Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Feb. 28, 2025, 9:27 a.m.	Feb. 28, 2025, 9:29 a.m.

Size	19.7MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`30c4c3698b65140a72d8268e5fb29f25`
SHA256	`e34756a5015b227ce85128b38185cc0eb54a9ee92b06337aaa77bd033c7e3c9d`
CRC32	`8413940E`
ssdeep	`393216:dLSCmr7oPGe3OhLu1qlSqxsHsxu92rLCEygrpnvZeuhl:8BrkZOhLu1Xx9GC3gFvZe`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Antivirus - Contains references to security software Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet IsPE32 - (no description) Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check mzp_file_format - MZP(Delphi) file format UPX_Zero - UPX packed file

Partner_Studio_Setup.exe "C:\Users\test22\AppData\Local\Temp\Partner_Studio_Setup.exe"
2640
- Partner_Studio_Setup.tmp "C:\Users\test22\AppData\Local\Temp\is-1I18T.tmp\Partner_Studio_Setup.tmp" /SL5="$80178,17550885,780800,C:\Users\test22\AppData\Local\Temp\Partner_Studio_Setup.exe"
  2708
  - Partner_Studio_Setup.exe "C:\Users\test22\AppData\Local\Temp\Partner_Studio_Setup.exe" /VERYSILENT
    2824
    - Partner_Studio_Setup.tmp "C:\Users\test22\AppData\Local\Temp\is-MRQ4I.tmp\Partner_Studio_Setup.tmp" /SL5="$90178,17550885,780800,C:\Users\test22\AppData\Local\Temp\Partner_Studio_Setup.exe" /VERYSILENT
      2888
      - CheckHyperVHost.exe "C:\Users\test22\AppData\Roaming\{3781CD53-9C9A-4B84-8139-BACDB5178120}\CheckHyperVHost.exe"
        3044
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Feb. 28, 2025, 9:27 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 28, 2025, 9:27 a.m.			0	0
IsDebuggerPresent Feb. 28, 2025, 9:27 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.itext
section	.didata

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ Feb. 28, 2025, 9:27 a.m.	stacktrace: TMethodImplementationIntercept+0x1fa4b1 dbkFCallWrapperAddr-0x21337 partner_studio_setup+0x2b0309 @ 0x6b0309 TMethodImplementationIntercept+0x1fa4b1 dbkFCallWrapperAddr-0x21337 partner_studio_setup+0x2b0309 @ 0x6b0309 TMethodImplementationIntercept+0x20d8f7 dbkFCallWrapperAddr-0xdef1 partner_studio_setup+0x2c374f @ 0x6c374f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1637812 registers.edi: 6071344 registers.eax: 1637812 registers.ebp: 1637892 registers.edx: 0 registers.ebx: 0 registers.esi: 2 registers.ecx: 7	1	0	0
__exception__ Feb. 28, 2025, 9:28 a.m.	stacktrace: 0x8f1b88 0x8f124b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 10 83 ec 10 85 c0 78 06 8b bd d4 fd ff ff 8d exception.instruction: call dword ptr [eax] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x8f1dfc registers.esp: 44758780 registers.edi: 0 registers.eax: 0 registers.ebp: 44759380 registers.edx: 37 registers.ebx: 44758836 registers.esi: 44759428 registers.ecx: 44759428	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (16 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Feb. 28, 2025, 9:27 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 28, 2025, 9:27 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 745472 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 28, 2025, 9:27 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 28, 2025, 9:27 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 28, 2025, 9:27 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72dd2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 28, 2025, 9:27 a.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72dd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 28, 2025, 9:27 a.m.	process_identifier: 2708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 28, 2025, 9:21 a.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000046a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 28, 2025, 9:27 a.m.	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 28, 2025, 9:27 a.m.	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 745472 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 28, 2025, 9:27 a.m.	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 28, 2025, 9:27 a.m.	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 28, 2025, 9:27 a.m.	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73452000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 28, 2025, 9:27 a.m.	process_identifier: 2888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73452000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 28, 2025, 9:27 a.m.	process_identifier: 2888 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 28, 2025, 9:28 a.m.	process_identifier: 3044 region_size: 110592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\is-TGP04.tmp\_isetup\_iscrypt.dll
file	C:\Users\test22\AppData\Local\Temp\is-TGP04.tmp\_isetup\_isdecmp.dll
file	C:\Users\test22\AppData\Local\Temp\is-C47BF.tmp\_isetup\_isdecmp.dll
file	C:\Users\test22\AppData\Local\Temp\is-C47BF.tmp\_isetup\_iscrypt.dll

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Local\Temp\is-C47BF.tmp\_isetup\_isdecmp.dll
file	C:\Users\test22\AppData\Local\Temp\is-1I18T.tmp\Partner_Studio_Setup.tmp
file	C:\Users\test22\AppData\Local\Temp\is-C47BF.tmp\_isetup\_iscrypt.dll

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Feb. 28, 2025, 9:27 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\Partner_Studio_Setup.exe parameters: /VERYSILENT filepath: C:\Users\test22\AppData\Local\Temp\Partner_Studio_Setup.exe	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (4 events)

Time & API	Arguments	Status	Return
Process32NextW Feb. 28, 2025, 9:27 a.m.	snapshot_handle: 0x00000278 process_name: pw.exe process_identifier: 2340	1	1
Process32NextW Feb. 28, 2025, 9:27 a.m.	snapshot_handle: 0x00000278 process_name: taskhost.exe process_identifier: 2488	1	1
Process32NextW Feb. 28, 2025, 9:27 a.m.	snapshot_handle: 0x00000278 process_name: Partner_Studio_Setup.exe process_identifier: 2824	1	1
Process32NextW Feb. 28, 2025, 9:27 a.m.	snapshot_handle: 0x00000278 process_name: Partner_Studio_Setup.tmp process_identifier: 2888	1	1

Queries for potentially installed applications (1 event)

Time & API	Arguments	Status	Return	Repeated
RegOpenKeyExW Feb. 28, 2025, 9:27 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\StellarMySqlRecovery_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\StellarMySqlRecovery_is1		2	0

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-MRQ4I.tmp\Partner_Studio_Setup.tmp

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 events)

Bkav	W32.AIDetectMalware
Skyhigh	Artemis
Cylance	Unsafe
CrowdStrike	win/grayware_confidence_100% (D)
ESET-NOD32	a variant of Generik.XETVYA
McAfeeD	ti!E34756A5015B
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
Google	Detected
Kingsoft	Win32.Troj.Unknown.a
Microsoft	Trojan:Win32/Sonbokli.A!cl
Varist	W32/ABApplication.QJZK-5483
McAfee	Artemis!30C4C3698B65
DeepInstinct	MALICIOUS
Ikarus	Win32.Outbreak

Detects the presence of Wine emulator (1 event)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress Feb. 28, 2025, 9:28 a.m.	ordinal: 0 function_address: 0x001927b4 function_name: wine_get_version module: ntdll module_address: 0x76f10000		3221225785	0

Partner_Studio_Setup.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All