Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 5, 2024, 9:51 a.m.	Aug. 5, 2024, 9:53 a.m.

Size	2.9MB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: AteraAgent, Author: Atera networks, Keywords: Installer, Comments: This installer database contains the logic and data required to install AteraAgent., Template: Intel;1033, Revision Number: {721AD955-79FD-4019-BBF5-9DCC4C1175BB}, Create Time/Date: Wed Feb 28 10:52:02 2024, Last Saved Time/Date: Wed Feb 28 10:52:02 2024, Number of Pages: 200, Number of Words: 6, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
MD5	`7058eef2fba6a8bf7944a23cc5f03886`
SHA256	`20fc6c87397964bb1536e15a6e762fc3749d66040f22808bf644b348069109e8`
CRC32	`527C1EE7`
ssdeep	`49152:h+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:h+lUlz9FKbsodq0YaH7ZPxMb8tT`
Yara	Malicious_Library_Zero - Malicious_Library Microsoft_Office_File_Zero - Microsoft Office File CAB_file_format - CAB archive file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\Guidelines_for_Citizen_Safety.msi
2548
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
ps.pndsn.com	A 18.179.18.153 A 18.179.18.155	18.179.18.154
cacerts.digicert.com	CNAME fp2e7a.wpc.2be4.phicdn.net CNAME fp2e7a.wpc.phicdn.net A 152.195.38.76	152.195.38.76
ocsp.digicert.com	CNAME ocsp.edge.digicert.com CNAME fp2e7a.wpc.2be4.phicdn.net CNAME fp2e7a.wpc.phicdn.net A 152.195.38.76	152.195.38.76
ps.atera.com	A 18.67.51.104 CNAME d25btwd9wax8gu.cloudfront.net A 18.67.51.98 A 18.67.51.59 A 18.67.51.102	18.67.51.59
agent-api.atera.com	CNAME agentsapi.trafficmanager.net CNAME agentapigateway-us.centralus.cloudapp.azure.com A 20.37.139.187	20.37.139.187

IP Address	Status	Action
152.195.38.76	Active	Moloch
164.124.101.2	Active	Moloch
18.179.18.155	Active	Moloch
18.67.51.104	Active	Moloch
20.37.139.187	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49170 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49162 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49171 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49178 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49177 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49167 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49172 -> 18.179.18.155:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49169 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49188 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49181 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49173 -> 18.179.18.155:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49175 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49182 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49176 -> 18.67.51.104:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49174 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49185 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49180 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49195 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49189 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49197 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49190 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49199 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49203 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49193 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49200 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49184 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49201 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49191 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49183 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49198 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49186 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49187 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49192 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49202 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49204 -> 20.37.139.187:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.101:49162 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49171 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49178 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49177 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49167 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49169 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49172 18.179.18.155:443	C=US, O=Amazon, CN=Amazon RSA 2048 M03	CN=*.pndsn.com	07:65:65:eb:fc:cb:2f:15:d8:c5:59:76:15:ef:f9:0b:d7:45:77:3f
TLS 1.2 192.168.56.101:49188 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49170 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49181 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49173 18.179.18.155:443	C=US, O=Amazon, CN=Amazon RSA 2048 M03	CN=*.pndsn.com	07:65:65:eb:fc:cb:2f:15:d8:c5:59:76:15:ef:f9:0b:d7:45:77:3f
TLS 1.2 192.168.56.101:49175 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49182 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49174 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49185 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49176 18.67.51.104:443	C=US, O=Amazon, CN=Amazon RSA 2048 M02	CN=ps.atera.com	17:96:ac:89:29:aa:f5:b7:7e:8c:7e:d9:cf:00:0f:8c:5b:2e:f6:cc
TLS 1.2 192.168.56.101:49180 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49195 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49189 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49197 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49190 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49199 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49203 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49193 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49200 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49184 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49201 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49191 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49183 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49198 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49186 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49187 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49192 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad
TLS 1.2 192.168.56.101:49202 20.37.139.187:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1	CN=*.atera.com	e4:80:61:96:ed:3c:73:9e:df:fd:66:a0:e4:af:c2:b9:14:d6:20:ad

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 5, 2024, 9:51 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 5, 2024, 9:51 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 5, 2024, 9:51 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 5, 2024, 9:51 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 5, 2024, 9:51 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (10 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=cf65c790-3bba-4a64-9937-f36220f6c218&uuid=55038c67-569f-4d99-8a57-744508033a9a
suspicious_features	GET method with no useragent header	suspicious_request	GET https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/55038c67-569f-4d99-8a57-744508033a9a/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=b5e04d33-6bf0-42c4-8e59-52ccdb41e3db&tt=0&uuid=55038c67-569f-4d99-8a57-744508033a9a
suspicious_features	GET method with no useragent header	suspicious_request	GET https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=e9e7b332-e51c-4aa0-a801-d87c8acbcc8a&uuid=55038c67-569f-4d99-8a57-744508033a9a
suspicious_features	GET method with no useragent header	suspicious_request	GET https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/55038c67-569f-4d99-8a57-744508033a9a/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=702fbf86-0fa7-4934-b774-f6bcb0b8b572&tr=36&tt=17228191021137080&uuid=55038c67-569f-4d99-8a57-744508033a9a
suspicious_features	GET method with no useragent header	suspicious_request	GET https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=acca9136-a599-4cb0-ad20-a7cb3388de77&uuid=55038c67-569f-4d99-8a57-744508033a9a
suspicious_features	GET method with no useragent header	suspicious_request	GET https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/55038c67-569f-4d99-8a57-744508033a9a/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=ad327499-f709-4137-84e5-53afcd35656e&tr=36&tt=17228191047232239&uuid=55038c67-569f-4d99-8a57-744508033a9a
suspicious_features	GET method with no useragent header	suspicious_request	GET https://ps.atera.com/agentpackagesnet45/AgentPackageAgentInformation/37.2/AgentPackageAgentInformation.zip?IaYiaqQ9y9o8b7g3EnJ8yVxQedXylv6S7z7zWYWmLKBc3BStISV4S61La6VNNgx5
suspicious_features	GET method with no useragent header	suspicious_request	GET https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=79383a77-1246-4ab7-add1-a742496ba2f9&uuid=55038c67-569f-4d99-8a57-744508033a9a
suspicious_features	GET method with no useragent header	suspicious_request	GET https://ps.pndsn.com/v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/55038c67-569f-4d99-8a57-744508033a9a/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=e494ecc6-7d5c-4596-adb2-e9b303d7c1a2&uuid=55038c67-569f-4d99-8a57-744508033a9a
suspicious_features	GET method with no useragent header	suspicious_request	GET https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=ca859d8d-9d89-4015-8fa6-99b7cf72a1f8&uuid=55038c67-569f-4d99-8a57-744508033a9a

Performs some HTTP requests (15 events)

request	GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
request	GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
request	GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAooSZl45YmN9AojjrilUug%3D
request	GET http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
request	GET http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
request	GET https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=cf65c790-3bba-4a64-9937-f36220f6c218&uuid=55038c67-569f-4d99-8a57-744508033a9a
request	GET https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/55038c67-569f-4d99-8a57-744508033a9a/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=b5e04d33-6bf0-42c4-8e59-52ccdb41e3db&tt=0&uuid=55038c67-569f-4d99-8a57-744508033a9a
request	GET https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=e9e7b332-e51c-4aa0-a801-d87c8acbcc8a&uuid=55038c67-569f-4d99-8a57-744508033a9a
request	GET https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/55038c67-569f-4d99-8a57-744508033a9a/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=702fbf86-0fa7-4934-b774-f6bcb0b8b572&tr=36&tt=17228191021137080&uuid=55038c67-569f-4d99-8a57-744508033a9a
request	GET https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=acca9136-a599-4cb0-ad20-a7cb3388de77&uuid=55038c67-569f-4d99-8a57-744508033a9a
request	GET https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/55038c67-569f-4d99-8a57-744508033a9a/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=ad327499-f709-4137-84e5-53afcd35656e&tr=36&tt=17228191047232239&uuid=55038c67-569f-4d99-8a57-744508033a9a
request	GET https://ps.atera.com/agentpackagesnet45/AgentPackageAgentInformation/37.2/AgentPackageAgentInformation.zip?IaYiaqQ9y9o8b7g3EnJ8yVxQedXylv6S7z7zWYWmLKBc3BStISV4S61La6VNNgx5
request	GET https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=79383a77-1246-4ab7-add1-a742496ba2f9&uuid=55038c67-569f-4d99-8a57-744508033a9a
request	GET https://ps.pndsn.com/v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/55038c67-569f-4d99-8a57-744508033a9a/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=e494ecc6-7d5c-4596-adb2-e9b303d7c1a2&uuid=55038c67-569f-4d99-8a57-744508033a9a
request	GET https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=ca859d8d-9d89-4015-8fa6-99b7cf72a1f8&uuid=55038c67-569f-4d99-8a57-744508033a9a

Allocates read-write-execute memory (usually to unpack itself) (25 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73951000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ac4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b02000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72761000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75831000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72701000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72631000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03910000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03930000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72622000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03f60000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04060000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 5, 2024, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75511000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 5, 2024, 9:45 a.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000046e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW Aug. 5, 2024, 9:51 a.m.	total_number_of_free_bytes: 13321392128 free_bytes_available: 13321392128 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Aug. 5, 2024, 9:51 a.m.	number_of_free_clusters: 3252293 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Aug. 5, 2024, 9:51 a.m.	total_number_of_free_bytes: 13321392128 free_bytes_available: 13321392128 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Aug. 5, 2024, 9:51 a.m.	number_of_free_clusters: 3252293 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (16 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Aug. 5, 2024, 9:51 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Aug. 5, 2024, 9:51 a.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1
LookupPrivilegeValueW Aug. 5, 2024, 9:51 a.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1
LookupPrivilegeValueW Aug. 5, 2024, 9:51 a.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1
LookupPrivilegeValueW Aug. 5, 2024, 9:51 a.m.	system_name: privilege_name: SeTcbPrivilege	1	1
LookupPrivilegeValueW Aug. 5, 2024, 9:51 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Aug. 5, 2024, 9:51 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW Aug. 5, 2024, 9:51 a.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW Aug. 5, 2024, 9:51 a.m.	system_name: privilege_name: SeBackupPrivilege	1	1
LookupPrivilegeValueW Aug. 5, 2024, 9:51 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW Aug. 5, 2024, 9:51 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Aug. 5, 2024, 9:51 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Aug. 5, 2024, 9:51 a.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1
LookupPrivilegeValueW Aug. 5, 2024, 9:51 a.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1
LookupPrivilegeValueW Aug. 5, 2024, 9:51 a.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1
LookupPrivilegeValueW Aug. 5, 2024, 9:51 a.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 015b5f953d6ffe1926c8f9bcd0e109ad91cfc6c8
buffer	Buffer with sha1: 73e0a81707960cc3ccb5dccef4cbb6cd51ee3710

File has been identified by 10 AntiVirus engines on VirusTotal as malicious (10 events)

Skyhigh	RemAdm-Atera
K7AntiVirus	Trojan ( 0001140e1 )
K7GW	Trojan ( 0001140e1 )
McAfee	RemAdm-Atera
Kaspersky	not-a-virus:HEUR:RemoteAdmin.MSIL.Atera.gen
DrWeb	Program.RemoteAdminNET.1
Google	Detected
Xcitium	ApplicUnwnt@#2s9re1zdfn0go
ZoneAlarm	not-a-virus:HEUR:RemoteAdmin.MSIL.Atera.gen
Varist	W32/Atera.KNVS-6994

Guidelines_for_Citizen_Safety.msi

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All