Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 2, 2024, 5:18 p.m.	Aug. 2, 2024, 5:20 p.m.

Size	4.5MB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 14:06:51 2020, Security: 0, Code page: 936, Revision Number: {B56F2A10-CFEC-441B-AA58-561FB8D31D6D}, Number of Words: 2, Subject: cftt, Author: MonKeyDu, Name of Creating Application: cftt, Template: ;2052, Comments: Installer cftt , Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Tue Jul 30 01:17:51 2024, Number of Pages: 200
MD5	`f9589d32c6fcbb019e3a95c4be0f4e92`
SHA256	`a5e4c4584de9b3e2203c7840d96e95c22ad9d8dba006c284e86333b135fabe97`
CRC32	`595FCA9A`
ssdeep	`98304:pZ1ZTimM7BflMPzidUtZJntPa+ntWBXm+FFEIRhKbK0Z:5bGBfMDJntPa+tqm+F6IRhK5Z`
Yara	Malicious_Library_Zero - Malicious_Library Antivirus - Contains references to security software Microsoft_Office_File_Zero - Microsoft Office File CAB_file_format - CAB archive file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\%E5%AE%89%E8%A3%85%E5%AF%9F%E7%9C%8B.msi
1792
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
206.238.179.28	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 2, 2024, 5:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 2, 2024, 5:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 2, 2024, 5:18 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 2, 2024, 5:18 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 2, 2024, 5:18 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (14 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 2, 2024, 5:18 p.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2024, 5:18 p.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73de1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2024, 5:18 p.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2024, 5:18 p.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73481000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2024, 5:18 p.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2024, 5:18 p.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2024, 5:18 p.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2024, 5:18 p.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73431000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 5:18 p.m.	process_identifier: 1792 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03c90000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 5:18 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 2, 2024, 5:18 p.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73422000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 5:18 p.m.	process_identifier: 1792 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d90000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 5:18 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03f80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 5:11 p.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000067e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Aug. 2, 2024, 5:18 p.m.	total_number_of_free_bytes: 9932226560 free_bytes_available: 9932226560 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0
GetDiskFreeSpaceW Aug. 2, 2024, 5:18 p.m.	number_of_free_clusters: 2424860 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (16 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Aug. 2, 2024, 5:18 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Aug. 2, 2024, 5:18 p.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1
LookupPrivilegeValueW Aug. 2, 2024, 5:18 p.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1
LookupPrivilegeValueW Aug. 2, 2024, 5:18 p.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1
LookupPrivilegeValueW Aug. 2, 2024, 5:18 p.m.	system_name: privilege_name: SeTcbPrivilege	1	1
LookupPrivilegeValueW Aug. 2, 2024, 5:18 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Aug. 2, 2024, 5:18 p.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW Aug. 2, 2024, 5:18 p.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW Aug. 2, 2024, 5:18 p.m.	system_name: privilege_name: SeBackupPrivilege	1	1
LookupPrivilegeValueW Aug. 2, 2024, 5:18 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW Aug. 2, 2024, 5:18 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Aug. 2, 2024, 5:18 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Aug. 2, 2024, 5:18 p.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1
LookupPrivilegeValueW Aug. 2, 2024, 5:18 p.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1
LookupPrivilegeValueW Aug. 2, 2024, 5:18 p.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1
LookupPrivilegeValueW Aug. 2, 2024, 5:18 p.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1

Communicates with host for which no DNS query was performed (1 event)

host

206.238.179.28

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

206.238.179.28:3036

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

Lionic	Trojan.Win32.ShellcodeRunner.4!c
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.Agent
ALYac	Trojan.Generic.36644513
VIPRE	Trojan.Generic.36644513
Sangfor	Trojan.Win32.Silverfox.ulgyzg
K7AntiVirus	Trojan ( 005b84591 )
K7GW	Trojan ( 005b84591 )
Symantec	W32.Ramnit.B
ESET-NOD32	a variant of Win32/ShellcodeRunner.LN
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	Trojan.Win32.Zapchast.boda
BitDefender	Trojan.Generic.36644513
MicroWorld-eScan	Trojan.Generic.36644513
Rising	Trojan.ShellCodeRunner!1.F986 (CLASSIC)
Emsisoft	Trojan.Generic.36644513 (B)
F-Secure	Trojan.TR/Redcap.qnsva
DrWeb	Trojan.Starter.8277
FireEye	Trojan.Generic.36644513
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Shellcoderunner
Google	Detected
Avira	TR/Zapchast.ielne
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Win32.ShellcodeRunner
Kingsoft	Win32.Troj.RAT.wj
Microsoft	Trojan:Win32/Malgent!MSR
ZoneAlarm	HEUR:Trojan.Win32.DLLhijack.gen
GData	Trojan.Generic.36644513
Varist	ABTrojan.NHYM-
Tencent	Win32.Backdoor.Phish-e.Hflw
Fortinet	W32/ShellcodeRunner.LN!tr
AVG	Win32:MalwareX-gen [Trj]
alibabacloud	Trojan:Win/ShellcodeRunner.LT

%E5%AE%89%E8%A3%85%E5%AF%9F%E7%9C%8B.msi

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All