Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 3, 2021, 10:26 a.m.	April 3, 2021, 10:29 a.m.

Size	3.1MB
Type	Microsoft Word 2007+
MD5	`609c2473571bf703ce985b6e44b8e343`
SHA256	`c8ef6d5139e6175dfa05c9ad6942343277a6c5ed8723472dd508d8d0235714d6`
CRC32	`8C7D0326`
ssdeep	`98304:mBNe9iSLToQuMkvX72hJ80VOLb8khrEzm+c9SwFSZPgnAiueci5G:mG9iIkf72Y0cIqAz9InYejG`
Yara	None matched

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\월간KIMA2021_4월호군사안보0330.docx
2648

Name	Response	Post-Analysis Lookup
beilksa.scienceontheweb.net	A 185.176.43.98	185.176.43.98

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.176.43.98	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Performs some HTTP requests (10 events)

request	OPTIONS http://beilksa.scienceontheweb.net/cookie/select/log/
request	OPTIONS http://beilksa.scienceontheweb.net/cookie/select/log
request	PROPFIND http://beilksa.scienceontheweb.net/cookie/select/log
request	PROPFIND http://beilksa.scienceontheweb.net/cookie/select/log/
request	PROPFIND http://beilksa.scienceontheweb.net/cookie/select
request	PROPFIND http://beilksa.scienceontheweb.net/cookie/select/
request	PROPFIND http://beilksa.scienceontheweb.net/cookie
request	PROPFIND http://beilksa.scienceontheweb.net/cookie/
request	GET http://beilksa.scienceontheweb.net/cookie/select/log/tmp?q=6
request	GET http://beilksa.scienceontheweb.net/cookie/select/log/tmp/?q=6

Allocates read-write-execute memory (usually to unpack itself) (41 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cac1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73321000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c9d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c9b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c961000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c901000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c8e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c7e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x765b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:26 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c8c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c711000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c765000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c701000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c504000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x65001000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x078e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x078f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x507c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c4e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c4e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c441000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c457000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6acf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2021, 10:27 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c3d5000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$KIMA2021_4월호군사안보0330.docx

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile April 3, 2021, 10:26 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000003ec filepath: C:\Users\test22\AppData\Local\Temp\~$KIMA2021_4월호군사안보0330.docx desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$KIMA2021_4월호군사안보0330.docx create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

File has been identified by 17 AntiVirus engines on VirusTotal as malicious (17 events)

McAfee	W97M/MacroLess.v
Alibaba	Trojan:Office97/MacroLess.be68cbdb
Arcabit	Trojan.Groooboor.Gen.19
ESET-NOD32	DOC/TrojanDownloader.Agent.ARJ
BitDefender	Trojan.Groooboor.Gen.19
NANO-Antivirus	Exploit.Xml.CVE-2017-0199.equmby
MicroWorld-eScan	Trojan.Groooboor.Gen.19
Emsisoft	Trojan.Groooboor.Gen.19 (B)
McAfee-GW-Edition	W97M/MacroLess.v
FireEye	Trojan.Groooboor.Gen.19
GData	Trojan.Groooboor.Gen.19
AegisLab	Trojan.MSWord.Groooboor.4!c
AhnLab-V3	Downloader/DOC.External
ALYac	Trojan.Downloader.DOC.Gen
MAX	malware (ai score=100)
Zoner	Probably Heur.W97OleLink
Qihoo-360	Office/Trojan.Generic.HjcASR8A

Libraries known to be associated with a CVE were requested (may be False Positive) (1 event)

cve	CVE-2013-3906

월간KIMA2021_4월호군사안보0330.docx

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All