Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 25, 2024, 10:44 a.m.	Sept. 25, 2024, 10:50 a.m.

Size	21.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`8b1275afa5ed7d63fc33c02400062814`
SHA256	`9272725ce2c04a04ac68741c6fce964648592933f3aba618fed7c585706b6d2a`
CRC32	`2D54034F`
ssdeep	`393216:FJ/YDkadun7COXFSW8hKuv4LKHuY57amRbk2rmhZzqFGqi0O/O4+Tba+bSTG7OMY://b2AIRwwpZamJkkmnoM0O+SeYG7c8rE`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format OS_Processor_Check_Zero - OS Processor Check

Descargar%20Musica%20Gratis-updater.exe "C:\Users\test22\AppData\Local\Temp\Descargar%20Musica%20Gratis-updater.exe"
2080
- Descargar%20Musica%20Gratis-updater.tmp "C:\Users\test22\AppData\Local\Temp\is-9NU7O.tmp\Descargar%20Musica%20Gratis-updater.tmp" /SL5="$30028,21255582,807936,C:\Users\test22\AppData\Local\Temp\Descargar%20Musica%20Gratis-updater.exe"
  2136
  - Descargar Musica Gratis.exe "C:\Users\test22\AppData\Local\Descargar Musica Gratis\Descargar Musica Gratis.exe" -activate
    2680
    - Descargar Musica GratisService.exe "C:\Users\test22\AppData\Local\Descargar Musica Gratis\Descargar Musica GratisService.exe"
      2780
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
soundfrost.org	A 185.132.132.47	185.132.132.47

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.132.132.47	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (8 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 25, 2024, 10:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2024, 10:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2024, 10:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2024, 10:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2024, 10:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2024, 10:49 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2024, 10:49 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2024, 10:49 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 25, 2024, 10:44 a.m.			0	0
IsDebuggerPresent Sept. 25, 2024, 10:49 a.m.			0	0
IsDebuggerPresent Sept. 25, 2024, 10:49 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (2 events)

registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\MachineGuid
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	c:\program files\mozilla firefox\firefox.exe

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.itext
section	.didata

Performs some HTTP requests (2 events)

request	GET http://soundfrost.org/pings/update.php?project=14&version=3.9.6
request	GET http://soundfrost.org/update/update.php?version=3.9.6&product=14&id=e1e9f0c45386f464933c401e41f43ee30779b6d0

Allocates read-write-execute memory (usually to unpack itself) (31 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 25, 2024, 10:44 a.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:44 a.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 745472 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:44 a.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:44 a.m.	process_identifier: 2080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 53248 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c6000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2024, 10:44 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 90112 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 36864 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742e6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8081408 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fcd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 323584 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70437000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 28672 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 53248 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742c9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 90112 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742c3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 249856 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74279000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 114688 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742c9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 28672 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 36864 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 1044480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741da000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 561152 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74101000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:49 a.m.	process_identifier: 2680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74185000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Descargar Musica Gratis\Uninstall Descargar Musica Gratis.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Descargar Musica Gratis\Descargar Musica Gratis.lnk

Creates a shortcut to an executable file (16 events)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Chrome.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Descargar Musica Gratis\Uninstall Descargar Musica Gratis.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Descargar Musica Gratis\Descargar Musica Gratis.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Descargar Musica Gratis\How to use Descargar Musica Gratis.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Word 2013.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-9NU7O.tmp\Descargar%20Musica%20Gratis-updater.tmp

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (39 events)

Time & API	Arguments	Status	Return
Process32FirstW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: [System Process] process_identifier: 0	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: System process_identifier: 4	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: smss.exe process_identifier: 232	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: csrss.exe process_identifier: 308	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: wininit.exe process_identifier: 344	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: csrss.exe process_identifier: 356	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: winlogon.exe process_identifier: 392	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: services.exe process_identifier: 436	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: lsass.exe process_identifier: 452	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: lsm.exe process_identifier: 460	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: svchost.exe process_identifier: 560	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: svchost.exe process_identifier: 636	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: svchost.exe process_identifier: 716	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: svchost.exe process_identifier: 780	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: svchost.exe process_identifier: 824	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: audiodg.exe process_identifier: 896	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: svchost.exe process_identifier: 984	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: svchost.exe process_identifier: 340	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: spoolsv.exe process_identifier: 1060	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: taskhost.exe process_identifier: 1112	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: svchost.exe process_identifier: 1120	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: dwm.exe process_identifier: 1192	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: explorer.exe process_identifier: 1236	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: svchost.exe process_identifier: 1744	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: pw.exe process_identifier: 1888	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: SearchIndexer.exe process_identifier: 1652	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: pw.exe process_identifier: 1904	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: taskhost.exe process_identifier: 296	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: SearchProtocolHost.exe process_identifier: 1792	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: SearchFilterHost.exe process_identifier: 1132	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: Descargar%20Musica%20Gratis-updater.exe process_identifier: 2080	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: Descargar%20Musica%20Gratis-updater.tmp process_identifier: 2136	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: svchost.exe process_identifier: 2356	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: mscorsvw.exe process_identifier: 2384	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: mscorsvw.exe process_identifier: 2424	1	1
Process32NextW Sept. 25, 2024, 10:44 a.m.	snapshot_handle: 0x0000024c process_name: sppsvc.exe process_identifier: 2476	1	1
Process32NextW Sept. 25, 2024, 10:49 a.m.	snapshot_handle: 0x00000274 process_name: Descargar Musica Gratis.exe process_identifier: 2680	1	1
Process32NextW Sept. 25, 2024, 10:49 a.m.	snapshot_handle: 0x00000274 process_name: Descargar Musica GratisService.exe process_identifier: 2716	1	1
Process32NextW Sept. 25, 2024, 10:49 a.m.	snapshot_handle: 0x00000274 process_name: Descargar Musica GratisService.exe process_identifier: 2780	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (8 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Sept. 25, 2024, 10:49 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Sept. 25, 2024, 10:49 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Sept. 25, 2024, 10:49 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Sept. 25, 2024, 10:49 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Sept. 25, 2024, 10:49 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Sept. 25, 2024, 10:49 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Sept. 25, 2024, 10:49 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Sept. 25, 2024, 10:49 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1

Queries for potentially installed applications (6 events)

Time & API	Arguments	Return
RegOpenKeyExW Sept. 25, 2024, 10:44 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Descargar Musica Gratis_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Descargar Musica Gratis_is1	2
RegOpenKeyExW Sept. 25, 2024, 10:44 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Descargar Musica Gratis_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Descargar Musica Gratis_is1	2
RegOpenKeyExW Sept. 25, 2024, 10:44 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Descargar Musica Gratis_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Descargar Musica Gratis_is1	2
RegOpenKeyExW Sept. 25, 2024, 10:45 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Descargar Musica Gratis_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Descargar Musica Gratis_is1	2
RegOpenKeyExW Sept. 25, 2024, 10:45 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Descargar Musica Gratis_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Descargar Musica Gratis_is1	2
RegOpenKeyExW Sept. 25, 2024, 10:45 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Descargar Musica Gratis_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000101 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Descargar Musica Gratis_is1	2

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Descargar Musica Gratis				reg_value	C:\Users\test22\AppData\Local\Descargar Musica Gratis\Descargar Musica Gratis.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Descargar Musica GratisService				reg_value	C:\Users\test22\AppData\Local\Descargar Musica Gratis\Descargar Musica GratisService.exe

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-9NU7O.tmp\Descargar%20Musica%20Gratis-updater.tmp

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 events)

Bkav	W32.Common.D87C2FC9
Cylance	unsafe
ESET-NOD32	a variant of Win32/SoundFrost.H potentially unwanted
Avast	Win32:MiscX-gen [PUP]
Rising	PUF.SoundFrost!8.4914 (TFE:5:A1TZ4Q0PNpQ)
DrWeb	Trojan.Click3.30366
Ikarus	PUA.SoundFrost
Google	Detected
Xcitium	ApplicUnwnt@#2xumh0f7zwswf
GData	Win32.Trojan.Agent.RK5C7X
Varist	W32/ABRisk.LDHO-9217
Malwarebytes	Generic.Malware/Suspicious
MaxSecure	Trojan.Malware.3411146.susgen
Fortinet	Riskware/SoundFrost
AVG	Win32:MiscX-gen [PUP]

Descargar%20Musica%20Gratis-updater.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All