Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Feb. 10, 2025, 4:13 p.m.	Feb. 10, 2025, 4:26 p.m.

Size	28.8MB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Network Screensaver Factory 7 Free, Author: Karlis Blumentals, Keywords: Installer, Comments: This installer database contains the logic and data required to install Network Screensaver Factory 7 Free., Template: Intel;1033, Revision Number: {4B471953-CDF0-470B-9C4F-5F2D2BD4A890}, Create Time/Date: Wed Jan 29 20:58:12 2025, Last Saved Time/Date: Wed Jan 29 20:58:12 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
MD5	`18fa8e73bcadfb7aecb02c9a036e8f8d`
SHA256	`8ba3e3ba86b3ef29558c6e88f9028632fd6c0bd5cb947a6f915f6b306a72038c`
CRC32	`49DB21B6`
ssdeep	`393216:kcOaxvyjkxcAev4ZxGGgl1HjU+rE+J7BJ9aWqAjYOQYV+LgVukX3Q0KD7TFOdRmM:k0NkvSghoG/bGtAwiTXOCWK452MYj`
Yara	Microsoft_Office_File_Zero - Microsoft Office File CAB_file_format - CAB archive file

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\NetworkScreensaverFactory7FreeSetup.msi
2552
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
81.19.140.67	Active	Moloch
94.130.53.50	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW Feb. 9, 2025, 1 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Feb. 9, 2025, 1 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 9, 2025, 1 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 9, 2025, 1 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 9, 2025, 1 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (25 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73951000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ac4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b02000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72761000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75831000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72701000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72631000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b60000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05d00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72622000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x059b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 9, 2025, 1 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75511000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 9, 2025, 1:02 p.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004120000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW Feb. 9, 2025, 1 p.m.	total_number_of_free_bytes: 13293776896 free_bytes_available: 13293776896 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Feb. 9, 2025, 1 p.m.	number_of_free_clusters: 3245551 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Feb. 9, 2025, 1 p.m.	total_number_of_free_bytes: 13293776896 free_bytes_available: 13293776896 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceW Feb. 9, 2025, 1 p.m.	number_of_free_clusters: 3245551 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (16 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Feb. 9, 2025, 1 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Feb. 9, 2025, 1 p.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1
LookupPrivilegeValueW Feb. 9, 2025, 1 p.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1
LookupPrivilegeValueW Feb. 9, 2025, 1 p.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1
LookupPrivilegeValueW Feb. 9, 2025, 1 p.m.	system_name: privilege_name: SeTcbPrivilege	1	1
LookupPrivilegeValueW Feb. 9, 2025, 1 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Feb. 9, 2025, 1 p.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW Feb. 9, 2025, 1 p.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW Feb. 9, 2025, 1 p.m.	system_name: privilege_name: SeBackupPrivilege	1	1
LookupPrivilegeValueW Feb. 9, 2025, 1 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW Feb. 9, 2025, 1 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Feb. 9, 2025, 1 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 9, 2025, 1 p.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1
LookupPrivilegeValueW Feb. 9, 2025, 1 p.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1
LookupPrivilegeValueW Feb. 9, 2025, 1 p.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1
LookupPrivilegeValueW Feb. 9, 2025, 1 p.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1

Communicates with host for which no DNS query was performed (2 events)

host	81.19.140.67
host	94.130.53.50

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

Lionic	Trojan.Win32.Generic.4!c
CTX	msi.trojan.artemis
CAT-QuickHeal	Trojan.Ghanarava.1738920103d88d05
Skyhigh	Artemis!Trojan
K7GW	Spyware ( 0059f25f1 )
K7AntiVirus	Spyware ( 0059f25f1 )
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/Spy.Agent.QIX
TrendMicro-HouseCall	TROJ_GEN.R002H09B725
Avast	Win32:SpywareX-gen [Trj]
Cynet	Malicious (score: 99)
Rising	Spyware.Agent!8.C6 (CLOUD)
F-Secure	Trojan.TR/Spy.Agent.mlvvm
TrendMicro	Trojan.Win32.DANABOT.YXFBGZ
Sophos	Generic Reputation PUA (PUA)
Google	Detected
Avira	TR/Spy.Agent.wqthh
Varist	W32/ABSpyware.GEKF-8895
McAfee	Artemis!6E75549F845F
VBA32	BScope.Adware.Puamson
Ikarus	Trojan-Spy.Win32.Agent
Tencent	Win32.Trojan.Spy.Udkl
Fortinet	W32/Agent.QIX!tr.spy
AVG	Win32:SpywareX-gen [Trj]
alibabacloud	Trojan[spy]:Win/Agent.QLF

NetworkScreensaverFactory7FreeSetup.msi

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All