Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 11, 2024, 10:03 a.m.	Nov. 11, 2024, 10:08 a.m.

Size	2.9MB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: AteraAgent, Author: Atera networks, Keywords: Installer, Comments: This installer database contains the logic and data required to install AteraAgent., Template: Intel;1033, Revision Number: {721AD955-79FD-4019-BBF5-9DCC4C1175BB}, Create Time/Date: Wed Feb 28 10:52:02 2024, Last Saved Time/Date: Wed Feb 28 10:52:02 2024, Number of Pages: 200, Number of Words: 6, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
MD5	`16a2d0c6e475bc422bf93644bef37e3a`
SHA256	`99943cbf5119b45787f6d349e0c8f65768360253e00451b9050923bfe4618e06`
CRC32	`E6CD1A57`
ssdeep	`49152:T+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:T+lUlz9FKbsodq0YaH7ZPxMb8tT`
Yara	Malicious_Library_Zero - Malicious_Library Microsoft_Office_File_Zero - Microsoft Office File CAB_file_format - CAB archive file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\Adobeflash.msi
1172
- explorer.exe C:\Windows\Explorer.EXE
  1236

Name	Response	Post-Analysis Lookup
ps.pndsn.com		18.179.18.154
ocsp.digicert.com		152.195.38.76
crl3.digicert.com		152.195.38.76
agent-api.atera.com		20.37.139.187

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 11, 2024, 10:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 11, 2024, 10:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:03 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 11, 2024, 10:03 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 11, 2024, 10:03 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (22 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73de1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73481000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75201000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73441000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73421000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73361000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03b40000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73352000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d60000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03f10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73281000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 1172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75ab1000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW Nov. 11, 2024, 10:03 a.m.	total_number_of_free_bytes: 9931923456 free_bytes_available: 9931923456 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Nov. 11, 2024, 10:03 a.m.	number_of_free_clusters: 2424786 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Nov. 11, 2024, 10:03 a.m.	total_number_of_free_bytes: 9931923456 free_bytes_available: 9931923456 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Nov. 11, 2024, 10:03 a.m.	number_of_free_clusters: 2424786 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (16 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Nov. 11, 2024, 10:03 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 10:03 a.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 10:03 a.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 10:03 a.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 10:03 a.m.	system_name: privilege_name: SeTcbPrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 10:03 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 10:03 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 10:03 a.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 10:03 a.m.	system_name: privilege_name: SeBackupPrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 10:03 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 10:03 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 10:03 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 10:03 a.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 10:03 a.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 10:03 a.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1
LookupPrivilegeValueW Nov. 11, 2024, 10:03 a.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 015b5f953d6ffe1926c8f9bcd0e109ad91cfc6c8
buffer	Buffer with sha1: 73e0a81707960cc3ccb5dccef4cbb6cd51ee3710

Attempts to create or modify system certificates (2 events)

registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

CTX	msi.remote-access-trojan.atera
Skyhigh	RemAdm-Atera
ALYac	Adware.GenericKD.61013951
VIPRE	Adware.GenericKD.61013951
K7GW	Trojan ( 0001140e1 )
K7AntiVirus	Trojan ( 0001140e1 )
Arcabit	Adware.Generic.D3A2FFBF
Kaspersky	not-a-virus:HEUR:RemoteAdmin.MSIL.Atera.gen
BitDefender	Adware.GenericKD.61013951
MicroWorld-eScan	Adware.GenericKD.61013951
Rising	HackTool.Atera!8.13A3B (CLOUD)
Emsisoft	Adware.GenericKD.61013951 (B)
DrWeb	Program.RemoteAdminNET.1
FireEye	Adware.GenericKD.61013951
Google	Detected
Antiy-AVL	RiskWare[RemoteAdmin]/MSIL.Atera
Xcitium	ApplicUnwnt@#2s9re1zdfn0go
ZoneAlarm	not-a-virus:HEUR:RemoteAdmin.MSIL.Atera.gen
GData	Adware.GenericKD.61013951
Varist	W32/Atera.KNVS-6994
McAfee	RemAdm-Atera
Fortinet	Riskware/Atera

Adobeflash.msi

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All