Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 13, 2024, 2:05 p.m.	Nov. 13, 2024, 2:11 p.m.

Size	83.2KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, RAR self-extracting archive
MD5	`a736e23ae291f6d3a848fdb1aaa7348f`
SHA256	`d00d806f1df7195c4d6b5757d90c3e81fdbf8d4f2efcbc895ee752af0b09b28c`
CRC32	`6ECCC40C`
ssdeep	`1536:o8V6g/5b+Dae3E/j9pGtbFIViUDq51plh6HcUa3WloAuyQjn:o8V6E5e3YxGF6zDUj/Rj3Pjn`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

clr.exe "C:\Users\test22\AppData\Local\Temp\clr.exe"
1836
- cmd.exe cmd /c ""C:\Windows\clrinst.bat" "
  108
  - taskkill.exe taskkill /f /im miter.exe
    2140
  - instsrv.exe instsrv.exe alark C:\Windows\alark.exe
    2240
  - PING.EXE ping 127.0.0.1 -n 2
    2304
  - reg.exe Reg Add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "Description" /t REG_SZ /d "Alarm service for default browser." /f
    2368
  - reg.exe Reg Add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "DisplayName" /t REG_SZ /d "Alarm Key Service" /f
    2412
  - reg.exe Reg Add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "ObjectName" /t REG_SZ /d "LocalSystem" /f
    2456
  - reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "Start" /t REG_DWORD /d "2" /f
    2500
  - reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "Type" /t REG_DWORD /d "16" /f
    2544
  - reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "ErrorControl" /t REG_DWORD /d "1" /f
    2588
  - reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "ImagePath" /t REG_EXPAND_SZ /d "C:\Windows\alark.exe" /f
    2632
  - reg.exe Reg Add "HKLM\SYSTEM\CurrentControlSet\services\alark\Parameters" /v "Application" /t REG_SZ /d "cmd /c start C:\Windows\miter.exe -t3010 C:\Windows\sysclr.bat" /f
    2676
  - PING.EXE ping 127.0.0.1 -n 2
    2724
  - net.exe net start alark
    2788
    - net1.exe C:\Windows\system32\net1 start alark
      2832
  - PING.EXE ping 127.0.0.1 -n 4
    2972
  - timeout.exe timeout 4 /NOBREAK
    508
  - taskkill.exe taskkill /f /im alark.exe
    2416

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Nov. 13, 2024, 2:05 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Nov. 13, 2024, 2:05 p.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (50 out of 120 events)

Time & API	Arguments	Status	Return
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: taskkill console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: /f /im miter.exe console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: copy console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: /y miterINST.exe miter.exe console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: instsrv.exe console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: alark C:\Windows\alark.exe console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: ping console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: 127.0.0.1 -n 2 console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: Reg console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: Add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "Description" /t REG_SZ /d "Alarm service for default browser." /f console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: Reg console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: Add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "DisplayName" /t REG_SZ /d "Alarm Key Service" /f console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: Reg console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: Add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "ObjectName" /t REG_SZ /d "LocalSystem" /f console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "Start" /t REG_DWORD /d "2" /f console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "Type" /t REG_DWORD /d "16" /f console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "ErrorControl" /t REG_DWORD /d "1" /f console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "ImagePath" /t REG_EXPAND_SZ /d "C:\Windows\alark.exe" /f console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: Reg console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: Add "HKLM\SYSTEM\CurrentControlSet\services\alark\Parameters" /v "Application" /t REG_SZ /d "cmd /c start C:\Windows\miter.exe -t3010 C:\Windows\sysclr.bat" /f console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: ping console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: 127.0.0.1 -n 2 console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: net console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: start alark console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: ping console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: 127.0.0.1 -n 4 console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: timeout console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: 4 /NOBREAK console_handle: 0x00000007	1	1
WriteConsoleW Nov. 13, 2024, 2:05 p.m.	buffer: C:\Windows> console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 13, 2024, 2:05 p.m.		1	1	0

Creates executable files on the filesystem (6 events)

file	C:\Windows\miterINST.exe
file	C:\Windows\clrinst.bat
file	C:\Windows\alark.exe
file	C:\Windows\sysclr.bat
file	C:\Windows\instsrv.exe
file	C:\Windows\sysclr.exe

Creates a service (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceA Nov. 13, 2024, 2:05 p.m.	service_start_name: start_type: 2 password: display_name: alark filepath: C:\Windows\alark.exe service_name: alark filepath_r: C:\Windows\alark.exe desired_access: 983551 service_handle: 0x003db160 error_control: 1 service_type: 16 service_manager_handle: 0x003db200	1	4043104	0

Drops a binary and executes it (2 events)

file	C:\Windows\clrinst.bat
file	C:\Windows\instsrv.exe

Executes one or more WMI queries (2 events)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "alark.exe")
wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "miter.exe")

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0000b400', u'virtual_address': u'0x0001a000', u'entropy': 7.888577112876484, u'name': u'UPX1', u'virtual_size': u'0x0000c000'}

entropy

7.88857711288

description

A section with a high entropy has been found

entropy

0.909090909091

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Nov. 13, 2024, 2:05 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Nov. 13, 2024, 2:05 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW Nov. 13, 2024, 2:05 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 13, 2024, 2:05 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Nov. 13, 2024, 2:05 p.m.	status_code: 0x00000001 process_identifier: 2876 process_handle: 0x00000184		0	0
NtTerminateProcess Nov. 13, 2024, 2:05 p.m.	status_code: 0x00000001 process_identifier: 2876 process_handle: 0x00000184	1	0	0

The executable is compressed using UPX (2 events)

section	UPX0				description	Section name indicates UPX
section	UPX1				description	Section name indicates UPX

Uses Windows utilities for basic Windows functionality (13 events)

cmdline	ping 127.0.0.1 -n 4
cmdline	reg add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "ImagePath" /t REG_EXPAND_SZ /d "C:\Windows\alark.exe" /f
cmdline	taskkill /f /im miter.exe
cmdline	reg add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "ErrorControl" /t REG_DWORD /d "1" /f
cmdline	ping 127.0.0.1 -n 2
cmdline	Reg Add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "Description" /t REG_SZ /d "Alarm service for default browser." /f
cmdline	reg add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "Start" /t REG_DWORD /d "2" /f
cmdline	Reg Add "HKLM\SYSTEM\CurrentControlSet\services\alark\Parameters" /v "Application" /t REG_SZ /d "cmd /c start C:\Windows\miter.exe -t3010 C:\Windows\sysclr.bat" /f
cmdline	Reg Add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "DisplayName" /t REG_SZ /d "Alarm Key Service" /f
cmdline	reg add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "Type" /t REG_DWORD /d "16" /f
cmdline	taskkill /f /im alark.exe
cmdline	Reg Add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "ObjectName" /t REG_SZ /d "LocalSystem" /f
cmdline	net start alark

Installs itself for autorun at Windows startup (2 events)

service_name	alark				service_path	C:\Windows\alark.exe
reg_key	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\alark\ImagePath				reg_value	C:\Windows\alark.exe

Stops Windows services (1 event)

service

alark (regkey HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\alark\Start)

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 events)

Lionic	Trojan.Win32.Generic.lCIq
Cynet	Malicious (score: 99)
Skyhigh	Clearlogs
ALYac	Application.Clearlog.A
Cylance	Unsafe
VIPRE	Application.Bat.VJC
CrowdStrike	win/grayware_confidence_90% (W)
BitDefender	Application.Bat.VJC
K7GW	Riskware ( 0015e4f01 )
K7AntiVirus	Riskware ( 0015e4f01 )
Arcabit	Application.Bat.VJC [many]
Baidu	Win32.HackTool.Clearlog.b
VirIT	Trojan.Win32.Agent.AYQF
Symantec	Hacktool.Clearlogs
Elastic	malicious (moderate confidence)
ESET-NOD32	multiple detections
Avast	SFX:Dropper-L [Drp]
ClamAV	Win.Trojan.Genome-5527
Kaspersky	UDS:Trojan.Win32.Scar
NANO-Antivirus	Trojan.Win32.DownLoad3.cqqapi
MicroWorld-eScan	Application.Bat.VJC
Rising	Hack.Clearlog.k (CLASSIC)
Emsisoft	Application.Bat.VJC (B)
F-Secure	Trojan.TR/Spy.6144.213
DrWeb	VirusConstructor.ClearLogs
TrendMicro	TSPY_FAREIT.YYSRV
McAfeeD	ti!D00D806F1DF7
CTX	exe.trojan.clearlog
Sophos	Mal/Generic-S
Ikarus	HackTool.Win32.Clearlog
FireEye	Generic.mg.a736e23ae291f6d3
Jiangmin	HackTool.Clearlog.l
Google	Detected
Avira	TR/Dropper.Gen
Antiy-AVL	HackTool/Win32.KeyGen
Gridinsoft	Trojan.Win32.Gen.cc!s2
Xcitium	Malware@#2f8qa3jru3l1h
Microsoft	HackTool:Win32/Multiverze
ZoneAlarm	HackTool.Win32.Clearlog.c
GData	Gen:Variant.Razy.117592
Varist	W32/Trojan.RFBI-8246
AhnLab-V3	PUP/Win32.Agent.R348454
McAfee	Artemis!A736E23AE291
DeepInstinct	MALICIOUS
VBA32	BScope.Trojan.Ditertag
Malwarebytes	Malware.AI.1986806844
Panda	Trj/CI.A
Zoner	Probably Heur.ExeHeaderL
TrendMicro-HouseCall	TSPY_FAREIT.YYSRV
Tencent	Win32.Hacktool.Clearlog.Qimw

clr.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All