Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 16, 2023, 2:02 p.m.	Sept. 16, 2023, 2:04 p.m.

Size	14.1MB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 14:06:51 2020, Security: 0, Code page: 1252, Revision Number: {712FA1FF-5EDD-4B8A-A341-2347CE5946D3}, Number of Words: 10, Subject: Pro Motion NG - V8 Community, Author: cosmigo, Name of Creating Application: Pro Motion NG - V8 Community, Template: ;1033, Comments: cosmigo, Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Thu Sep 14 19:10:25 2023, Number of Pages: 200
MD5	`96d99e6c2e7c358b9d663595d3af5f27`
SHA256	`301432e6053a0f092e8f5137a97ef3543934e0f8e200bd0c7844886e4c72e7e9`
CRC32	`3EF084B1`
ssdeep	`393216:bQcblwAxiRsytVOtSOuySa3/B5Qw0a4/AlwZnb87:lbys0MSOuySuLQPa7gA`
Yara	Malicious_Library_Zero - Malicious_Library CAB_file_format - CAB archive file Microsoft_Office_File_Zero - Microsoft Office File Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\promot_s.msi
1648
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
apps.identrust.com	A 121.254.136.9 CNAME a1952.dscq.akamai.net CNAME identrust.edgesuite.net A 121.254.136.18	23.67.53.17
www.google-analytics.com	A 172.217.24.238	216.239.38.178
www.highmotionsoftware.com	A 104.193.111.101 CNAME highmotionsoftware.com	104.193.111.101
www.bolidesoft.com	CNAME bolidesoft.com A 104.193.111.117	104.193.111.117

IP Address	Status	Action
104.193.111.101	Active	Moloch
104.193.111.117	Active	Moloch
121.254.136.9	Active	Moloch
164.124.101.2	Active	Moloch
172.217.24.238	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49168 -> 172.217.24.238:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49169 -> 104.193.111.101:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49168 172.217.24.238:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1C3	CN=*.google-analytics.com	e6:f7:82:c1:10:ac:08:76:a1:97:70:b7:56:b7:ef:92:30:ba:1e:12
TLSv1 192.168.56.103:49169 104.193.111.101:443	C=US, O=Let's Encrypt, CN=R3	CN=highmotionsoftware.com	6f:a9:b3:c7:07:47:2c:5d:29:21:bd:d5:d6:29:38:66:0c:08:a5:43

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 16, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 16, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 16, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 16, 2023, 2:02 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 16, 2023, 2:02 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (2 events)

request	GET http://apps.identrust.com/roots/dstrootcax3.p7c
request	GET https://www.google-analytics.com/collect?v=1&tid=UA-380480-23&cid=%7B8088027B-4BB6-456E-A8C8-37F4AC853C35%7D&t=event&ec=Session&ea=Start&an=ImBatch&av=7.6.0&ul=en-GB&sr=1024x768&sc=start&z=42773

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73de1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73481000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75201000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73441000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73421000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73361000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ae0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04be0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73352000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 16, 2023, 2:02 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Sept. 16, 2023, 2:02 p.m.	total_number_of_free_bytes: 9919909888 free_bytes_available: 9919909888 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0
GetDiskFreeSpaceW Sept. 16, 2023, 2:02 p.m.	number_of_free_clusters: 2421853 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1	0

File has been identified by 4 AntiVirus engines on VirusTotal as malicious (4 events)

Rising	Trojan.Generic@AI.90 (RDML:4BSI7VQWrlAjlQ6ssGNUhA)
McAfee-GW-Edition	Artemis!Trojan
Google	Detected
Ikarus	Trojan.WjexjofuRAT

Checks for the Locally Unique Identifier on the system for a suspicious privilege (16 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Sept. 16, 2023, 2:02 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Sept. 16, 2023, 2:02 p.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1
LookupPrivilegeValueW Sept. 16, 2023, 2:02 p.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1
LookupPrivilegeValueW Sept. 16, 2023, 2:02 p.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1
LookupPrivilegeValueW Sept. 16, 2023, 2:02 p.m.	system_name: privilege_name: SeTcbPrivilege	1	1
LookupPrivilegeValueW Sept. 16, 2023, 2:02 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Sept. 16, 2023, 2:02 p.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW Sept. 16, 2023, 2:02 p.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW Sept. 16, 2023, 2:02 p.m.	system_name: privilege_name: SeBackupPrivilege	1	1
LookupPrivilegeValueW Sept. 16, 2023, 2:02 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW Sept. 16, 2023, 2:02 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Sept. 16, 2023, 2:02 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 16, 2023, 2:02 p.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1
LookupPrivilegeValueW Sept. 16, 2023, 2:02 p.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1
LookupPrivilegeValueW Sept. 16, 2023, 2:02 p.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1
LookupPrivilegeValueW Sept. 16, 2023, 2:02 p.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 6efbb6fc158ca58df705f8dc22bfe43004c87bdb
buffer	Buffer with sha1: ee009e61765924d3a9fb3bba730cae344b6529cd

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

promot_s.msi

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All