Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 10, 2021, 10:24 a.m.	June 10, 2021, 10:26 a.m.

Size	2.3MB
Type	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5	`0f21460d981d6c274325d9233d446322`
SHA256	`8f133bf24f369fda7a2458fcad2194f5ca629bc29719152986f8626ad86648c6`
CRC32	`8CC5457A`
ssdeep	`24576:dxhleitEm5+zVcl/u5jftOoATGJpfmgFmsMhc+CVF3F3SeBHfkJuHkJaRcqp/P8Q:XtkNb`
Yara	None matched

mshta.exe "C:\Windows\System32\mshta.exe" C:\Users\test22\AppData\Local\Temp\ref-06092021_pdf.hta
3024

Name	Response	Post-Analysis Lookup
kundecamton.serveftp.com	A 185.19.85.169	185.19.85.169

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.19.85.169	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:61479 -> 164.124.101.2:53	2028691	ET POLICY DNS Query to DynDNS Domain *.serveftp .com	Potentially Bad Traffic
UDP 192.168.56.101:59369 -> 164.124.101.2:53	2028691	ET POLICY DNS Query to DynDNS Domain *.serveftp .com	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (5 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 10, 2021, 10:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 10, 2021, 10:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 10, 2021, 10:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 10, 2021, 10:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 10, 2021, 10:24 a.m.	computer_name: TEST22-PC	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 10, 2021, 10:24 a.m.		1	1	0

Connects to a Dynamic DNS Domain (1 event)

domain

kundecamton.serveftp.com

Allocates read-write-execute memory (usually to unpack itself) (50 out of 691 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72192000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04850000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04852000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04852000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04852000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04852000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04852000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04852000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04853000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04854000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04854000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04854000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04854000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04854000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04854000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04854000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04854000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04854000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04855000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04855000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04855000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04855000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04855000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04855000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04855000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04855000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04855000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04855000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04855000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04856000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04856000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04856000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04856000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04856000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04856000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04856000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04856000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04856000 process_handle: 0xffffffff	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 10, 2021, 10:24 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 16 (PAGE_EXECUTE) base_address: 0x04850000 process_handle: 0xffffffff	1	0	0

A potential heapspray has been detected. 76 megabytes was sprayed onto the heap of the mshta.exe process (1 event)

count

615

name

heapspray

process

mshta.exe

total_mb

length

131072

protection

PAGE_READWRITE

ref-06092021_pdf.hta

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All