Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 18, 2024, 9:28 a.m.	Nov. 18, 2024, 9:30 a.m.

Size	5.9MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`cbb34d95217826f4ad877e7e7a46b69c`
SHA256	`707b321c42fbaa91cf41a9b41c85f3b56c7326cb32f40fc495f17df83b21cbed`
CRC32	`58D6E07B`
ssdeep	`98304:PX4wRX+gNnYLzYhrMfgiBB3owncvnuOK+VWUhFh6J3GB4VVPYhpYEFyazx1G0:vnRX+gNnYvgHycaYwTVVPQyaB`
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format OS_Processor_Check_Zero - OS Processor Check

stories.exe "C:\Users\test22\AppData\Local\Temp\stories.exe"
2592
- stories.tmp "C:\Users\test22\AppData\Local\Temp\is-3BSJG.tmp\stories.tmp" /SL5="$7012C,5532893,721408,C:\Users\test22\AppData\Local\Temp\stories.exe"
  2668
  - net.exe "C:\Windows\system32\net.exe" pause shine-encoder_11152
    2776
    - net1.exe C:\Windows\system32\net1 pause shine-encoder_11152
      2892
  - shineencoder32.exe "C:\Users\test22\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe" -i
    2820
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Nov. 18, 2024, 9:28 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 18, 2024, 9:28 a.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Nov. 18, 2024, 9:28 a.m.	buffer: The service name is invalid. console_handle: 0x0000000b	1	1	0
WriteConsoleW Nov. 18, 2024, 9:28 a.m.	buffer: More help is available by typing NET HELPMSG 2185. console_handle: 0x0000000b	1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.itext
section	.didata

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ Nov. 18, 2024, 9:28 a.m.	stacktrace: TMethodImplementationIntercept+0x12d57e dbkFCallWrapperAddr-0x88da2 stories+0x1ce89a @ 0x5ce89a TMethodImplementationIntercept+0x12f899 dbkFCallWrapperAddr-0x86a87 stories+0x1d0bb5 @ 0x5d0bb5 TMethodImplementationIntercept+0x136147 dbkFCallWrapperAddr-0x801d9 stories+0x1d7463 @ 0x5d7463 TMethodImplementationIntercept+0x128253 dbkFCallWrapperAddr-0x8e0cd stories+0x1c956f @ 0x5c956f TMethodImplementationIntercept+0x126fc5 dbkFCallWrapperAddr-0x8f35b stories+0x1c82e1 @ 0x5c82e1 TMethodImplementationIntercept+0x18b377 dbkFCallWrapperAddr-0x2afa9 stories+0x22c693 @ 0x62c693 TMethodImplementationIntercept+0x18b4f6 dbkFCallWrapperAddr-0x2ae2a stories+0x22c812 @ 0x62c812 TMethodImplementationIntercept+0x19915a dbkFCallWrapperAddr-0x1d1c6 stories+0x23a476 @ 0x63a476 TMethodImplementationIntercept+0x1ac283 dbkFCallWrapperAddr-0xa09d stories+0x24d59f @ 0x64d59f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 06 c7 45 fc fe ff ff ff 85 db 0f 85 97 34 00 exception.symbol: WNetCloseEnum+0x14 WNetOpenEnumW-0x11c mpr+0x2dea exception.instruction: mov eax, dword ptr [esi] exception.module: mpr.dll exception.exception_code: 0xc0000005 exception.offset: 11754 exception.address: 0x73952dea registers.esp: 1636820 registers.edi: 34038784 registers.eax: 1636848 registers.ebp: 1636864 registers.edx: 44 registers.ebx: 0 registers.esi: 44 registers.ecx: 0	1	0	0
__exception__ Nov. 18, 2024, 9:28 a.m.	stacktrace: TMethodImplementationIntercept+0x127d73 dbkFCallWrapperAddr-0x8e5ad stories+0x1c908f @ 0x5c908f TMethodImplementationIntercept+0x126fc5 dbkFCallWrapperAddr-0x8f35b stories+0x1c82e1 @ 0x5c82e1 TMethodImplementationIntercept+0x18b377 dbkFCallWrapperAddr-0x2afa9 stories+0x22c693 @ 0x62c693 TMethodImplementationIntercept+0x18b4f6 dbkFCallWrapperAddr-0x2ae2a stories+0x22c812 @ 0x62c812 TMethodImplementationIntercept+0x19915a dbkFCallWrapperAddr-0x1d1c6 stories+0x23a476 @ 0x63a476 TMethodImplementationIntercept+0x1ac283 dbkFCallWrapperAddr-0xa09d stories+0x24d59f @ 0x64d59f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: f7 f1 89 06 e9 0f 0a 00 00 ff 77 04 ff 37 8b 06 exception.symbol: TMethodImplementationIntercept+0x124517 dbkFCallWrapperAddr-0x91e09 stories+0x1c5833 exception.instruction: div ecx exception.module: stories.tmp exception.exception_code: 0xc0000094 exception.offset: 1857587 exception.address: 0x5c5833 registers.esp: 1636664 registers.edi: 58982796 registers.eax: 2281895 registers.ebp: 1637564 registers.edx: 0 registers.ebx: 34114817 registers.esi: 58982788 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Nov. 18, 2024, 9:28 a.m.

stacktrace:

TMethodImplementationIntercept+0x12d57e dbkFCallWrapperAddr-0x88da2 stories+0x1ce89a @ 0x5ce89a
TMethodImplementationIntercept+0x12f899 dbkFCallWrapperAddr-0x86a87 stories+0x1d0bb5 @ 0x5d0bb5
TMethodImplementationIntercept+0x136147 dbkFCallWrapperAddr-0x801d9 stories+0x1d7463 @ 0x5d7463
TMethodImplementationIntercept+0x128253 dbkFCallWrapperAddr-0x8e0cd stories+0x1c956f @ 0x5c956f
TMethodImplementationIntercept+0x126fc5 dbkFCallWrapperAddr-0x8f35b stories+0x1c82e1 @ 0x5c82e1
TMethodImplementationIntercept+0x18b377 dbkFCallWrapperAddr-0x2afa9 stories+0x22c693 @ 0x62c693
TMethodImplementationIntercept+0x18b4f6 dbkFCallWrapperAddr-0x2ae2a stories+0x22c812 @ 0x62c812
TMethodImplementationIntercept+0x19915a dbkFCallWrapperAddr-0x1d1c6 stories+0x23a476 @ 0x63a476
TMethodImplementationIntercept+0x1ac283 dbkFCallWrapperAddr-0xa09d stories+0x24d59f @ 0x64d59f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: 8b 06 c7 45 fc fe ff ff ff 85 db 0f 85 97 34 00
exception.symbol: WNetCloseEnum+0x14 WNetOpenEnumW-0x11c mpr+0x2dea
exception.instruction: mov eax, dword ptr [esi]
exception.module: mpr.dll
exception.exception_code: 0xc0000005
exception.offset: 11754
exception.address: 0x73952dea
registers.esp: 1636820
registers.edi: 34038784
registers.eax: 1636848
registers.ebp: 1636864
registers.edx: 44
registers.ebx: 0
registers.esi: 44
registers.ecx: 0

__exception__

Nov. 18, 2024, 9:28 a.m.

stacktrace:

TMethodImplementationIntercept+0x127d73 dbkFCallWrapperAddr-0x8e5ad stories+0x1c908f @ 0x5c908f
TMethodImplementationIntercept+0x126fc5 dbkFCallWrapperAddr-0x8f35b stories+0x1c82e1 @ 0x5c82e1
TMethodImplementationIntercept+0x18b377 dbkFCallWrapperAddr-0x2afa9 stories+0x22c693 @ 0x62c693
TMethodImplementationIntercept+0x18b4f6 dbkFCallWrapperAddr-0x2ae2a stories+0x22c812 @ 0x62c812
TMethodImplementationIntercept+0x19915a dbkFCallWrapperAddr-0x1d1c6 stories+0x23a476 @ 0x63a476
TMethodImplementationIntercept+0x1ac283 dbkFCallWrapperAddr-0xa09d stories+0x24d59f @ 0x64d59f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: f7 f1 89 06 e9 0f 0a 00 00 ff 77 04 ff 37 8b 06
exception.symbol: TMethodImplementationIntercept+0x124517 dbkFCallWrapperAddr-0x91e09 stories+0x1c5833
exception.instruction: div ecx
exception.module: stories.tmp
exception.exception_code: 0xc0000094
exception.offset: 1857587
exception.address: 0x5c5833
registers.esp: 1636664
registers.edi: 58982796
registers.eax: 2281895
registers.ebp: 1637564
registers.edx: 0
registers.ebx: 34114817
registers.esi: 58982788
registers.ecx: 0

Allocates read-write-execute memory (usually to unpack itself) (8 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 18, 2024, 9:28 a.m.	process_identifier: 2592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 18, 2024, 9:28 a.m.	process_identifier: 2592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 688128 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 18, 2024, 9:28 a.m.	process_identifier: 2592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 18, 2024, 9:28 a.m.	process_identifier: 2592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 18, 2024, 9:28 a.m.	process_identifier: 2592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72dd2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 18, 2024, 9:28 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72dd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2024, 9:28 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2024, 9:22 a.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe
file	C:\Users\test22\AppData\Local\Temp\is-9VUII.tmp\_isetup\_iscrypt.dll

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\is-9VUII.tmp\_isetup\_iscrypt.dll
file	C:\Users\test22\AppData\Local\Temp\is-3BSJG.tmp\stories.tmp

Queries for potentially installed applications (4 events)

Time & API	Arguments	Return
RegOpenKeyExW Nov. 18, 2024, 9:28 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Shine Encoder_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Shine Encoder_is1	2
RegOpenKeyExW Nov. 18, 2024, 9:28 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Shine Encoder_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Shine Encoder_is1	2
RegOpenKeyExW Nov. 18, 2024, 9:28 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Shine Encoder_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Shine Encoder_is1	2
RegOpenKeyExW Nov. 18, 2024, 9:28 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Shine Encoder_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000101 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Shine Encoder_is1	2

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Windows\system32\net.exe" pause shine-encoder_11152

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-3BSJG.tmp\stories.tmp

File has been identified by 42 AntiVirus engines on VirusTotal as malicious (42 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Ekstak.4!c
Cynet	Malicious (score: 99)
ALYac	Trojan.GenericKD.74838016
Cylance	Unsafe
VIPRE	Trojan.GenericKD.74838016
CrowdStrike	win/grayware_confidence_60% (D)
BitDefender	Trojan.GenericKD.74838016
K7GW	Trojan ( 005bae3a1 )
K7AntiVirus	Trojan ( 005bae3a1 )
Arcabit	Trojan.Generic.D475F000
Symantec	PUA.Gen.2
Elastic	malicious (moderate confidence)
ESET-NOD32	multiple detections
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan.Win32.Ekstak.ayznk
MicroWorld-eScan	Trojan.GenericKD.74838016
Emsisoft	Trojan.GenericKD.74838016 (B)
F-Secure	Adware.ADWARE/AVI.ICLoader.bkska
TrendMicro	Trojan.Win32.SOCKSSYSTEMZ.YXEKOZ
McAfeeD	ti!707B321C42FB
CTX	exe.trojan.ekstak
Sophos	Generic Reputation PUA (PUA)
FireEye	Trojan.GenericKD.74838016
Avira	ADWARE/AVI.ICLoader.bkska
Kingsoft	Win32.Trojan.Ekstak.ayznk
Gridinsoft	Malware.Win32.Gen.tr
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	UDS:Trojan.Win32.Ekstak.ayznk
GData	Win32.Trojan.Kryptik.K6ME2K
McAfee	Artemis!CBB34D952178
DeepInstinct	MALICIOUS
VBA32	Trojan.ICLoader
Malwarebytes	Malware.AI.4288863033
Ikarus	Trojan-Dropper.Win32.Agent
TrendMicro-HouseCall	Trojan.Win32.SOCKSSYSTEMZ.YXEKOZ
Tencent	Win32.Trojan.Ekstak.Iqil
huorong	HEUR:TrojanDropper/Agent.t
Fortinet	Riskware/NDAoF
AVG	Win32:Malware-gen
Paloalto	generic.ml

stories.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All