Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 2, 2025, 10:41 a.m.	Jan. 2, 2025, 10:44 a.m.

Size	1.9MB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Microsoft Edge 131.0.2903.112, Subject: Microsoft Edge, Author: Microsoft Corporation, Keywords: Installer, Template: Intel;1033, Revision Number: {A3E5BD32-5D25-43E0-A9F0-60F729B1751C}, Create Time/Date: Thu Jan 11 14:59:44 2024, Last Saved Time/Date: Thu Jan 11 14:59:44 2024, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (11.0.53.0), Security: 2
MD5	`911c7c676d8457767ff6d69ecefa1d79`
SHA256	`b2332c274a55abe231d044ad4e3e64dd37bf3200314c209d5a91ff8ee800cc54`
CRC32	`6EEA1549`
ssdeep	`24576:1t9cpVDh46APmqtgPOvmoQVFVwhajkD6lbTOz0H:KpRhV9qtgGBQD28AOTGK`
Yara	Malicious_Library_Zero - Malicious_Library Microsoft_Office_File_Zero - Microsoft Office File CAB_file_format - CAB archive file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\install.msi
2556

Name	Response	Post-Analysis Lookup
kuywuskkgqsigqqs.xyz		193.32.177.34
uoigsiqmemcscosu.xyz
skyqsyyymyacyayc.xyz
auayomwkewcomwas.xyz
ggicikyqcaiyguee.xyz
ewacuagosgqmuocm.xyz
eqakguiwiqacqiwg.xyz
iyaikmkkowcqemsi.xyz
oqyaoykomyoygics.xyz
wgcaouuqqqwucogy.xyz

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Jan. 2, 2025, 10:41 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 2, 2025, 10:41 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 2, 2025, 10:41 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (17 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73951000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ac4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b02000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72761000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726f1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x037e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726e2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03a50000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72611000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 2, 2025, 10:41 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75511000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW Jan. 2, 2025, 10:41 a.m.	total_number_of_free_bytes: 13320556544 free_bytes_available: 13320556544 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Jan. 2, 2025, 10:41 a.m.	number_of_free_clusters: 3252089 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Jan. 2, 2025, 10:41 a.m.	total_number_of_free_bytes: 13320556544 free_bytes_available: 13320556544 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Jan. 2, 2025, 10:41 a.m.	number_of_free_clusters: 3252089 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (16 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Jan. 2, 2025, 10:41 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Jan. 2, 2025, 10:41 a.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1
LookupPrivilegeValueW Jan. 2, 2025, 10:41 a.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1
LookupPrivilegeValueW Jan. 2, 2025, 10:41 a.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1
LookupPrivilegeValueW Jan. 2, 2025, 10:41 a.m.	system_name: privilege_name: SeTcbPrivilege	1	1
LookupPrivilegeValueW Jan. 2, 2025, 10:41 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Jan. 2, 2025, 10:41 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW Jan. 2, 2025, 10:41 a.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW Jan. 2, 2025, 10:41 a.m.	system_name: privilege_name: SeBackupPrivilege	1	1
LookupPrivilegeValueW Jan. 2, 2025, 10:41 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW Jan. 2, 2025, 10:41 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Jan. 2, 2025, 10:41 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Jan. 2, 2025, 10:41 a.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1
LookupPrivilegeValueW Jan. 2, 2025, 10:41 a.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1
LookupPrivilegeValueW Jan. 2, 2025, 10:41 a.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1
LookupPrivilegeValueW Jan. 2, 2025, 10:41 a.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1

File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 events)

Lionic	Trojan.Win32.Heavy.4!c
MicroWorld-eScan	Trojan.GenericKD.75287443
CTX	msi.trojan.heavy
ALYac	Gen:Variant.Lazy.609164
VIPRE	Trojan.GenericKD.75287443
K7GW	Trojan-Downloader ( 0056a18b1 )
K7AntiVirus	Trojan-Downloader ( 0056a18b1 )
Arcabit	Trojan.Generic.D47CCB93
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.HUQ
Avast	Other:Malware-gen [Trj]
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.Win32.Heavy.gen
BitDefender	Trojan.GenericKD.75287443
Emsisoft	Trojan.GenericKD.75287443 (B)
F-Secure	Trojan:W32/GenInflated.B
TrendMicro	TrojanSpy.Win32.METASTEALER.YXEL5Z
Ikarus	Trojan-Downloader.Win32.Agent
FireEye	Trojan.GenericKD.75287443
Avira	TR/Dldr.Agent.gyjeq
Antiy-AVL	Trojan/Win32.Heavy
Kingsoft	Win32.Trojan.Heavy.gen
GData	Trojan.GenericKD.75287443
Varist	ABTrojan.GRHR-
Tencent	Win32.Trojan-Downloader.Oader.Aplw
Fortinet	W32/Agent.HUQ!tr.dldr
AVG	Other:Malware-gen [Trj]
alibabacloud	Trojan[downloader]:Win/Heavy.gyf

install.msi

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All