Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 25, 2024, 10:19 a.m.	July 25, 2024, 10:21 a.m.

Size	2.5MB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {94DF14AB-36C1-4886-A54A-687987508C4D}, Number of Words: 2, Subject: UpdateMSwindows, Author: UpdateMSwindows, Name of Creating Application: UpdateMSwindows, Template: ;1033, Comments: This installer database contains the logic and data required to install UpdateMSwindows., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Tue Jul 23 15:58:05 2024, Last Saved Time/Date: Tue Jul 23 15:58:05 2024, Last Printed: Tue Jul 23 15:58:05 2024, Number of Pages: 450
MD5	`3b48c90d4a283982ced898df9570894b`
SHA256	`3ed535bbcd9d4980ec8bc60cd64804e9c9617b7d88723d3b05e6ad35821c3fe7`
CRC32	`4303BA55`
ssdeep	`49152:6spIfhlTYEO+w2/64hnPRMB0WkuqES58NtvU:dIZlEN+wK6qRMB0WkufF`
Yara	Malicious_Library_Zero - Malicious_Library Microsoft_Office_File_Zero - Microsoft Office File Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\WidowsSystem-update.msi
1440
- MSIC3BC.tmp "C:\Users\test22\AppData\Local\Temp\MSIC3BC.tmp" -pqwerty2023 -s1
  2176
  - SymposiumTaiwan.exe "C:\Users\test22\AppData\Local\Temp\SymposiumTaiwan.exe"
    2476
    - cmd.exe "C:\Windows\System32\cmd.exe" /k copy Open Open.cmd & Open.cmd & exit
      2556
      - tasklist.exe tasklist
        2732
      - findstr.exe findstr /I "wrsa.exe opssvc.exe"
        2772
      - tasklist.exe tasklist
        2912
      - findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
        2976
      - cmd.exe cmd /c md 558563
        3060
      - findstr.exe findstr /V "cbsinchhavefcc" Basketball
        2220
      - cmd.exe cmd /c copy /b Upc + Beverages + Hero + Displaying + Version + Fm + Emotions 558563\k
        2268
      - Dicks.pif 558563\Dicks.pif 558563\k
        2288
      - timeout.exe timeout 5
        2376

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 25, 2024, 10:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2024, 10:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2024, 10:19 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 25, 2024, 10:19 a.m.			0	0
IsDebuggerPresent July 25, 2024, 10:19 a.m.			0	0

Command line console output was observed (50 out of 1569 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: Set console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: Acquisitions=T console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: wrkqTowards console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: Minor Myanmar Lonely Prediction Championships Computing Newsletter Ka console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: 'wrkqTowards' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: zSLRCruise console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: Carb Entry Picked Linux Logical Richard Hire console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: 'zSLRCruise' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: YuKEMessenger console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: 'YuKEMessenger' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: kumIllinois console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: Organizational Cas Worldsex Hotels Owned Supplements Internship console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: 'kumIllinois' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: xSMPending console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: Recognised console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: 'xSMPending' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: NDmcChan console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: Possession console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: 'NDmcChan' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: CbFTsunami console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: Infrared Christian Relatively Depression console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: 'CbFTsunami' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: Set console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: Week=P console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: ZdjPetersburg console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: Encoding Vsnet Lawrence Bunny Grande Lindsay Union console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: 'ZdjPetersburg' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: IEHAuctions console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: Psychiatry Effective Van Moscow Hungry console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: 'IEHAuctions' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: wzBqBookmark console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: Knives Contributed console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: 'wzBqBookmark' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: iVFailed console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: Nw Returned Stephen console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2024, 10:19 a.m.	buffer: 'iVFailed' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 25, 2024, 10:19 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (16 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73de1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73481000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73431000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 1440 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03b40000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03c90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73422000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 1440 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03cd0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03ea0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73351000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75ab1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2024, 10:19 a.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73271000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

msiexec.exe tried to sleep 120 seconds, actually delayed analysis time by 120 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (50 out of 798 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9933774848 free_bytes_available: 9933774848 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2425238 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9038434304 free_bytes_available: 9038434304 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2206649 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9038434304 free_bytes_available: 9038434304 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2206649 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9038434304 free_bytes_available: 9038434304 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2206649 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 25, 2024, 10:19 a.m.	total_number_of_free_bytes: 9005531136 free_bytes_available: 9005531136 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW July 25, 2024, 10:19 a.m.	number_of_free_clusters: 2198616 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\SymposiumTaiwan.exe
file	C:\Users\test22\AppData\Local\Temp\558563\Dicks.pif

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /k copy Open Open.cmd & Open.cmd & exit

Drops an executable to the user AppData folder (4 events)

file	C:\Users\test22\AppData\Local\Temp\MSIC3BC.tmp
file	C:\Users\test22\AppData\Local\Temp\SymposiumTaiwan.exe
file	C:\Users\test22\AppData\Local\Temp\558563\Dicks.pif
file	C:\Users\test22\AppData\Local\Temp\MSIC2BE.tmp

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 25, 2024, 10:19 a.m.	show_type: 0 filepath_r: cmd parameters: /k copy Open Open.cmd & Open.cmd & exit filepath: cmd	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (18 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeTcbPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeBackupPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 25, 2024, 10:19 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (10 events)

description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

tasklist

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\SymposiumTaiwan.exe
file	C:\Users\test22\AppData\Local\Temp\558563\Dicks.pif

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1440 resumed a thread in remote process 2176
Process injection	Process 2556 resumed a thread in remote process 2288
NtResumeThread July 25, 2024, 10:19 a.m.	thread_handle: 0x000002c4 suspend_count: 1 process_identifier: 2176	1	0	0
NtResumeThread July 25, 2024, 10:19 a.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 2288	1	0	0

WidowsSystem-update.msi

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All