Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 29, 2024, 1:28 p.m.	Nov. 29, 2024, 1:33 p.m.

Size	984.5KB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`a55d149ef6d095d1499d0668459c236f`
SHA256	`c4a5fdd606768f6f69aa9e6cad874296c8e1e85f88b17f12b4ecab2c247c54ce`
CRC32	`410BA5BD`
ssdeep	`24576:JEN/si2azuLhn21szZkveEPNoYeOvxV3mhfyHUCxizDs5oy9F11:sNz3aWeE6YTifyHUg9P1`
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

uxN4wDZ.exe "C:\Users\test22\AppData\Local\Temp\uxN4wDZ.exe"
2652
- uxN4wDZ.exe "C:\Users\test22\AppData\Local\Temp\uxN4wDZ.exe"
  2748

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 29, 2024, 1:28 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 29, 2024, 1:28 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.00cfg

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 29, 2024, 1:28 p.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Nov. 29, 2024, 1:28 p.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d86000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0004a800', u'virtual_address': u'0x000b2000', u'entropy': 7.999414040544859, u'name': u'.bss', u'virtual_size': u'0x0004a800'}

entropy

7.99941404054

description

A section with a high entropy has been found

entropy

0.303153611394

description

Overall entropy of this PE file is high

Yara rule detected in process memory (9 events)

description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Nov. 29, 2024, 1:28 p.m.	process_identifier: 2748 region_size: 364544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c	1	0	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Nov. 29, 2024, 1:28 p.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELB3Ggàæ¾Ð@@ÝP<?(¼.textÝåæ `.rdata· "ê@@.data0Z@À.CRT@f@@.reloc<?P@h@B base_address: 0x00400000 process_identifier: 2748 process_handle: 0x0000002c	1	1
WriteProcessMemory Nov. 29, 2024, 1:28 p.m.	buffer: @ base_address: 0x00454000 process_identifier: 2748 process_handle: 0x0000002c	1	1
WriteProcessMemory Nov. 29, 2024, 1:28 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2748 process_handle: 0x0000002c	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 29, 2024, 1:28 p.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELB3Ggàæ¾Ð@@ÝP<?(¼.textÝåæ `.rdata· "ê@@.data0Z@À.CRT@f@@.reloc<?P@h@B base_address: 0x00400000 process_identifier: 2748 process_handle: 0x0000002c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2652 called NtSetContextThread to modify thread in remote process 2748
NtSetContextThread Nov. 29, 2024, 1:28 p.m.	registers.eip: 1995571652 registers.esp: 1898544 registers.edi: 0 registers.eax: 4233168 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000020 process_identifier: 2748	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2652 resumed a thread in remote process 2748
NtResumeThread Nov. 29, 2024, 1:28 p.m.	thread_handle: 0x00000020 suspend_count: 1 process_identifier: 2748	1	0	0

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Bkav	W32.AIDetectMalware
Cynet	Malicious (score: 100)
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/GenKryptik.HDSK
APEX	Malicious
Avast	FileRepMalware [Trj]
Kaspersky	VHO:Trojan-PSW.Win32.Stealerc.gen
McAfeeD	ti!C4A5FDD60676
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.a55d149ef6d095d1
Antiy-AVL	GrayWare/Win32.Kryptik.gpyt
Kingsoft	malware.kb.a.924
Microsoft	Trojan:Win32/Wacatac.B!ml
DeepInstinct	MALICIOUS
VBA32	BScope.TrojanSpy.Stealer
Tencent	Win32.Trojan.Genkryptik.Yylw
MaxSecure	Trojan.Malware.300983.susgen
AVG	FileRepMalware [Trj]

Executed a process and injected code into it, probably while unpacking (13 events)

Time & API	Arguments	Status	Return
NtResumeThread Nov. 29, 2024, 1:28 p.m.	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 2652	1	0
CreateProcessInternalW Nov. 29, 2024, 1:28 p.m.	thread_identifier: 2752 thread_handle: 0x00000020 process_identifier: 2748 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\uxN4wDZ.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\uxN4wDZ.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000002c	1	1
NtGetContextThread Nov. 29, 2024, 1:28 p.m.	thread_handle: 0x00000020	1	0
NtAllocateVirtualMemory Nov. 29, 2024, 1:28 p.m.	process_identifier: 2748 region_size: 364544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c	1	0
WriteProcessMemory Nov. 29, 2024, 1:28 p.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELB3Ggàæ¾Ð@@ÝP<?(¼.textÝåæ `.rdata· "ê@@.data0Z@À.CRT@f@@.reloc<?P@h@B base_address: 0x00400000 process_identifier: 2748 process_handle: 0x0000002c	1	1
WriteProcessMemory Nov. 29, 2024, 1:28 p.m.	buffer: base_address: 0x00401000 process_identifier: 2748 process_handle: 0x0000002c	1	1
WriteProcessMemory Nov. 29, 2024, 1:28 p.m.	buffer: base_address: 0x00440000 process_identifier: 2748 process_handle: 0x0000002c	1	1
WriteProcessMemory Nov. 29, 2024, 1:28 p.m.	buffer: base_address: 0x00443000 process_identifier: 2748 process_handle: 0x0000002c	1	1
WriteProcessMemory Nov. 29, 2024, 1:28 p.m.	buffer: @ base_address: 0x00454000 process_identifier: 2748 process_handle: 0x0000002c	1	1
WriteProcessMemory Nov. 29, 2024, 1:28 p.m.	buffer: base_address: 0x00455000 process_identifier: 2748 process_handle: 0x0000002c	1	1
WriteProcessMemory Nov. 29, 2024, 1:28 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2748 process_handle: 0x0000002c	1	1
NtSetContextThread Nov. 29, 2024, 1:28 p.m.	registers.eip: 1995571652 registers.esp: 1898544 registers.edi: 0 registers.eax: 4233168 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000020 process_identifier: 2748	1	0
NtResumeThread Nov. 29, 2024, 1:28 p.m.	thread_handle: 0x00000020 suspend_count: 1 process_identifier: 2748	1	0

uxN4wDZ.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All