Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Feb. 3, 2025, 10:03 a.m.	Feb. 3, 2025, 10:24 a.m.

Size	2.1MB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Microsoft Edge 132.0.2957.127, Subject: Microsoft Edge, Author: Microsoft Corporation, Keywords: Installer, Template: Intel;1033, Revision Number: {29A67636-7A61-4F2E-9A4D-A37F1CDD5940}, Create Time/Date: Thu Jan 11 14:59:44 2024, Last Saved Time/Date: Thu Jan 11 14:59:44 2024, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (11.0.53.0), Security: 2
MD5	`d192d614bff7e4d9de58ea2e1d0669c3`
SHA256	`5989d6ca4350e9642e0971111ad36b529acbb82a5b9374d5ba4c534b360c2395`
CRC32	`123DB1DB`
ssdeep	`24576:ht9cpVDhL6WbPtGYjnhP+WH77chDnAIdmow2mSZK0L+LLk2VC:WpRhOWJGYjnhP+WbUAIdmsZKSCC`
Yara	Malicious_Library_Zero - Malicious_Library Microsoft_Office_File_Zero - Microsoft Office File CAB_file_format - CAB archive file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\setup.msi
1460

Name	Response	Post-Analysis Lookup
qcyeogcwkeqmmwii.xyz
omagiyeiaggkeiqa.xyz
akgeaywgcumqgeye.xyz
acicgeoaiyyiowmm.xyz
isekooiiwkkukyog.xyz
oeccmisqyomuosaq.xyz
imygqwowcuaycyua.xyz	A 193.32.177.34	193.32.177.34
kqoeoowkwikcaouy.xyz
igyycsusqkowgkeu.xyz
ymameyoysseiagky.xyz
eyqyyggowegmcwce.xyz
smyacmmaeomcqkoq.xyz

IP Address	Status	Action
164.124.101.2	Active	Moloch
193.32.177.34	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Feb. 3, 2025, 10:03 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 3, 2025, 10:03 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 3, 2025, 10:03 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73de1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73481000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73431000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 1460 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x031f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x031f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73422000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 1460 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x034d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03620000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73351000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75ab1000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW Feb. 3, 2025, 10:03 a.m.	total_number_of_free_bytes: 9933918208 free_bytes_available: 9933918208 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Feb. 3, 2025, 10:03 a.m.	number_of_free_clusters: 2425273 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Feb. 3, 2025, 10:03 a.m.	total_number_of_free_bytes: 9933918208 free_bytes_available: 9933918208 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Feb. 3, 2025, 10:03 a.m.	number_of_free_clusters: 2425273 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (16 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Feb. 3, 2025, 10:03 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Feb. 3, 2025, 10:03 a.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1
LookupPrivilegeValueW Feb. 3, 2025, 10:03 a.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1
LookupPrivilegeValueW Feb. 3, 2025, 10:03 a.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1
LookupPrivilegeValueW Feb. 3, 2025, 10:03 a.m.	system_name: privilege_name: SeTcbPrivilege	1	1
LookupPrivilegeValueW Feb. 3, 2025, 10:03 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Feb. 3, 2025, 10:03 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW Feb. 3, 2025, 10:03 a.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW Feb. 3, 2025, 10:03 a.m.	system_name: privilege_name: SeBackupPrivilege	1	1
LookupPrivilegeValueW Feb. 3, 2025, 10:03 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW Feb. 3, 2025, 10:03 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Feb. 3, 2025, 10:03 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 3, 2025, 10:03 a.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1
LookupPrivilegeValueW Feb. 3, 2025, 10:03 a.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1
LookupPrivilegeValueW Feb. 3, 2025, 10:03 a.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1
LookupPrivilegeValueW Feb. 3, 2025, 10:03 a.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1

File has been identified by 27 AntiVirus engines on VirusTotal as malicious (27 events)

Lionic	Trojan.Win32.Heavy.4!c
CTX	msi.trojan.heavy
VIPRE	Gen:Variant.Midie.157418
K7GW	Trojan-Downloader ( 005bb1c61 )
K7AntiVirus	Trojan-Downloader ( 005bb1c61 )
Arcabit	Trojan.Midie.D266EA
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.HUQ
Avast	Other:Malware-gen [Trj]
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.Win32.Heavy.gen
BitDefender	Gen:Variant.Midie.157418
NANO-Antivirus	Exploit.Script.Nemucod.dzzhbf
Emsisoft	Gen:Variant.Midie.157418 (B)
F-Secure	Trojan:W32/GenInflated.B
TrendMicro	TrojanSpy.Win32.METASTEALER.YXFBBZ
FireEye	Gen:Variant.Midie.157418
Avira	TR/Dldr.Agent.cmpfm
Antiy-AVL	Trojan/Win32.Heavy
Kingsoft	Win32.Trojan.Heavy.gen
GData	Gen:Variant.Midie.157418
Varist	ABTrojan.SOXW-
Ikarus	Trojan-Downloader.Win32.Agent
Tencent	Win32.Trojan-Downloader.Oader.Zwhl
Fortinet	W32/Agent.HUQ!tr.dldr
AVG	Other:Malware-gen [Trj]
alibabacloud	Trojan[downloader]:Win/Heavy.gyf

setup.msi

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All