popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

12.msi

MSOffice File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 12, 2021, 10:47 a.m. Aug. 12, 2021, 10:50 a.m.
Size 328.0KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 09:56:09 2012, Create Time/Date: Fri Sep 21 09:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 11:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0
MD5 300db1ac0bba0b2e9904738e1607f279
SHA256 585eab5404dde6b1084ccd144d2c90fd433d7ad7b68de82afe123f8191e6b878
CRC32 83DB51D0
ssdeep 3072:eEdtx/sU1FSTiAO8sW8J7M1toTq+ucbwk/AAjhJmgbemXiJl6NDV:eEbxQ8J7M1+u2XzhXKmo6
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File

Name Response Post-Analysis Lookup
netcbin.info
A 185.225.19.137
185.225.19.137
IP Address Status Action
164.124.101.2 Active Moloch
179.43.173.14 Active Moloch
185.225.19.137 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49201 -> 185.225.19.137:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49201
185.225.19.137:443 		C=US, O=Let's Encrypt, CN=R3 CN=netcbin.info f8:ef:c3:29:e4:d9:fa:4c:a8:cb:c3:59:87:ba:69:5e:05:39:12:a5

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET https://netcbin.info/August_lpIeHgg240.bin
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x725d1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c71000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72561000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73764000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72562000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x723d1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x736e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732d1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x723b1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72351000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03ab0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03bf0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72342000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03c30000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03d70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13726347264
free_bytes_available: 13726347264
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 3351159
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: C:\
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13725753344
free_bytes_available: 13725753344
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0
Sangfor Trojan.Win32.Save.a
ESET-NOD32 a variant of Win32/GenKryptik.FIVI
TrendMicro-HouseCall Cryp_Banker17
TrendMicro Cryp_Banker17
Microsoft Trojan:Win32/Sabsik.FL.B!ml
MaxSecure Trojan.Malware.121218.susgen
Fortinet MSOffice/NetWire.7B36!tr
BitDefenderTheta Gen:NN.ZevbaF.34058.tm0@a041QynG
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeCreateTokenPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeAssignPrimaryTokenPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeMachineAccountPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeTcbPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeTakeOwnershipPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeLoadDriverPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeBackupPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeRestorePrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeRemoteShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeEnableDelegationPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeManageVolumePrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeCreateGlobalPrivilege
1 1 0
host 179.43.173.14
dead_host 192.168.56.101:49222
dead_host 192.168.56.101:49202
dead_host 192.168.56.101:49231
dead_host 192.168.56.101:49211
dead_host 192.168.56.101:49206
dead_host 192.168.56.101:49219
dead_host 192.168.56.101:49215
dead_host 192.168.56.101:49223
dead_host 192.168.56.101:49224
dead_host 192.168.56.101:49207
dead_host 192.168.56.101:49228
dead_host 192.168.56.101:49208
dead_host 179.43.173.14:1220
dead_host 192.168.56.101:49216
dead_host 192.168.56.101:49212
dead_host 192.168.56.101:49225
dead_host 192.168.56.101:49220
dead_host 192.168.56.101:49229
dead_host 192.168.56.101:49209
dead_host 192.168.56.101:49204
dead_host 192.168.56.101:49217
dead_host 192.168.56.101:49213
dead_host 192.168.56.101:49226
dead_host 192.168.56.101:49221
dead_host 192.168.56.101:49230
dead_host 192.168.56.101:49210
dead_host 192.168.56.101:49218
dead_host 192.168.56.101:49214
dead_host 192.168.56.101:49227