Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 30, 2024, 9:42 a.m.	May 30, 2024, 9:56 a.m.

Size	252.0KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: LegoBlocks - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com 0.0.0.0, Subject: LegoBlocks - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com, Author: NokSha Games!, Keywords: Installer, Template: x64;1033, Revision Number: {6CA09FD9-918F-4EDD-A9C4-D05F1B6222BD}, Create Time/Date: Thu Jan 11 14:59:38 2024, Last Saved Time/Date: Thu Jan 11 14:59:38 2024, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (11.0.53.0), Security: 2
MD5	`d457ede045732a5c1e1895304d1dc560`
SHA256	`2cf84ed623f2680e8162d7499b9bdab785dad88bfb6fc012717f53c8dfae3dde`
CRC32	`62AA9185`
ssdeep	`3072:+spAtO9mXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8kK:MtO9iRQYpgjpjew5DHyGxcqo8`
Yara	Microsoft_Office_File_Zero - Microsoft Office File Malicious_Library_Zero - Malicious_Library CAB_file_format - CAB archive file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\c2exe.msi
2056

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
3.141.55.131	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW May 30, 2024, 9:42 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 30, 2024, 9:42 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 30, 2024, 9:42 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 30, 2024, 9:42 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2024, 9:42 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73de1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2024, 9:42 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2024, 9:42 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73481000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2024, 9:42 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2024, 9:42 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2024, 9:42 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2024, 9:42 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73431000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2024, 9:42 a.m.	process_identifier: 2056 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03700000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2024, 9:42 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x037f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2024, 9:42 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73422000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2024, 9:42 a.m.	process_identifier: 2056 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03830000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2024, 9:42 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03930000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2024, 9:42 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73351000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2024, 9:42 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75ab1000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW May 30, 2024, 9:42 a.m.	total_number_of_free_bytes: 9933631488 free_bytes_available: 9933631488 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW May 30, 2024, 9:42 a.m.	number_of_free_clusters: 2425203 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW May 30, 2024, 9:42 a.m.	total_number_of_free_bytes: 9933631488 free_bytes_available: 9933631488 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW May 30, 2024, 9:42 a.m.	number_of_free_clusters: 2425203 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (16 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW May 30, 2024, 9:42 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW May 30, 2024, 9:42 a.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1
LookupPrivilegeValueW May 30, 2024, 9:42 a.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1
LookupPrivilegeValueW May 30, 2024, 9:42 a.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1
LookupPrivilegeValueW May 30, 2024, 9:42 a.m.	system_name: privilege_name: SeTcbPrivilege	1	1
LookupPrivilegeValueW May 30, 2024, 9:42 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW May 30, 2024, 9:42 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW May 30, 2024, 9:42 a.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW May 30, 2024, 9:42 a.m.	system_name: privilege_name: SeBackupPrivilege	1	1
LookupPrivilegeValueW May 30, 2024, 9:42 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW May 30, 2024, 9:42 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW May 30, 2024, 9:42 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 30, 2024, 9:42 a.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1
LookupPrivilegeValueW May 30, 2024, 9:42 a.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1
LookupPrivilegeValueW May 30, 2024, 9:42 a.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1
LookupPrivilegeValueW May 30, 2024, 9:42 a.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1

Communicates with host for which no DNS query was performed (1 event)

host

3.141.55.131

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Lionic	Trojan.Win32.ShellCode.3!c
Cynet	Malicious (score: 99)
Skyhigh	Artemis!Trojan
ALYac	Gen:Variant.Jalapeno.2384
VIPRE	Gen:Variant.Jalapeno.2384
Arcabit	Trojan.Jalapeno.D950
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Tiny.GX
McAfee	Artemis!2F4531484FF7
Avast	Win32:ExploitX-gen [Expl]
Kaspersky	HEUR:Exploit.MSIL.ShellCode.gen
BitDefender	Gen:Variant.Jalapeno.2384
NANO-Antivirus	Trojan.Win32.Redcap.klymzz
Rising	Exploit.ShellCode!8.1983E (CLOUD)
Emsisoft	Gen:Variant.Jalapeno.2384 (B)
F-Secure	Trojan.TR/Redcap.ottjd
Zillya	Exploit.ShellCode.Win32.1762
TrendMicro	TROJ_GEN.R023C0XDM24
FireEye	Gen:Variant.Jalapeno.2384
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Tiny
Google	Detected
Avira	TR/Redcap.ottjd
Antiy-AVL	Trojan[Exploit]/MSIL.ShellCode
Kingsoft	MSIL.Exploit.ShellCode.gen
Microsoft	Program:Win32/Wacapew.C!ml
ZoneAlarm	HEUR:Exploit.MSIL.ShellCode.gen
GData	Gen:Variant.Jalapeno.2384
Varist	W32/ABRisk.TMLB-1102
AhnLab-V3	Malware/Win.ExploitX-gen.C5612546
Tencent	Malware.Win32.Gencirc.1408feb4
MAX	malware (ai score=89)
Fortinet	PossibleThreat
AVG	Win32:ExploitX-gen [Expl]
alibabacloud	Malware

c2exe.msi

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All