Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 25, 2024, 10:18 a.m.	July 25, 2024, 10:21 a.m.

Size	2.5MB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {CD04E684-BF78-4D49-9946-703F8141C499}, Number of Words: 2, Subject: office365crowndStrike, Author: office365crowndStrike, Name of Creating Application: office365crowndStrike, Template: ;1033, Comments: This installer database contains the logic and data required to install office365crowndStrike., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Tue Jul 23 15:56:49 2024, Last Saved Time/Date: Tue Jul 23 15:56:49 2024, Last Printed: Tue Jul 23 15:56:49 2024, Number of Pages: 450
MD5	`8a9baf0bf2ffabd39007a630a430a29b`
SHA256	`aca54f9f5398342566e02470854aff48c53659be0c0cb83d3ce1fd05430375f8`
CRC32	`C1425759`
ssdeep	`49152:rXSIfhlTYEO+w2/64hnPRMB0WkuqES58NtvU:GIZlEN+wK6qRMB0WkufF`
Yara	Malicious_Library_Zero - Malicious_Library Microsoft_Office_File_Zero - Microsoft Office File Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\office365crowndStrike.msi
3048
- MSI278C.tmp "C:\Users\test22\AppData\Local\Temp\MSI278C.tmp" -pqwerty2023 -s1
  2312
  - SymposiumTaiwan.exe "C:\Users\test22\AppData\Local\Temp\SymposiumTaiwan.exe"
    240
    - cmd.exe "C:\Windows\System32\cmd.exe" /k copy Open Open.cmd & Open.cmd & exit
      1020
      - tasklist.exe tasklist
        2128
      - findstr.exe findstr /I "wrsa.exe opssvc.exe"
        2652
      - tasklist.exe tasklist
        2836
      - findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
        2896
      - cmd.exe cmd /c md 558563
        2032
      - findstr.exe findstr /V "cbsinchhavefcc" Basketball
        1784
      - cmd.exe cmd /c copy /b Upc + Beverages + Hero + Displaying + Version + Fm + Emotions 558563\k
        296
      - Dicks.pif 558563\Dicks.pif 558563\k
        832
      - timeout.exe timeout 5
        2404

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 25, 2024, 10:18 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2024, 10:18 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2024, 10:18 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 25, 2024, 10:18 a.m.			0	0
IsDebuggerPresent July 25, 2024, 10:18 a.m.			0	0

Command line console output was observed (50 out of 1569 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: Set console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: Acquisitions=T console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: wrkqTowards console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: Minor Myanmar Lonely Prediction Championships Computing Newsletter Ka console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: 'wrkqTowards' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: zSLRCruise console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: Carb Entry Picked Linux Logical Richard Hire console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: 'zSLRCruise' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: YuKEMessenger console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: 'YuKEMessenger' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: kumIllinois console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: Organizational Cas Worldsex Hotels Owned Supplements Internship console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: 'kumIllinois' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: xSMPending console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: Recognised console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: 'xSMPending' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: NDmcChan console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: Possession console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: 'NDmcChan' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: CbFTsunami console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: Infrared Christian Relatively Depression console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: 'CbFTsunami' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: Set console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: Week=P console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: ZdjPetersburg console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: Encoding Vsnet Lawrence Bunny Grande Lindsay Union console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: 'ZdjPetersburg' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: IEHAuctions console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: Psychiatry Effective Van Moscow Hungry console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: 'IEHAuctions' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: wzBqBookmark console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: Knives Contributed console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: 'wzBqBookmark' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: iVFailed console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: Nw Returned Stephen console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:18 a.m.	buffer: 'iVFailed' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 25, 2024, 10:18 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (23 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b93000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x730d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73861000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73841000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737d1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x040e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04200000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x730c2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04240000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04390000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ff1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75be1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72f71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b93000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:18 a.m.	process_identifier: 832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b12000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

msiexec.exe tried to sleep 120 seconds, actually delayed analysis time by 120 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (50 out of 786 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW July 25, 2024, 10:18 a.m.	total_number_of_free_bytes: 9122770944 free_bytes_available: 9122770944 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:18 a.m.	number_of_free_clusters: 2227239 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:18 a.m.	total_number_of_free_bytes: 8225587200 free_bytes_available: 8225587200 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:18 a.m.	number_of_free_clusters: 2008200 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:18 a.m.	total_number_of_free_bytes: 8225587200 free_bytes_available: 8225587200 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:18 a.m.	number_of_free_clusters: 2008200 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:18 a.m.	total_number_of_free_bytes: 8225587200 free_bytes_available: 8225587200 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:18 a.m.	number_of_free_clusters: 2008200 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 8190803968 free_bytes_available: 8190803968 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 1999708 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\SymposiumTaiwan.exe
file	C:\Users\test22\AppData\Local\Temp\558563\Dicks.pif

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /k copy Open Open.cmd & Open.cmd & exit

Drops an executable to the user AppData folder (4 events)

file	C:\Users\test22\AppData\Local\Temp\SymposiumTaiwan.exe
file	C:\Users\test22\AppData\Local\Temp\558563\Dicks.pif
file	C:\Users\test22\AppData\Local\Temp\MSI269D.tmp
file	C:\Users\test22\AppData\Local\Temp\MSI278C.tmp

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 25, 2024, 10:18 a.m.	show_type: 0 filepath_r: cmd parameters: /k copy Open Open.cmd & Open.cmd & exit filepath: cmd	1	1	0

File has been identified by 3 AntiVirus engines on VirusTotal as malicious (3 events)

ESET-NOD32	NSIS/Runner.T
ClamAV	Win.Trojan.DarkKomet-10027799-0
Gridinsoft	Spy.U.Gen.tr

Checks for the Locally Unique Identifier on the system for a suspicious privilege (18 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeTcbPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeBackupPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:18 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (10 events)

description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

tasklist

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\SymposiumTaiwan.exe
file	C:\Users\test22\AppData\Local\Temp\558563\Dicks.pif

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3048 resumed a thread in remote process 2312
Process injection	Process 1020 resumed a thread in remote process 832
NtResumeThread July 25, 2024, 10:18 a.m.	thread_handle: 0x00000310 suspend_count: 1 process_identifier: 2312	1	0	0
NtResumeThread July 25, 2024, 10:18 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 832	1	0	0

office365crowndStrike.msi

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All