Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Dec. 16, 2024, 6:12 p.m.	Dec. 16, 2024, 7:01 p.m.

Size	2.0KB
Type	HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5	`81df0a7222ad3c1bd736c2190314b47c`
SHA256	`df63eda4107b614d7a1138490e5c23d657ef4966d7af8c5bd747e5c06a4b231c`
CRC32	`029D9C03`
ssdeep	`48:3XrEzR0n67Z00kWo5XJdYCSC0DpxMUR02V4YD9Lhushq3pYk94WdfG:qgc00doRYrC0FfqYKCAu`
Yara	None matched

mshta.exe "C:\Windows\System32\mshta.exe" C:\Users\test22\AppData\Local\Temp\Captcha.hta
2080

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 16, 2024, 6:12 p.m.		1	1	0

Performs some HTTP requests (1 event)

request

GET http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Dec. 16, 2024, 6:12 p.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03410000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:12 p.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03410000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:12 p.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03410000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:12 p.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03410000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:12 p.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03410000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:12 p.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03410000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:12 p.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03410000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:12 p.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03411000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:12 p.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03411000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:12 p.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03411000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:12 p.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03412000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:12 p.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03412000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:12 p.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03412000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:12 p.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03412000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:12 p.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03412000 process_handle: 0xffffffff	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Dec. 16, 2024, 6:12 p.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 16 (PAGE_EXECUTE) base_address: 0x03410000 process_handle: 0xffffffff	1	0	0

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Lionic	Trojan.HTML.Electryon.a!c
CTX	vba.trojan.electryon
ALYac	VBS:Electryon.380
VIPRE	VBS:Electryon.380
Arcabit	VBS:Electryon.380
Symantec	Trojan.Gen.MBT
ESET-NOD32	PowerShell/TrojanDownloader.Agent.KIV
TrendMicro-HouseCall	Trojan.HTML.LUMMASTEALER.YXELMZ
Avast	Script:SNH-gen [Drp]
Kaspersky	Trojan-Downloader.VBS.Tiny.c
BitDefender	VBS:Electryon.380
NANO-Antivirus	Trojan.Script.ExpKit.eurlzq
MicroWorld-eScan	VBS:Electryon.380
Emsisoft	VBS:Electryon.380 (B)
TrendMicro	Trojan.HTML.LUMMASTEALER.YXELMZ
Ikarus	HTML.ExploitKit
FireEye	VBS:Electryon.380
Google	Detected
Kingsoft	Win32.Infected.AutoInfector.a
GData	VBS:Electryon.380
Varist	XML/ABApplication.CW
Tencent	Win32.Trojan-Downloader.Downloader.Kmnw
AVG	Script:SNH-gen [Drp]
alibabacloud	Trojan[downloader]:Win/Tiny.c

Captcha.hta

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All