Report - ZeroBOX

ScreenShot

Info
Location map


Created	2021.03.09 11:34	Machine	s1_win7_x6402
Filename	13.cry.exe
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
AI Score	3	Behavior Score	6.6
ZERO API	file : malware
VT API (file)	6 detected (malicious, confidence, Static AI, Suspicious PE)
md5	5af074c9bec5f91119e5deac1964207a
sha256	68eb43b8e87657e66f8b25400926f55498bfde185252ee24eb068928d698e90d
ssdeep	12288:rS5JKcaGxxwBwH3OO0RygTljJPSONI4BwrOmKW:rSH/xxxv0MgVJPSWxBwrrKW
imphash	88be6a3f02e620b370d6f4da1dd6d20a
impfuzzy	48:1YStoSjd9aIpcQZJHCSt0GuYD6EqQTRKli3o+09FoZo/KA15QOSkolEPrS5LXN+U:1vtdQIpcQZJHCSt0G5+PxBg5

Network IP location

Signature (18cnts)

Level	Description
watch	Communicates with host for which no DNS query was performed
notice	A process attempted to delay the analysis task.
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice	Checks adapter addresses which can be used to detect virtual network interfaces
notice	Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice	Creates a suspicious process
notice	Creates hidden or system file
notice	File has been identified by 6 AntiVirus engines on VirusTotal as malicious
notice	One or more potentially interesting buffers were extracted
notice	Potentially malicious URLs were found in the process memory dump
notice	Terminates another process
notice	The binary likely contains encrypted or compressed data indicative of a packer
notice	Yara rule detected in process memory
info	Checks if process is being debugged by a debugger
info	One or more processes crashed
info	Queries for the computername
info	This executable has a PDB path

Rules (56cnts)

Level	Name	Description	Collection
notice	Str_Win32_Http_API	Match Windows Http API call	memory
notice	Str_Win32_Internet_API	Match Windows Inet API call	memory
info	anti_dbg	Checks if being debugged	memory
info	antisb_threatExpert	Anti-Sandbox checks for ThreatExpert	memory
info	Check_Dlls	(no description)	memory
info	DebuggerCheck__GlobalFlags	(no description)	memory
info	DebuggerCheck__QueryInfo	(no description)	memory
info	DebuggerCheck__RemoteAPI	(no description)	memory
info	DebuggerException__ConsoleCtrl	(no description)	memory
info	DebuggerException__SetConsoleCtrl	(no description)	memory
info	DebuggerHiding__Active	(no description)	memory
info	DebuggerHiding__Thread	(no description)	memory
info	disable_dep	Bypass DEP	memory
info	IsDLL	(no description)	binaries (upload)
info	IsPE32	(no description)	binaries (upload)
info	OS_Processor_Check_Zero	OS Processor Check Signature Zero	binaries (upload)
info	PE_Header_Zero	PE File Signature Zero	binaries (upload)
info	SEH__vectored	(no description)	memory
info	ThreadControl__Context	(no description)	memory
info	win_hook	Affect hook table	memory
info	create_com_service	Create a COM server	memory
info	create_service	Create a windows service	memory
info	cred_local	Steal credential	memory
info	escalate_priv	Escalade priviledges	memory
info	HasDebugData	DebugData Check	binaries (upload)
info	HasRichSignature	Rich Signature Check	binaries (upload)
info	hijack_network	Hijack network configuration	memory
info	inject_thread	Code injection with CreateRemoteThread in a remote process	memory
info	IsPacked	Entropy Check	binaries (upload)
info	IsWindowsGUI	(no description)	binaries (upload)
info	keylogger	Run a keylogger	memory
info	migrate_apc	APC queue tasks migration	memory
info	network_dga	Communication using dga	memory
info	network_dns	Communications use DNS	memory
info	network_dropper	File downloader/dropper	memory
info	network_ftp	Communications over FTP	memory
info	network_http	Communications over HTTP	memory
info	network_p2p_win	Communications over P2P network	memory
info	network_tcp_listen	Listen for incoming communication	memory
info	network_tcp_socket	Communications over RAW socket	memory
info	network_toredo	Communications over Toredo network	memory
info	network_udp_sock	Communications over UDP network	memory
info	screenshot	Take screenshot	binaries (upload)
info	screenshot	Take screenshot	memory
info	sniff_audio	Record Audio	memory
info	spreading_file	Malware can spread east-west file	memory
info	spreading_share	Malware can spread east-west using share drive	memory
info	Str_Win32_Wininet_Library	Match Windows Inet API library declaration	memory
info	Str_Win32_Winsock2_Library	Match Winsock 2 API library declaration	memory
info	win_files_operation	Affect private profile	binaries (upload)
info	win_files_operation	Affect private profile	memory
info	win_mutex	Create or check mutex	memory
info	win_private_profile	Affect private profile	memory
info	win_registry	Affect system registries	binaries (upload)
info	win_registry	Affect system registries	memory
info	win_token	Affect system token	memory

Network (2cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
123.200.26.246 whois		Link3 Technologies Ltd.	123.200.26.246		mailcious
122.2.28.70 whois		Philippine Long Distance Telephone Company	122.2.28.70		mailcious

Report - 13.cry.exe

Signature (18cnts)

Rules (56cnts)

Network (2cnts) ?

Suricata ids

Similarity measure (PE file only) - Checking for service failure