Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 18, 2023, 9:46 a.m.	Sept. 18, 2023, 9:48 a.m.

Size	14.0MB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 14:06:51 2020, Security: 0, Code page: 1252, Revision Number: {887DC08E-7563-4B0B-B863-26A8DD4ED1C0}, Number of Words: 10, Subject: Forex Strategy Builder Pro, Author: Forex Software Ltd., Name of Creating Application: Forex Strategy Builder Pro, Template: ;1033, Comments: Forex Software Ltd., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Thu Sep 7 13:27:04 2023, Number of Pages: 200
MD5	`452db598b23ac2a6cd0d4d4692f1c438`
SHA256	`396eedecaf60b2cf33e4b54f7eff42ab1d92c26ca9c81f2d1eb0323ca100f737`
CRC32	`7B45F330`
ssdeep	`393216:qohwo064S07VmAEBr2KmWd84QLYDIUc5b29UUENsIJ:Xwo0wAEr2LWi4v3GbCUxsI`
Yara	Malicious_Library_Zero - Malicious_Library CAB_file_format - CAB archive file Microsoft_Office_File_Zero - Microsoft Office File Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\forex.msi
1872
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
leaseagent.xyz	A 172.67.207.124 A 104.21.42.182	104.21.42.182

IP Address	Status	Action
104.21.42.182	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49166 -> 104.21.42.182:80	2046637	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Configuration Request Attempt	Malware Command and Control Activity Detected
TCP 104.21.42.182:80 -> 192.168.56.103:49165	2023668	ET INFO Unconfigured nginx Access	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 18, 2023, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 18, 2023, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2023, 9:46 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 18, 2023, 9:46 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 18, 2023, 9:46 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header

suspicious_request

POST http://leaseagent.xyz/c2conf

Performs some HTTP requests (2 events)

request	GET http://leaseagent.xyz/
request	POST http://leaseagent.xyz/c2conf

Sends data using the HTTP POST Method (1 event)

request

POST http://leaseagent.xyz/c2conf

Allocates read-write-execute memory (usually to unpack itself) (21 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73de1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73481000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75201000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73441000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73421000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73361000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04840000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73352000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:46 a.m.	process_identifier: 1872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ba0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:39 a.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000006840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Sept. 18, 2023, 9:46 a.m.	total_number_of_free_bytes: 9917104128 free_bytes_available: 9917104128 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0
GetDiskFreeSpaceW Sept. 18, 2023, 9:46 a.m.	number_of_free_clusters: 2421168 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1	0

File has been identified by 6 AntiVirus engines on VirusTotal as malicious (6 events)

TrendMicro	TrojanSpy.Win32.LUMMASTEALER.YXDIJZ
McAfee-GW-Edition	Artemis
Ikarus	Virus.ILCrypt
Google	Detected
McAfee	Artemis!548CB3A857E3
Fortinet	W32/PossibleThreat

Checks for the Locally Unique Identifier on the system for a suspicious privilege (16 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Sept. 18, 2023, 9:46 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Sept. 18, 2023, 9:46 a.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1
LookupPrivilegeValueW Sept. 18, 2023, 9:46 a.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1
LookupPrivilegeValueW Sept. 18, 2023, 9:46 a.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1
LookupPrivilegeValueW Sept. 18, 2023, 9:46 a.m.	system_name: privilege_name: SeTcbPrivilege	1	1
LookupPrivilegeValueW Sept. 18, 2023, 9:46 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Sept. 18, 2023, 9:46 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW Sept. 18, 2023, 9:46 a.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW Sept. 18, 2023, 9:46 a.m.	system_name: privilege_name: SeBackupPrivilege	1	1
LookupPrivilegeValueW Sept. 18, 2023, 9:46 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW Sept. 18, 2023, 9:46 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Sept. 18, 2023, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 18, 2023, 9:46 a.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1
LookupPrivilegeValueW Sept. 18, 2023, 9:46 a.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1
LookupPrivilegeValueW Sept. 18, 2023, 9:46 a.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1
LookupPrivilegeValueW Sept. 18, 2023, 9:46 a.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 6efbb6fc158ca58df705f8dc22bfe43004c87bdb
buffer	Buffer with sha1: ee009e61765924d3a9fb3bba730cae344b6529cd

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

forex.msi

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All