code: 2954240 ()
device_handle: 0x00000100
output_buffer: (§
1 1 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.KillFiles.4!c
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.StartPageAutoIt.wc
Cylance Unsafe
CrowdStrike win/malicious_confidence_60% (D)
K7GW Trojan ( 005885721 )
K7AntiVirus Trojan ( 005885721 )
VirIT Trojan.Win32.Generic.AXDZ
ESET-NOD32 Win32/Packed.Autoit.AE suspicious
ClamAV Win.Dropper.DarkKomet-9986221-0
Alibaba Packed:Win32/Generic.e162eeba
DrWeb Trojan.KillFiles.22240
Zillya Trojan.Kryptik.Win32.830677
Trapmine malicious.high.ml.score
CTX exe.trojan.killfiles
Sophos Mal/Generic-S
FireEye Generic.mg.5192f8f21b79c8dc
Google Detected
Kingsoft Win32.Troj.Packed.AE
McAfee Artemis!5192F8F21B79
DeepInstinct MALICIOUS
VBA32 Trojan.KillFiles
Yandex Trojan.Igent.bYrcol.2
MaxSecure Trojan.Malware.11973.susgen
Paloalto generic.ml