Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 22, 2021, 6:37 p.m.	March 22, 2021, 6:44 p.m.

Size	9.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`79143f8bb899f89ad0a244017e4934dd`
SHA256	`c1fe973ec51d405df053a593909e50a2f6929e95966557e0b5188861ca983c56`
CRC32	`9BDF52AF`
ssdeep	`196608:5diWhHuOZ9gaOUTEX6Ln714t+zQotTA82laPYOSPQW5RznW:7iaEkCt+zQoG82lAL2QW5Ri`
Yara	PE_Header_Zero - PE File Signature Zero escalate_priv - Escalade priviledges win_registry - Affect system registries win_token - Affect system token win_files_operation - Affect private profile IsPE32 - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check HasOverlay - Overlay Check HasDigitalSignature - DigitalSignature Check borland_delphi - Borland Delphi 2.0 - 7.0 / 2005 - 2007

coohom.exe "C:\Users\test22\AppData\Local\Temp\coohom.exe"
3172
- coohom.tmp "C:\Users\test22\AppData\Local\Temp\is-3SDD2.tmp\coohom.tmp" /SL5="$8201C8,9285237,79360,C:\Users\test22\AppData\Local\Temp\coohom.exe"
  6928
  - cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\ProgramData\uacwev.bat""
    6012
    - timeout.exe TIMEOUT /T 8
      2228
explorer.exe C:\Windows\Explorer.EXE
1848

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA March 22, 2021, 6:37 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 22, 2021, 6:37 p.m.			0	0

Command line console output was observed (38 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: C:\ProgramData> console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: mkdir console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: "\\?\C:\Windows " console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: C:\ProgramData> console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: mkdir console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: "\\?\C:\Windows \System32" console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: C:\ProgramData> console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: copy console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: "C:\Windows\System32\PasswordOnWakeSettingFlyout.exe" "C:\Windows \System32\" console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: The system cannot find the file specified. console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: C:\ProgramData> console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: copy console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: "uxtheme.dll" "C:\Windows \System32\" console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: 1 file(s) copied. console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: C:\ProgramData> console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: "C:\Windows \System32\PasswordOnWakeSettingFlyout.exe" console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: '"C:\Windows \System32\PasswordOnWakeSettingFlyout.exe"' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x000000000000000b	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: C:\ProgramData> console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: echo console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: [-] UAC Bypassed ? console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: [-] UAC Bypassed ? console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: C:\ProgramData> console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: TIMEOUT console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: /T 8 console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: C:\ProgramData> console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: del console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: /s "C:\ProgramData\uxtheme.dll" console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: Deleted file - C:\ProgramData\uxtheme.dll console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: C:\ProgramData> console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: del console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: /s "C:\ProgramData\pass.exe" console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: Deleted file - C:\ProgramData\pass.exe console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: C:\ProgramData> console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: del console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: "C:\ProgramData\uacwev.bat" console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: The batch file cannot be found. console_handle: 0x000000000000000b	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: Waiting for 8 console_handle: 0x0000000000000007	1	1
WriteConsoleW March 22, 2021, 6:30 p.m.	buffer: seconds, press a key to continue ... console_handle: 0x0000000000000007	1	1

Tries to locate where the browsers are installed (1 event)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 22, 2021, 6:37 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 22, 2021, 6:37 p.m.	process_identifier: 3172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2021, 6:37 p.m.	process_identifier: 3172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 53248 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2021, 6:37 p.m.	process_identifier: 3172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00412000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2021, 6:37 p.m.	process_identifier: 3172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 6:37 p.m.	process_identifier: 6928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2021, 6:37 p.m.	process_identifier: 6928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW March 22, 2021, 6:37 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 13287088128 root_path: C:\ProgramData\ total_number_of_bytes: 34252779520	1	1	0

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner.lnk

Creates a shortcut to an executable file (16 events)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\한컴오피스 한글 2010.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EditPlus.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Chrome.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\한컴 사전.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk

Creates a suspicious process (1 event)

cmdline

"C:\Windows\system32\cmd.exe" /C ""C:\ProgramData\uacwev.bat""

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-3SDD2.tmp\coohom.tmp

Queries for potentially installed applications (1 event)

Time & API	Arguments	Status	Return	Repeated
RegOpenKeyExA March 22, 2021, 6:37 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\CCleaner_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000101 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\CCleaner_is1		2	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-3SDD2.tmp\coohom.tmp

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 events)

McAfee	Artemis!79143F8BB899
Zillya	Trojan.RemoteUtilities.Win32.3
Symantec	Trojan.Gen.2
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
Sophos	Generic Reputation PUA (PUA)
DrWeb	BackDoor.RMS.196
McAfee-GW-Edition	Artemis
Gridinsoft	Trojan.Win32.Gen.oa!s1
Microsoft	Trojan:Win32/Wacatac.B!ml
AhnLab-V3	Malware/Gen.Generic.C4342453
Malwarebytes	Trojan.Dropper
ESET-NOD32	multiple detections
Ikarus	Trojan.Win32.RA
AVG	Win32:MalwareX-gen [Trj]

coohom.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All