Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 24, 2025, 1:32 p.m.	March 24, 2025, 1:34 p.m.

Size	1.4MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`06b18d1d3a9f8d167e22020aeb066873`
SHA256	`34b129b82df5d38841dc9978746790673f32273b07922c74326e0752a592a579`
CRC32	`AE2AA255`
ssdeep	`24576:5tCj1bzqgJmDWkjmZgPUW/STvNGF13sg3l2gIOZf3IvLKHQHEkOaTVhiLoXlTKq:5Q1Hqg+DggPJ/0IYg3rIOZgvFT+kUq`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

zx4PJh6.exe "C:\Users\test22\AppData\Local\Temp\zx4PJh6.exe"
2552
- cmd.exe "C:\Windows\system32\CMD.exe" /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat
  2676
  - findstr.exe findstr /I "opssvc wrsa"
    2784
  - tasklist.exe tasklist
    2748
  - tasklist.exe tasklist
    2896
  - findstr.exe findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
    2932
  - cmd.exe cmd /c md 440824
    3004
  - extrac32.exe extrac32 /Y /E Architecture.wmv
    3048
  - findstr.exe findstr /V "Offensive" Inter
    2056
  - cmd.exe cmd /c copy /b 440824\Organizations.com + Flexible + Damn + Hard + College + Corp + Cj + Boulevard + Drainage + Truth 440824\Organizations.com
    1404
  - cmd.exe cmd /c copy /b ..\Dancing.wmv + ..\Ka.wmv + ..\Bali.wmv + ..\Liability.wmv + ..\Lamps.wmv + ..\Electro.wmv + ..\Shakespeare.wmv + ..\Make.wmv + ..\Physiology.wmv + ..\Witness.wmv + ..\Submitting.wmv + ..\Bd.wmv h
    1264
  - Organizations.com Organizations.com h
    148
  - choice.exe choice /d y /t 5
    2312

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW March 24, 2025, 1:32 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW March 24, 2025, 1:32 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 24, 2025, 1:32 p.m.			0	0
IsDebuggerPresent March 24, 2025, 1:32 p.m.			0	0

Command line console output was observed (50 out of 1903 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: Set console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: Discussed=L console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: EcGas console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: 'EcGas' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: YvIllustrations console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: (Premises(Tap(Bizarre(Feb(Fell( console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: 'YvIllustrations' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: SYdBrandon console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: (Trust(Nu(Advertisement(Oil( console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: 'SYdBrandon' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: rMDoMember console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: (Terminology(Innovative(Gambling( console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: 'rMDoMember' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: aYMacro console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: (Associates(Monroe(Upon(Obligation(Catering(Cached( console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: 'aYMacro' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: dAmYn console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: (Washing(Motorola(Desktops(Flour(Watches( console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: 'dAmYn' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: bnXTab console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: (Infection(Block( console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: 'bnXTab' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: Set console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: Arg=l console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: ojAppearing console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: (Fly(Louise(Plenty(Label(Fruits(Uniprotkb(Copyright(Valuable( console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: 'ojAppearing' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: RoRoof console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: (Pace(Rescue(Revision( console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: 'RoRoof' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: QwLike console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: (Carbon(Stainless( console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: 'QwLike' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: HmKMouth console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: (Http(Inner(Page(Shopper(Transcription(Marilyn( console_handle: 0x00000007	1	1
WriteConsoleW March 24, 2025, 1:32 p.m.	buffer: 'HmKMouth' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 24, 2025, 1:32 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 24, 2025, 1:32 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 24, 2025, 1:32 p.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 24, 2025, 1:32 p.m.	process_identifier: 148 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d2000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\440824\Organizations.com

Creates a suspicious process (2 events)

cmdline	"C:\Windows\system32\CMD.exe" /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat
cmdline	C:\Windows\System32\cmd.exe /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\440824\Organizations.com

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\440824\Organizations.com

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW March 24, 2025, 1:32 p.m.	show_type: 0 filepath_r: C:\Windows\system32\CMD.exe parameters: /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat filepath: C:\Windows\System32\cmd.exe	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW March 24, 2025, 1:32 p.m.	snapshot_handle: 0x00000134 process_name: WmiPrvSE.exe process_identifier: 2856	1	1	0
Process32NextW March 24, 2025, 1:32 p.m.	snapshot_handle: 0x00000134 process_name: Organizations.com process_identifier: 148	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0000ea00', u'virtual_address': u'0x00470000', u'entropy': 7.7253144491761265, u'name': u'.rsrc', u'virtual_size': u'0x0000e960'}

entropy

7.72531444918

description

A section with a high entropy has been found

entropy

0.646408839779

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 24, 2025, 1:32 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW March 24, 2025, 1:32 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (33 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Hijack network configuration	rule	Hijack_Network
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	"C:\Windows\system32\CMD.exe" /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat
cmdline	tasklist
cmdline	C:\Windows\System32\cmd.exe /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2676 resumed a thread in remote process 148
NtResumeThread March 24, 2025, 1:32 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 148	1	0	0

File has been identified by 40 AntiVirus engines on VirusTotal as malicious (40 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Runner.m!c
Cynet	Malicious (score: 99)
CAT-QuickHeal	cld.backdoor.agent
Skyhigh	BehavesLike.Win32.Dropper.tc
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_60% (W)
K7GW	Trojan ( 005c2e221 )
K7AntiVirus	Trojan ( 005c2e221 )
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	NSIS/Runner.LG
Avast	NSIS:BackdoorX-gen [Trj]
Kaspersky	HEUR:Backdoor.Win32.Agent.gen
Alibaba	TrojanDropper:Application/Runner.adebd511
Rising	Trojan.Runner/NSIS!1.128CD (CLASSIC)
F-Secure	Trojan.TR/Redcap.jebyu
TrendMicro	Trojan.Win32.AMADEY.YXFCUZ
McAfeeD	ti!34B129B82DF5
Trapmine	suspicious.low.ml.score
CTX	exe.trojan.runner
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
FireEye	Generic.mg.06b18d1d3a9f8d16
Google	Detected
Avira	TR/Redcap.jebyu
Kingsoft	malware.kb.a.982
Microsoft	Trojan:Win64/LummaStealer!rfn
GData	Win32.Trojan.Agent.11Y016
Varist	W32/ABTrojan.OESL-3800
McAfee	Artemis!06B18D1D3A9F
DeepInstinct	MALICIOUS
Ikarus	Trojan.NSIS.Runner
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXFCUZ
Tencent	Win32.Backdoor.Agent.Cdhl
Fortinet	W32/Runner.LG!tr
AVG	NSIS:BackdoorX-gen [Trj]
Paloalto	generic.ml
alibabacloud	Backdoor:Win/Runner.LU

zx4PJh6.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All