Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

t.msi

Generic Malware Admin Tool (Sysinternals etc ...) MSOffice File

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 1, 2021, 8:01 a.m.	Oct. 1, 2021, 8:03 a.m.

Size	172.0KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 09:56:09 2012, Create Time/Date: Fri Sep 21 09:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 11:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0
MD5	`b5748cd7d495d76fb3293cf4da83632f`
SHA256	`123d349c756450a3a224ae1fbd91910223c2338438b60f9373c4ef56c6d5b951`
CRC32	`DD7E4DDB`
ssdeep	`1536:9E68dfFdEagURiz1PBq2syei1muDZad+ZVXExHpX30NBbNwrKle8pJr85BB:9E687Mtfq2XZjkwZVcJ30XOKleOO`
Yara	Admin_Tool_IN_Zero - Admin Tool Sysinternals Generic_Malware_Zero - Generic Malware Microsoft_Office_File_Zero - Microsoft Office File

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\t.msi
2232
explorer.exe C:\Windows\Explorer.EXE
1848

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Oct. 1, 2021, 8:01 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameA Oct. 1, 2021, 8:02 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Oct. 1, 2021, 8:02 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 1, 2021, 8:01 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 1, 2021, 8:01 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 1, 2021, 8:01 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x725d1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 1, 2021, 8:01 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c71000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 1, 2021, 8:01 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72561000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 1, 2021, 8:01 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73764000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 1, 2021, 8:01 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72562000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 1, 2021, 8:01 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x723d1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 1, 2021, 8:01 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 1, 2021, 8:01 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 1, 2021, 8:01 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x723b1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 1, 2021, 8:01 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72351000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 1, 2021, 8:01 a.m.	process_identifier: 2232 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03950000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 1, 2021, 8:01 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 1, 2021, 8:01 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72342000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 1, 2021, 8:01 a.m.	process_identifier: 2232 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x035c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 1, 2021, 8:01 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x035c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Oct. 1, 2021, 8:01 a.m.	total_number_of_free_bytes: 13728477184 free_bytes_available: 13728477184 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0
GetDiskFreeSpaceW Oct. 1, 2021, 8:01 a.m.	number_of_free_clusters: 3351679 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1	0

File has been identified by 9 AntiVirus engines on VirusTotal as malicious (9 events)

McAfee	Artemis!5AEC1B432FE3
Sangfor	Trojan.Win32.Save.a
BitDefenderTheta	Gen:NN.ZevbaF.34170.jm0@aad8rbai
Kaspersky	UDS:Trojan.Win32.Mucc
McAfee-GW-Edition	Artemis
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Ikarus	Trojan.VB.Crypt
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	MSOffice/NetWire.7B36!tr

Checks for the Locally Unique Identifier on the system for a suspicious privilege (16 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 1, 2021, 8:01 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1	0
LookupPrivilegeValueW Oct. 1, 2021, 8:01 a.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1	0
LookupPrivilegeValueW Oct. 1, 2021, 8:01 a.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1	0
LookupPrivilegeValueW Oct. 1, 2021, 8:01 a.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1	0
LookupPrivilegeValueW Oct. 1, 2021, 8:01 a.m.	system_name: privilege_name: SeTcbPrivilege	1	1	0
LookupPrivilegeValueW Oct. 1, 2021, 8:01 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1	0
LookupPrivilegeValueW Oct. 1, 2021, 8:01 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1	0
LookupPrivilegeValueW Oct. 1, 2021, 8:01 a.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1	0
LookupPrivilegeValueW Oct. 1, 2021, 8:01 a.m.	system_name: privilege_name: SeBackupPrivilege	1	1	0
LookupPrivilegeValueW Oct. 1, 2021, 8:01 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1	0
LookupPrivilegeValueW Oct. 1, 2021, 8:01 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1	0
LookupPrivilegeValueW Oct. 1, 2021, 8:01 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Oct. 1, 2021, 8:01 a.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1	0
LookupPrivilegeValueW Oct. 1, 2021, 8:01 a.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1	0
LookupPrivilegeValueW Oct. 1, 2021, 8:01 a.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1	0
LookupPrivilegeValueW Oct. 1, 2021, 8:01 a.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1	0