Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 2, 2021, 4:51 p.m.	April 2, 2021, 4:55 p.m.

Size	112.0KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 09:56:09 2012, Create Time/Date: Fri Sep 21 09:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 11:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0
MD5	`71714c975383be9d962b333987e4eed5`
SHA256	`bf6c679446314890a052275205cdcdbe7987873a648cb2bec25f41e6895de6df`
CRC32	`E6959B50`
ssdeep	`1536:OUET0NTOoq9SlvXyWSNJOMDcKlvLWCvp:OUETwTOdSlvJaNoUvqCB`
Yara	Microsoft_Office_Document_Zero - Microsoft Office Document Signature Zero Antivirus - Contains references to security software

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\cp.msi
112

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.82.216.191	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW April 2, 2021, 4:51 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 2, 2021, 4:51 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 2, 2021, 4:51 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 2, 2021, 4:51 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x725d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 4:51 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 4:51 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72561000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 4:51 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73764000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 4:51 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72562000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 4:51 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72221000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 4:51 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 4:51 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 4:51 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72201000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 4:51 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x721a1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 4:51 p.m.	process_identifier: 112 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c70000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 4:51 p.m.	process_identifier: 112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 4:51 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72192000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 4:51 p.m.	process_identifier: 112 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03840000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 4:51 p.m.	process_identifier: 112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW April 2, 2021, 4:51 p.m.	total_number_of_free_bytes: 13727485952 free_bytes_available: 13727485952 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0
GetDiskFreeSpaceW April 2, 2021, 4:51 p.m.	number_of_free_clusters: 3351437 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (16 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW April 2, 2021, 4:51 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW April 2, 2021, 4:51 p.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1
LookupPrivilegeValueW April 2, 2021, 4:51 p.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1
LookupPrivilegeValueW April 2, 2021, 4:51 p.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1
LookupPrivilegeValueW April 2, 2021, 4:51 p.m.	system_name: privilege_name: SeTcbPrivilege	1	1
LookupPrivilegeValueW April 2, 2021, 4:51 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW April 2, 2021, 4:51 p.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW April 2, 2021, 4:51 p.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW April 2, 2021, 4:51 p.m.	system_name: privilege_name: SeBackupPrivilege	1	1
LookupPrivilegeValueW April 2, 2021, 4:51 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW April 2, 2021, 4:51 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW April 2, 2021, 4:51 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW April 2, 2021, 4:51 p.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1
LookupPrivilegeValueW April 2, 2021, 4:51 p.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1
LookupPrivilegeValueW April 2, 2021, 4:51 p.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1
LookupPrivilegeValueW April 2, 2021, 4:51 p.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1

Communicates with host for which no DNS query was performed (1 event)

host

185.82.216.191

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

McAfee	PWS-FCWQ!FAF58327D10F
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Save.a
Arcabit	Trojan.Generic.D2BDE686
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of Generik.DUGGJEJ
TrendMicro-HouseCall	TROJ_GEN.R002H06CU21
Avast	Win32:Trojan-gen
BitDefender	Trojan.GenericKD.45999750
MicroWorld-eScan	Trojan.GenericKD.45999750
Ad-Aware	Trojan.GenericKD.45999750
Emsisoft	Trojan.GenericKD.45999750 (B)
McAfee-GW-Edition	PWS-FCWQ!FAF58327D10F
FireEye	Trojan.GenericKD.45999750
Sophos	Generic PUA JN (PUA)
Microsoft	Program:Win32/Wacapew.C!ml
AegisLab	Trojan.Win32.Generic.4!c
GData	Trojan.GenericKD.45999750
ALYac	Trojan.GenericKD.45999750
MAX	malware (ai score=82)
Ikarus	Trojan.Win32.Injector
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Generic_PUA_JN
AVG	Win32:Trojan-gen

cp.msi

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All