Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 19, 2024, 10:23 a.m.	Sept. 19, 2024, 10:37 a.m.

Size	3.7MB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 14:06:51 2020, Security: 0, Code page: 1252, Revision Number: {32B03926-9B26-4EC3-A6F4-B71EF2E0538F}, Number of Words: 2, Subject: QuickBooks Desktop Download, Author: lntuitInc., Name of Creating Application: QuickBooks Desktop Download, Template: ;1033, Comments: This installer database contains the logic and data required to install QuickBooks Desktop Download., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
MD5	`675d05c2a81ec2148a6181ad1c60813d`
SHA256	`90dd27602fdfd90c7390056676aa5636003b34895e80a946794af36cf596cd36`
CRC32	`5A67C3A4`
ssdeep	`98304:1Yk8Y7sDAi/5GCyJL81ojocVtpQIxcknkmLoLbKxc7fUi:BGeL81oEcjdc/mEVQi`
Yara	Malicious_Library_Zero - Malicious_Library Microsoft_Office_File_Zero - Microsoft Office File CAB_file_format - CAB archive file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\QuickBooks_Desktop_Setup.msi
2560
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
117.18.232.200	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 23.207.173.206:443 -> 192.168.56.101:49176	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49180 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49175 -> 23.207.173.206:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 117.18.232.200:443 -> 192.168.56.101:49184	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49174 -> 23.207.173.206:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 117.18.232.200:443 -> 192.168.56.101:49185	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49182 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49183 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49181 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 23.207.173.206:443 -> 192.168.56.101:49177	2260001	SURICATA Applayer Wrong direction first Data	Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 19, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 19, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 19, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 19, 2024, 10:23 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 19, 2024, 10:23 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 19, 2024, 10:23 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x75c5374b DllDebugObjectRPCHook+0x108 HACCEL_UserFree-0x5 ole32+0x13f777 @ 0x747ff777 NdrPointerFree+0x1b9 IUnknown_Release_Proxy-0xb rpcrt4+0x3419a @ 0x75c6419a NdrClientCall2+0x118 RpcAsyncInitializeHandle-0xf1 rpcrt4+0xb011d @ 0x75ce011d WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x747fc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x746f98ad CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x746fb641 CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x746fb5ed CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x746fb172 CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x746fa66e StgOpenStorage+0x14f2 CoSetProxyBlanket-0x1a5 ole32+0x15d00 @ 0x746d5d00 StgOpenStorage+0x14d3 CoSetProxyBlanket-0x1c4 ole32+0x15ce1 @ 0x746d5ce1 StgOpenStorage+0x1531 CoSetProxyBlanket-0x166 ole32+0x15d3f @ 0x746d5d3f SetErrorInfo+0x70f CoRevokeInitializeSpy-0x802 ole32+0x48f82 @ 0x74708f82 SetErrorInfo+0x650 CoRevokeInitializeSpy-0x8c1 ole32+0x48ec3 @ 0x74708ec3 PropVariantCopy+0xfe CoFreeAllLibraries-0x2406 ole32+0x3bac3 @ 0x746fbac3 SetErrorInfo+0x75 CoRevokeInitializeSpy-0xe9c ole32+0x488e8 @ 0x747088e8 New_ole32_CoUninitialize@0+0x55 New_ole32_OleConvertOLESTREAMToIStorage@12-0x58 @ 0x73275180 MsiSetOfflineContextW+0x898a6 msi+0x161bab @ 0x735c1bab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80070005 exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 70184968 registers.edi: 1953561104 registers.eax: 70184968 registers.ebp: 70185048 registers.edx: 0 registers.ebx: 6788124 registers.esi: 2147942405 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 19, 2024, 10:23 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x75c5374b
DllDebugObjectRPCHook+0x108 HACCEL_UserFree-0x5 ole32+0x13f777 @ 0x747ff777
NdrPointerFree+0x1b9 IUnknown_Release_Proxy-0xb rpcrt4+0x3419a @ 0x75c6419a
NdrClientCall2+0x118 RpcAsyncInitializeHandle-0xf1 rpcrt4+0xb011d @ 0x75ce011d
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x747fc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x746f98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x746fb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x746fb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x746fb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x746fa66e
StgOpenStorage+0x14f2 CoSetProxyBlanket-0x1a5 ole32+0x15d00 @ 0x746d5d00
StgOpenStorage+0x14d3 CoSetProxyBlanket-0x1c4 ole32+0x15ce1 @ 0x746d5ce1
StgOpenStorage+0x1531 CoSetProxyBlanket-0x166 ole32+0x15d3f @ 0x746d5d3f
SetErrorInfo+0x70f CoRevokeInitializeSpy-0x802 ole32+0x48f82 @ 0x74708f82
SetErrorInfo+0x650 CoRevokeInitializeSpy-0x8c1 ole32+0x48ec3 @ 0x74708ec3
PropVariantCopy+0xfe CoFreeAllLibraries-0x2406 ole32+0x3bac3 @ 0x746fbac3
SetErrorInfo+0x75 CoRevokeInitializeSpy-0xe9c ole32+0x488e8 @ 0x747088e8
New_ole32_CoUninitialize@0+0x55 New_ole32_OleConvertOLESTREAMToIStorage@12-0x58 @ 0x73275180
MsiSetOfflineContextW+0x898a6 msi+0x161bab @ 0x735c1bab
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x80070005
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 70184968
registers.edi: 1953561104
registers.eax: 70184968
registers.ebp: 70185048
registers.edx: 0
registers.ebx: 6788124
registers.esi: 2147942405
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (2 events)

request	GET http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.8&processName=lntuit.exe&platform=0009&osver=5&isServer=0
request	GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml

Allocates read-write-execute memory (usually to unpack itself) (25 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73951000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ac4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b02000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72761000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75831000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72701000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72631000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04530000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04620000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72622000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04660000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 10:23 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75511000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 19, 2024, 10:17 a.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (50 out of 80 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318934528 free_bytes_available: 13318934528 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251693 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318934528 free_bytes_available: 13318934528 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251693 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318934528 free_bytes_available: 13318934528 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251693 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318934528 free_bytes_available: 13318934528 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251693 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318934528 free_bytes_available: 13318934528 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251693 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318934528 free_bytes_available: 13318934528 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251693 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318934528 free_bytes_available: 13318934528 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251693 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318934528 free_bytes_available: 13318934528 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251693 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318934528 free_bytes_available: 13318934528 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251693 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318934528 free_bytes_available: 13318934528 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251693 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318934528 free_bytes_available: 13318934528 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251693 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318934528 free_bytes_available: 13318934528 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251693 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318914048 free_bytes_available: 13318914048 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251688 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318914048 free_bytes_available: 13318914048 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251688 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318868992 free_bytes_available: 13318868992 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251677 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318868992 free_bytes_available: 13318868992 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251677 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318868992 free_bytes_available: 13318868992 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251677 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318868992 free_bytes_available: 13318868992 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251677 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318877184 free_bytes_available: 13318877184 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251679 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318877184 free_bytes_available: 13318877184 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251679 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318877184 free_bytes_available: 13318877184 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251679 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318877184 free_bytes_available: 13318877184 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251679 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318877184 free_bytes_available: 13318877184 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251679 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318877184 free_bytes_available: 13318877184 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251679 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Sept. 19, 2024, 10:23 a.m.	total_number_of_free_bytes: 13318877184 free_bytes_available: 13318877184 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Sept. 19, 2024, 10:23 a.m.	number_of_free_clusters: 3251679 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\MSIF23F.tmp

Checks for the Locally Unique Identifier on the system for a suspicious privilege (16 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Sept. 19, 2024, 10:23 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Sept. 19, 2024, 10:23 a.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1
LookupPrivilegeValueW Sept. 19, 2024, 10:23 a.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1
LookupPrivilegeValueW Sept. 19, 2024, 10:23 a.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1
LookupPrivilegeValueW Sept. 19, 2024, 10:23 a.m.	system_name: privilege_name: SeTcbPrivilege	1	1
LookupPrivilegeValueW Sept. 19, 2024, 10:23 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Sept. 19, 2024, 10:23 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW Sept. 19, 2024, 10:23 a.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW Sept. 19, 2024, 10:23 a.m.	system_name: privilege_name: SeBackupPrivilege	1	1
LookupPrivilegeValueW Sept. 19, 2024, 10:23 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW Sept. 19, 2024, 10:23 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Sept. 19, 2024, 10:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 19, 2024, 10:23 a.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1
LookupPrivilegeValueW Sept. 19, 2024, 10:23 a.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1
LookupPrivilegeValueW Sept. 19, 2024, 10:23 a.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1
LookupPrivilegeValueW Sept. 19, 2024, 10:23 a.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1

One or more of the buffers contains an embedded PE file (4 events)

buffer	Buffer with sha1: e9cc0938cfb4ea957a77b398e05bca6410f74adb
buffer	Buffer with sha1: 9e96944d2975757ac3f547c346f34930d9762e5a
buffer	Buffer with sha1: 157d3dddcb19c7ce84c73a3cb88b82143416b395
buffer	Buffer with sha1: 511c2f8b24fe0ca7dedf3b4683a665967e6e4002

Communicates with host for which no DNS query was performed (1 event)

host

117.18.232.200

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

Cynet	Malicious (score: 99)
ALYac	Gen:Variant.Marsilia.146086
VIPRE	Gen:Variant.Marsilia.146086
K7AntiVirus	Trojan ( 005b92761 )
K7GW	Trojan ( 005b92761 )
Arcabit	Trojan.Jalapeno.D4738
Symantec	Trojan.Gen.MBT
ESET-NOD32	Win32/GenCBL.FGT
Avast	Win32:MalwareX-gen [Trj]
BitDefender	Gen:Variant.Jalapeno.18232
NANO-Antivirus	Trojan.Win32.TrjGen.krfrjp
Emsisoft	Gen:Variant.Jalapeno.18232 (B)
F-Secure	Trojan.TR/Agent.hmdkq
DrWeb	BackDoor.Siggen2.4873
FireEye	Gen:Variant.Jalapeno.18232
Ikarus	Trojan.MSIL.Agent
Google	Detected
Avira	TR/Agent.hmdkq
MAX	malware (ai score=89)
GData	Gen:Variant.Jalapeno.18232
Varist	W32/FakeQB.A.gen!Eldorado
AVG	Win32:MalwareX-gen [Trj]
alibabacloud	Trojan:MSIL/Agent.XM!

QuickBooks_Desktop_Setup.msi

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All