Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 29, 2021, 2:10 p.m.	Oct. 29, 2021, 2:15 p.m.

Size	4.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`aa1966419284a4a503c101bd7db7a2a0`
SHA256	`f192c8762c35c18a863e3e3618f795be91333e4da82c9a2defebf20c27cd36c7`
CRC32	`FE8A999B`
ssdeep	`98304:b1QTjwQbco4u51WEfA0lzrTWuQOeQSe6us:x6wicopzXfA0lzjMQe`
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

pop-up_excel_calendar_setup.exe "C:\Users\test22\AppData\Local\Temp\pop-up_excel_calendar_setup.exe"
1016
- pop-up_excel_calendar_setup.tmp "C:\Users\test22\AppData\Local\Temp\is-LMALK.tmp\pop-up_excel_calendar_setup.tmp" /SL5="$D0240,3719005,851968,C:\Users\test22\AppData\Local\Temp\pop-up_excel_calendar_setup.exe"
  2680
  - UniformSoftInstaller.exe "C:\Program Files (x86)\BoostExcel\Pop-up Excel Calendar\UniformSoftInstaller.exe" /edp
    2408
    - certutil.exe "C:\Windows\system32\certutil.exe" -f -addstore "TrustedPublisher" "C:\Users\test22\AppData\Local\Temp\tmpE817.tmp.cer"
      752
  - regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Program Files (x86)\BoostExcel\Pop-up Excel Calendar\CALMANAG.dll" /s
    2296
  - notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\BoostExcel\Pop-up Excel Calendar\readme.txt
    2944
explorer.exe C:\Windows\Explorer.EXE
1848

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 29, 2021, 2:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 29, 2021, 2:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 29, 2021, 2:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 29, 2021, 2:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 29, 2021, 2:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 29, 2021, 2:11 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 29, 2021, 2:10 p.m.			0	0
IsDebuggerPresent Oct. 29, 2021, 2:11 p.m.			0	0
IsDebuggerPresent Oct. 29, 2021, 2:11 p.m.			0	0
IsDebuggerPresent Oct. 29, 2021, 2:11 p.m.			0	0

Command line console output was observed (3 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 29, 2021, 2:11 p.m.	buffer: TrustedPublisher console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 29, 2021, 2:11 p.m.	buffer: Certificate "CN=Uniform Software Limited, O=Uniform Software Limited, STREET=Churchill House 142-146 Old Street, L=London, S=London, PostalCode=EC1V 9BW, C=GB" added to store. console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 29, 2021, 2:11 p.m.	buffer: CertUtil: -addstore command completed successfully. console_handle: 0x0000000000000007	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 29, 2021, 2:11 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.itext
section	.didata

Allocates read-write-execute memory (usually to unpack itself) (50 out of 60 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 29, 2021, 2:10 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:10 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 688128 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:10 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:10 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 155648 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:10 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x728b2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:10 p.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x728b2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:10 p.m.	process_identifier: 2680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000510000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0e71000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef150b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001ef0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0e72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0e72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0e72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0e72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0e72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0e72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0e72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0e72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0e72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0e72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0e72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0e74000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0e74000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0e74000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef0e74000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe916fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9170c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91820000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91821000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91822000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91823000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91824000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe917ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe917d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe917b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe916fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91825000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91826000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91827000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91828000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 2:11 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9171b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

A process attempted to delay the analysis task. (1 event)

description

explorer.exe tried to sleep 190 seconds, actually delayed analysis time by 190 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW Oct. 29, 2021, 2:10 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 0 root_path: C:\Program Files (x86)\BoostExcel\Pop-up Excel Calendar\ total_number_of_bytes: 70707124072		0
GetDiskFreeSpaceExW Oct. 29, 2021, 2:10 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 0 root_path: C:\Program Files (x86)\BoostExcel\ total_number_of_bytes: 70707124072		0
GetDiskFreeSpaceExW Oct. 29, 2021, 2:10 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 13719932928 root_path: C:\Program Files (x86)\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Oct. 29, 2021, 2:11 p.m.	total_number_of_free_bytes: 13715054592 free_bytes_available: 13715054592 root_path: C:\ total_number_of_bytes: 34252779520	1	1

Creates executable files on the filesystem (3 events)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BoostExcel\Pop-up Excel Calendar\Home Page.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BoostExcel\Pop-up Excel Calendar\Read Me.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BoostExcel\Pop-up Excel Calendar\Uninstall Pop-up Excel Calendar.lnk

Creates a shortcut to an executable file (18 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BoostExcel\Pop-up Excel Calendar\Read Me.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EditPlus.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BoostExcel\Pop-up Excel Calendar\Home Page.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\한컴오피스 한글 2010.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Chrome.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BoostExcel\Pop-up Excel Calendar\Home Page.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\한컴 사전.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BoostExcel\Pop-up Excel Calendar\Uninstall Pop-up Excel Calendar.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BoostExcel\Pop-up Excel Calendar\Uninstall Pop-up Excel Calendar.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BoostExcel\Pop-up Excel Calendar\Read Me.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk

Creates a suspicious process (1 event)

cmdline

"C:\Windows\system32\regsvr32.exe" "C:\Program Files (x86)\BoostExcel\Pop-up Excel Calendar\CALMANAG.dll" /s

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-LMALK.tmp\pop-up_excel_calendar_setup.tmp

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Oct. 29, 2021, 2:11 p.m.	thread_identifier: 2000 thread_handle: 0x0000000000000238 process_identifier: 752 current_directory: C:\Program Files (x86)\BoostExcel\Pop-up Excel Calendar filepath: track: 1 command_line: "C:\Windows\system32\certutil.exe" -f -addstore "TrustedPublisher" "C:\Users\test22\AppData\Local\Temp\tmpE817.tmp.cer" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000234	1	1	0

File has been identified by 3 AntiVirus engines on VirusTotal as malicious (3 events)

APEX	Malicious
Gridinsoft	Malware.Win32.Gen.dd!n
Yandex	Trojan.Slntscn24.bWfT6q

Queries for potentially installed applications (4 events)

Time & API	Arguments	Return
RegOpenKeyExW Oct. 29, 2021, 2:10 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Pop-up Excel Calendar_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pop-up Excel Calendar_is1	2
RegOpenKeyExW Oct. 29, 2021, 2:10 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Pop-up Excel Calendar_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pop-up Excel Calendar_is1	2
RegOpenKeyExW Oct. 29, 2021, 2:10 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Pop-up Excel Calendar_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pop-up Excel Calendar_is1	2
RegOpenKeyExW Oct. 29, 2021, 2:10 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Pop-up Excel Calendar_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000101 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pop-up Excel Calendar_is1	2

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\tmpE817.tmp.cer

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4D3697E12F0E400F340CCDAA4D524803C7C871F0\Blob

pop-up_excel_calendar_setup.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All