Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 9, 2021, 11:36 a.m.	March 9, 2021, 11:38 a.m.

Size	181.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`b9bf7278d38a66f52bad2055b361de4a`
SHA256	`c81f27a34af933278aa36efc16e1665526a00d5b8913ab2530b4556173b475be`
CRC32	`56C7062B`
ssdeep	`3072:yX7J2E72CpkZU3tjGUSyty8j2aTbOTuVWFlIncZB8lyc:yX7Jf/pkZ+ihytaa2uVWIDyc`
PDB Path	D:\Mktmp\NL1\Release\NL1.pdb
Yara	IsPE32 - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check network_http - Communications over HTTP win_mutex - Create or check mutex win_files_operation - Affect private profile Str_Win32_Wininet_Library - Match Windows Inet API library declaration Str_Win32_Internet_API - Match Windows Inet API call Str_Win32_Http_API - Match Windows Http API call PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero

a.exe "C:\Users\test22\AppData\Local\Temp\a.exe"
2216
- bween.exe "C:\ProgramData\97fd00311d\bween.exe"
  1772
  - cmd.exe "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\97fd00311d\
    1396
    - reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\97fd00311d\
      1808

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
217.8.117.207	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW March 9, 2021, 11:36 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW March 9, 2021, 11:36 a.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1	0

This executable has a PDB path (1 event)

pdb_path

D:\Mktmp\NL1\Release\NL1.pdb

A process attempted to delay the analysis task. (1 event)

description

bween.exe tried to sleep 318 seconds, actually delayed analysis time by 318 seconds

Creates executable files on the filesystem (1 event)

file	C:\ProgramData\97fd00311d\bween.exe

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\97fd00311d\

Drops a binary and executes it (1 event)

file	C:\ProgramData\97fd00311d\bween.exe

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW March 9, 2021, 11:36 a.m.	show_type: 0 filepath_r: C:\ProgramData\97fd00311d\bween.exe parameters: filepath: C:\ProgramData\97fd00311d\bween.exe	1	1	0
ShellExecuteExW March 9, 2021, 11:36 a.m.	show_type: 0 filepath_r: cmd parameters: /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\97fd00311d\ filepath: cmd	1	1	0

Potentially malicious URLs were found in the process memory dump (50 out of 1249 events)

url	https://ssl.pstatic.net/tveta/libs/1287/1287046/6df1cc02334922baa2d4_20200806172035021.jpg
url	https://ssl.pstatic.net/static/pwe/common/img_use_mobile_version.png
url	http://find.joins.com/
url	http://uk.ask.com/favicon.ico
url	https://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wWA.woff
url	http://google.com/
url	https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2FcropImg_339x222_38528621599152653.jpeg%22
url	http://search.yahoo.co.jp
url	http://www.iask.com/favicon.ico
url	https://s.pstatic.net/static/www/mobile/edit/2020/0804/cropImg_728x360_38481254551659019.jpeg
url	http://www.najdi.si/
url	http://www.merlin.com.pl/favicon.ico
url	http://www.cnet.com/favicon.ico
url	https://ssl.pstatic.net/tveta/libs/assets/js/common/min/probe.min.js
url	https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic1.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2FcropImg_222x145_38626953912837677.png%22
url	https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
url	http://search.naver.com/search.naver?sm=tab_hty.top
url	http://www.snee.com/xml/xslt/sample.doc
url	http://recherche.linternaute.com/
url	http://www.yceml.net/0559/10408495-1499411010011
url	http://p.zhongsou.com/
url	https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118371466370743504.jpeg
url	https://s.pstatic.net/static/newsstand/up/2020/0615/nsd10319824.png
url	https://fonts.gstatic.com/s/catamaran/v7/o-0bIpQoyXQa2RxT7-5B6Ryxs2E_6n1iPHjd5a7dvQ.woff
url	https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2FcropImg_339x222_38552809772500435.jpeg%22
url	https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/src/controls.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
url	https://ssl.pstatic.net/static/pwe/nm/b.gif
url	http://search.nifty.com/
url	https://castbox.shopping.naver.com/js/lazyload.js
url	http://ns.adobe.com/exif/1.0/
url	https://s.pstatic.net/shopping.phinf/20200729_1/2931dd60-1842-4048-a39c-1e3389db4a0e.jpg
url	https://ssl.pstatic.net/static/pwe/nm/spr_vertical_0d25bb77f8.png
url	https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_17061525298c.jpg%22
url	http://www.etmall.com.tw/
url	https://s.pstatic.net/static/newsstand/2020/logo/light/0604/042.png
url	https://s.pstatic.net/static/newsstand/2020/logo/light/0604/955.png
url	https://s.pstatic.net/static/newsstand/2020/logo/light/0604/056.png
url	http://www.buzzadnetwork.com/jump/next.php?stamat=m%7CM-4iM-4jaQdHQBH0dEdHP3xP.0e7%2CboDB7XrVJDfRqYwVNhmAc8QRCrIuseXl_bWuTf_latOFYiGEzPpb7ikp5t8RPmTHyMRYDe1i9EJZLC6LSuccW1-YPggnMxkcwVirdNVGfgK3hFUbeKvFvqNv0-u8VxfrNUFB1gFhMN_8GLCn1znxf5_p0FJe0MYRI7nbfyajoqg_H3fvzrjsMsC0vAMYn2un8v5vcBfzwM-DewoZ7WId7geGlrySfAHx5KiJ5Hm90CU%2C
url	https://s.pstatic.net/shopping.phinf/20200720_22/e2297359-375a-403a-86c5-44ff86c708fc.jpg
url	https://t1.daumcdn.net/tistory_admin/blogs/plugins/PreventCopyContents/js/functions.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
url	http://busca.estadao.com.br/favicon.ico
url	http://search.hanafos.com/favicon.ico
url	https://ssl.pstatic.net/tveta/libs/1298/1298853/743c01d46e807a376d99_20200730182507675.png
url	https://tistory3.daumcdn.net/tistory/807805/skin/images/footerbg.jpg
url	http://search.chol.com/favicon.ico
url	https://s.pstatic.net/static/newsstand/2020/logo/light/0604/820.png
url	http://www.mercadolibre.com.mx/favicon.ico
url	https://file-examples-com.github.io/uploads/2017/02/file-sample_1MB.doc
url	https://s.pstatic.net/static/newsstand/2020/logo/light/0604/825.png
url	http://search.lycos.com/

Yara rule detected in process memory (50 out of 172 events)

description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Create a windows service	rule	create_service
description	Communications over UDP network	rule	network_udp_sock
description	Listen for incoming communication	rule	network_tcp_listen
description	Communications over P2P network	rule	network_p2p_win
description	Communications over HTTP	rule	network_http
description	File downloader/dropper	rule	network_dropper
description	Communications over FTP	rule	network_ftp
description	Communications over RAW socket	rule	network_tcp_socket
description	Communications use DNS	rule	network_dns
description	Communication using dga	rule	network_dga
description	Escalade priviledges	rule	escalate_priv
description	Take screenshot	rule	screenshot
description	Run a keylogger	rule	keylogger
description	Steal credential	rule	cred_local
description	Record Audio	rule	sniff_audio
description	APC queue tasks migration	rule	migrate_apc
description	Malware can spread east-west using share drive	rule	spreading_share
description	Create or check mutex	rule	win_mutex
description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_private_profile
description	Affect private profile	rule	win_files_operation
description	Match Winsock 2 API library declaration	rule	Str_Win32_Winsock2_Library
description	Match Windows Inet API library declaration	rule	Str_Win32_Wininet_Library
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Hijack network configuration	rule	hijack_network
description	Create a windows service	rule	create_service
description	Create a COM server	rule	create_com_service
description	Communications over UDP network	rule	network_udp_sock
description	Listen for incoming communication	rule	network_tcp_listen
description	Communications over Toredo network	rule	network_toredo
description	Communications over P2P network	rule	network_p2p_win
description	Communications over HTTP	rule	network_http

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\97fd00311d\
cmdline	cmd /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\97fd00311d\
cmdline	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\97fd00311d\

Communicates with host for which no DNS query was performed (1 event)

host

217.8.117.207

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) (3 events)

url	http://217.8.117.207/gb2pnjsjcs/plugins/cred.dll
url	http://217.8.117.207/gb2pnjsjcs/plugins/scr.dll
url	http://217.8.117.207/gb2pnjsjcs/index.php

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (2 events)

Time & API	Arguments	Status	Return	Repeated
HttpSendRequestW March 9, 2021, 11:37 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=152138328664&vs=2.06&sd=4773e7&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0		0	0
HttpSendRequestW March 9, 2021, 11:38 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=152138328664&vs=2.06&sd=4773e7&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0		0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

217.8.117.207:80

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader36.25139
MicroWorld-eScan	Gen:Variant.Zusy.329294
FireEye	Generic.mg.b9bf7278d38a66f5
CAT-QuickHeal	Trojan.Bingoml
McAfee	GenericRXAA-AA!B9BF7278D38A
Malwarebytes	Trojan.Amadey
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_60% (D)
Alibaba	TrojanDownloader:Win32/Bingoml.acd84cba
K7GW	Trojan-Downloader ( 00575ca01 )
K7AntiVirus	Trojan-Downloader ( 00575ca01 )
BitDefenderTheta	Gen:NN.ZexaF.34608.luW@aun5h7ai
Cyren	W32/Trojan.HJCW-4179
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:BotX-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.Bingoml.gen
BitDefender	Gen:Variant.Zusy.329294
ViRobot	Trojan.Win32.Z.Zusy.185856.BB
Ad-Aware	Gen:Variant.Zusy.329294
Emsisoft	Trojan-Downloader.Agent (A)
F-Secure	Heuristic.HEUR/AGEN.1116859
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.Win32.AMADEY.SMA
McAfee-GW-Edition	BehavesLike.Win32.Dropper.ch
Sophos	Mal/Generic-S
Paloalto	generic.ml
Jiangmin	TrojanDownloader.Deyma.sn
Avira	HEUR/AGEN.1116859
MAX	malware (ai score=84)
Antiy-AVL	Trojan[Downloader]/Win32.Agent
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Trojan:Win32/Glupteba!ml
AegisLab	Trojan.Win32.Bingoml.4!c
ZoneAlarm	HEUR:Trojan.Win32.Bingoml.gen
GData	Win32.Trojan.Deyma.A
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Trojanspy.R370729
ALYac	Gen:Variant.Zusy.329294
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.FLS
TrendMicro-HouseCall	TrojanSpy.Win32.AMADEY.SMA
Rising	Trojan.Injector!8.C4 (TFE:5:MB7JTjGmRzO)
Yandex	Trojan.Bingoml!jZ/4L+unjoQ
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_96%
Fortinet	W32/Bingoml.FLS!tr
AVG	Win32:BotX-gen [Trj]
Panda	Trj/GdSda.A

a.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All