Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 22, 2024, 3:03 p.m.	Nov. 22, 2024, 3:09 p.m.

Size	503.6KB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`926dd9e88e2ac846eaf3c23ef8208cdf`
SHA256	`ad277a48c7c67f5510e0d2b28284f631f9e51dd7da53ed9e4da8dec0078d9aa0`
CRC32	`401D6E58`
ssdeep	`12288:sA4gyTSwAN2kL0PPJHBlOyLwFrpOu6VSlC8OIlr7v:sxgFN2kL03HlpLwFrpOu6qC83r7v`
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

chrome_133.exe "C:\Users\test22\AppData\Local\Temp\chrome_133.exe"
1932
- chrome_133.exe "C:\Users\test22\AppData\Local\Temp\chrome_133.exe"
  2112

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Nov. 22, 2024, 3:03 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameA Nov. 22, 2024, 3:03 p.m.	computer_name: TEST22-PC	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 22, 2024, 3:03 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.00cfg
section	.coS

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 22, 2024, 3:02 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00edd000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Nov. 22, 2024, 3:03 p.m.	process_identifier: 2112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00330000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00035600', u'virtual_address': u'0x00001000', u'entropy': 6.9570355128484875, u'name': u'.text', u'virtual_size': u'0x0003542c'}

entropy

6.95703551285

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0003bc00', u'virtual_address': u'0x00043000', u'entropy': 7.999240180906577, u'name': u'.coS', u'virtual_size': u'0x0003bc00'}

entropy

7.99924018091

description

A section with a high entropy has been found

entropy

0.92252803262

description

Overall entropy of this PE file is high

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://localhost:9229/json

Yara rule detected in process memory (14 events)

description	Client_SW_User_Data_Stealer	rule	Client_SW_User_Data_Stealer
description	ftp clients info stealer	rule	infoStealer_ftpClients_Zero
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Nov. 22, 2024, 3:03 p.m.	status_code: 0x00000000 process_identifier: 2076 process_handle: 0x0000002c		0	0
NtTerminateProcess Nov. 22, 2024, 3:03 p.m.	status_code: 0x00000000 process_identifier: 2076 process_handle: 0x0000002c	1	0	0

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Nov. 22, 2024, 3:03 p.m.	process_identifier: 2076 region_size: 2424832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c		3221225496	0
NtAllocateVirtualMemory Nov. 22, 2024, 3:03 p.m.	process_identifier: 2112 region_size: 2424832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000040	1	0	0

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1932 manipulating memory of non-child process 2076
NtAllocateVirtualMemory Nov. 22, 2024, 3:03 p.m.	process_identifier: 2076 region_size: 2424832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c		3221225496	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Nov. 22, 2024, 3:03 p.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $Î´â8ÕkÕkÕkå£'kÕkå£kÕkå£&k°ÕkkÕkkÕk ¬jÕkÕkÖÕkå£#kÕkå£kÕkRichÕkPEL >gà @"À°@%@`< $ä<°.textú à.rdatatµ°¶@@.dataì+!pR@À.reloc$] $^^@B base_address: 0x00400000 process_identifier: 2112 process_handle: 0x00000040	1	1
WriteProcessMemory Nov. 22, 2024, 3:03 p.m.	buffer: \±B.?AVtype_info@@Næ@»±¿D ! 5A CPR S WYl m pr ) ¡¤§ ·Î× ÿÿÿÿÿÿÿÿ>B>B>B>B>B>B>B>B>B>BC$ÇB ÇBÇBÇBÇBÇBÇBÇBüÆBôÆBèÆBÜÆBÔÆBÈÆBÄÆBÀÆB¼ÆB¸ÆB´ÆB°ÆB¬ÆB¨ÆB¤ÆB ÆBÆBÆBÆBÆB\|ÆBtÆB´ÆBlÆBdÆB\ÆBPÆBHÆB<ÆB0ÆB,ÆB(ÆBÆBÆBüÅB ôÅBìÅBäÅBÜÅBÔÅBÌÅBÄÅB´ÅB¤ÅBÅBÅBlÅB\ÅBHÅB@ÅB8ÅB0ÅB(ÅB ÅBÅBÅBÅBÅBøÄBðÄBèÄBØÄBÄÄB¸ÄB¬ÄB ÅB ÄBÄBÄBpÄB`ÄBLÄB8ÄB0ÄB(ÄBÄBìÃBØÃBsCsCsCsCsCÈzC¨ÈB0ÍB°ÎBsCxtC abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZXuC¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þÿÿÿÿ þÿÿÿ¬ÊB..ÀzCCCCCCCCCCÄzCCCCCCCCÈzC¨ÈBªÊB.\±B.?AVlogic_error@std@@\±B.?AVlength_error@std@@\±B.?AVout_of_range@std@@\±B.?AVexception@std@@\±B.?AVbad_alloc@std@@ base_address: 0x00437000 process_identifier: 2112 process_handle: 0x00000040	1	1
WriteProcessMemory Nov. 22, 2024, 3:03 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2112 process_handle: 0x00000040	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 22, 2024, 3:03 p.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $Î´â8ÕkÕkÕkå£'kÕkå£kÕkå£&k°ÕkkÕkkÕk ¬jÕkÕkÖÕkå£#kÕkå£kÕkRichÕkPEL >gà @"À°@%@`< $ä<°.textú à.rdatatµ°¶@@.dataì+!pR@À.reloc$] $^^@B base_address: 0x00400000 process_identifier: 2112 process_handle: 0x00000040	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1932 called NtSetContextThread to modify thread in remote process 2112
NtSetContextThread Nov. 22, 2024, 3:03 p.m.	registers.eip: 2005598660 registers.esp: 1374388 registers.edi: 0 registers.eax: 4332992 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000044 process_identifier: 2112	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1932 resumed a thread in remote process 2112
NtResumeThread Nov. 22, 2024, 3:03 p.m.	thread_handle: 0x00000044 suspend_count: 1 process_identifier: 2112	1	0	0

Executed a process and injected code into it, probably while unpacking (14 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Nov. 22, 2024, 3:03 p.m.	thread_identifier: 2080 thread_handle: 0x00000020 process_identifier: 2076 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\chrome_133.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\chrome_133.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000002c	1	1
NtGetContextThread Nov. 22, 2024, 3:03 p.m.	thread_handle: 0x00000020	1	0
NtAllocateVirtualMemory Nov. 22, 2024, 3:03 p.m.	process_identifier: 2076 region_size: 2424832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c		3221225496
CreateProcessInternalW Nov. 22, 2024, 3:03 p.m.	thread_identifier: 2116 thread_handle: 0x00000044 process_identifier: 2112 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\chrome_133.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\chrome_133.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000040	1	1
NtGetContextThread Nov. 22, 2024, 3:03 p.m.	thread_handle: 0x00000044	1	0
NtAllocateVirtualMemory Nov. 22, 2024, 3:03 p.m.	process_identifier: 2112 region_size: 2424832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000040	1	0
WriteProcessMemory Nov. 22, 2024, 3:03 p.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $Î´â8ÕkÕkÕkå£'kÕkå£kÕkå£&k°ÕkkÕkkÕk ¬jÕkÕkÖÕkå£#kÕkå£kÕkRichÕkPEL >gà @"À°@%@`< $ä<°.textú à.rdatatµ°¶@@.dataì+!pR@À.reloc$] $^^@B base_address: 0x00400000 process_identifier: 2112 process_handle: 0x00000040	1	1
WriteProcessMemory Nov. 22, 2024, 3:03 p.m.	buffer: base_address: 0x00401000 process_identifier: 2112 process_handle: 0x00000040	1	1
WriteProcessMemory Nov. 22, 2024, 3:03 p.m.	buffer: base_address: 0x0042b000 process_identifier: 2112 process_handle: 0x00000040	1	1
WriteProcessMemory Nov. 22, 2024, 3:03 p.m.	buffer: \±B.?AVtype_info@@Næ@»±¿D ! 5A CPR S WYl m pr ) ¡¤§ ·Î× ÿÿÿÿÿÿÿÿ>B>B>B>B>B>B>B>B>B>BC$ÇB ÇBÇBÇBÇBÇBÇBÇBüÆBôÆBèÆBÜÆBÔÆBÈÆBÄÆBÀÆB¼ÆB¸ÆB´ÆB°ÆB¬ÆB¨ÆB¤ÆB ÆBÆBÆBÆBÆB\|ÆBtÆB´ÆBlÆBdÆB\ÆBPÆBHÆB<ÆB0ÆB,ÆB(ÆBÆBÆBüÅB ôÅBìÅBäÅBÜÅBÔÅBÌÅBÄÅB´ÅB¤ÅBÅBÅBlÅB\ÅBHÅB@ÅB8ÅB0ÅB(ÅB ÅBÅBÅBÅBÅBøÄBðÄBèÄBØÄBÄÄB¸ÄB¬ÄB ÅB ÄBÄBÄBpÄB`ÄBLÄB8ÄB0ÄB(ÄBÄBìÃBØÃBsCsCsCsCsCÈzC¨ÈB0ÍB°ÎBsCxtC abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZXuC¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þÿÿÿÿ þÿÿÿ¬ÊB..ÀzCCCCCCCCCCÄzCCCCCCCCÈzC¨ÈBªÊB.\±B.?AVlogic_error@std@@\±B.?AVlength_error@std@@\±B.?AVout_of_range@std@@\±B.?AVexception@std@@\±B.?AVbad_alloc@std@@ base_address: 0x00437000 process_identifier: 2112 process_handle: 0x00000040	1	1
WriteProcessMemory Nov. 22, 2024, 3:03 p.m.	buffer: base_address: 0x0064a000 process_identifier: 2112 process_handle: 0x00000040	1	1
WriteProcessMemory Nov. 22, 2024, 3:03 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2112 process_handle: 0x00000040	1	1
NtSetContextThread Nov. 22, 2024, 3:03 p.m.	registers.eip: 2005598660 registers.esp: 1374388 registers.edi: 0 registers.eax: 4332992 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000044 process_identifier: 2112	1	0
NtResumeThread Nov. 22, 2024, 3:03 p.m.	thread_handle: 0x00000044 suspend_count: 1 process_identifier: 2112	1	0

chrome_133.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All