Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 19, 2021, 1:46 p.m.	May 19, 2021, 1:48 p.m.

Size	83.5KB
Type	Microsoft Word 2007+
MD5	`28618dc816f92287178a26e72c37d311`
SHA256	`43e857426751866b816b7d2472e978111d7f61054c2361979bf2d03758d48231`
CRC32	`00BF25F2`
ssdeep	`1536:es+WqQuctgd9myOG/HyII85n04rHGzZbbayeQgoSAZmhXzopOmdZOLpvk9jitOXt:F+X8Yvn/Q+ntrmVyyeImhDEtfO0j4OCk`
Yara	Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\msf.docm
9068

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (9 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 19, 2021, 1:46 p.m.	process_identifier: 9068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:46 p.m.	process_identifier: 9068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:46 p.m.	process_identifier: 9068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:46 p.m.	process_identifier: 9068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743c1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:46 p.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:46 p.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:46 p.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05cc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:46 p.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05cd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:46 p.m.	process_identifier: 9068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x507c1000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$msf.docm

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile May 19, 2021, 1:46 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000003e0 filepath: C:\Users\test22\AppData\Local\Temp\~$msf.docm desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$msf.docm create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 events)

DrWeb	Trojan.MulDrop9.34960
MicroWorld-eScan	VB:Trojan.Valyria.447
FireEye	VB:Trojan.Valyria.447
CAT-QuickHeal	O97M.Downloader.39914
Sangfor	Malware.Generic-Macro.Save.8e4caa0f
Arcabit	VB:Trojan.Valyria.447
Cyren	PP97M/Downldr.gen
Symantec	Scr.Malcode!gen
ESET-NOD32	multiple detections
TrendMicro-HouseCall	W2KM_POWLOAD.THAAOIAH
Avast	VBA:Downloader-EON [Trj]
ClamAV	Doc.Malware.Valyria-6728957-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	VB:Trojan.Valyria.447
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi
Tencent	Heur:Trojan.Script.LS_Gencirc.7123735.0
Ad-Aware	VB:Trojan.Valyria.447
TACHYON	Suspicious/WOX.Obfus.Gen.8
Emsisoft	VB:Trojan.Valyria.447 (B)
Comodo	Malware@#szyhna3hnt41
Baidu	VBA.Trojan.Agent.v
TrendMicro	W2KM_POWLOAD.THAAOIAH
McAfee-GW-Edition	RDN/GenDownloader.ave
Sophos	ATK/FatRat-F
Ikarus	Trojan.SuspectCRC
Jiangmin	TrojanDropper/MSWord.Agent.jh
Avira	W2000M/Agent.57860552
Gridinsoft	Trojan.U.Agent.ns
Microsoft	Trojan:Win32/Swrort.A
AegisLab	Trojan.Script.Agent.4!c
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	VB:Trojan.Valyria.447
Cynet	Malicious (score: 99)
McAfee	RDN/GenDownloader.ave
MAX	malware (ai score=86)
SentinelOne	Static AI - Malicious OPENXML
Fortinet	MSOffice/Agent.NUOSZNZ!tr
AVG	VBA:Downloader-EON [Trj]

msf.docm

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All