Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
09.19 02:09
66ea645129e6a_jacobs.exe
09.19 11:09
clip64.dll
09.19 11:09
cred64.dll
09.19 10:09
vsfdajg16.exe
09.19 10:09
QuickBooks_Setup.msi
09.19 10:09
QuickBooks_Desktop_Set...
09.19 10:09
game.exe
09.19 10:09
vlsadg.exe
09.19 10:09
lnfsda.exe
09.19 10:09
66eaadab755d2_installs...

Latest News
09.20 03:09
Bridge Detection Gaps ...
09.20 03:09
02 - Performing Basic ...
09.20 03:09
Exploiting Exchange Po...
09.20 03:09
KI in Hollywood: Wie L...
09.20 03:09
Google: PIN-Schutz für...
09.20 03:09
Chrome-Update für Work...
09.20 03:09
Attacker or IT admin? ...
09.20 03:09
EU’s Von der Leyen Ple...
09.20 02:09
Threat Intelligence Sn...
09.20 02:09
Compliance webinar ser...

Summary | ZeroBOX

plan-1811162309.xlsb

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 29, 2021, 9:38 a.m.	June 29, 2021, 9:42 a.m.

Size	88.0KB
Type	Microsoft Excel 2007+
MD5	`e489a06471cbbe594a1ff7c306db410e`
SHA256	`25d46204f9bb8624d15d13296f31f2837323e25298480f4f8595a903c06e39d6`
CRC32	`0EE8A507`
ssdeep	`1536:MlHoxJQVyZEbrMj34410mHyL9c988gHhX8jCNnKfl5ncjv0/Ci:8Dbr0o45GUgHhX8jC9ySa`
Yara	None matched

EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\plan-1811162309.xlsb
5032
- regsvr32.exe regsvr32 ..\gihi1.dll
  4960
- regsvr32.exe regsvr32 ..\gihi2.dll
  2848

Name	Response	Post-Analysis Lookup
gruasphenbogota.com	A 50.116.92.246	50.116.92.246
carpascapital.com	A 50.116.92.246	50.116.92.246

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
50.116.92.246	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49809 -> 50.116.92.246:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 50.116.92.246:443 -> 192.168.56.102:49816	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49810 -> 50.116.92.246:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 50.116.92.246:443 -> 192.168.56.102:49812	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49814 -> 50.116.92.246:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49815 -> 50.116.92.246:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 29, 2021, 9:38 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (17 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70af1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70b4f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70b4f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73321000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f61000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f71000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e5e1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743f1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726d1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73711000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06fb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06fb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06fc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 29, 2021, 9:38 a.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07010000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\gihi2.dll
file	C:\Users\test22\gihi1.dll

Creates hidden or system file (3 events)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile June 29, 2021, 9:38 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000398 filepath: C:\Users\test22\AppData\Local\Temp\~$plan-1811162309.xlsb desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES\|DELETE\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$plan-1811162309.xlsb create_options: 4198496 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0
NtCreateFile June 29, 2021, 9:38 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000408 filepath: C:\Users\test22\AppData\Local\Temp\~$plan-1811162309.xlsb desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES\|DELETE\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$plan-1811162309.xlsb create_options: 4198496 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0
NtCreateFile June 29, 2021, 9:38 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000404 filepath: C:\Users\test22\AppData\Local\Temp\~$plan-1811162309.xlsb desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES\|DELETE\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$plan-1811162309.xlsb create_options: 4198496 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0

Creates a suspicious process (2 events)

cmdline	regsvr32 ..\gihi2.dll
cmdline	regsvr32 ..\gihi1.dll

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 19 AntiVirus engines on VirusTotal as malicious (19 events)

MicroWorld-eScan	Trojan.DOC.Agent.AWO
Alibaba	TrojanDownloader:VBA/MalDoc.ali1000101
Arcabit	Trojan.DOC.Agent.AWO
Cyren	XF/IcedID.C.gen!Camelot
ESET-NOD32	DOC/TrojanDownloader.Agent.DEP
Avast	VBS:Malware-gen
BitDefender	Trojan.DOC.Agent.AWO
Ad-Aware	Trojan.DOC.Agent.AWO
McAfee-GW-Edition	X97M/Downloader.iy
FireEye	Trojan.DOC.Agent.AWO
Emsisoft	Trojan.DOC.Agent.AWO (B)
MAX	malware (ai score=86)
Microsoft	TrojanDownloader:O97M/EncDoc.AVI!MTB
GData	Trojan.DOC.Agent.AWO
McAfee	X97M/Downloader.iy
Rising	Downloader.Agent/XLM!1.D77C (CLASSIC)
Ikarus	Trojan-Downloader.DOC.Agent
Fortinet	MSExcel/Agent.DEP!tr.dldr
AVG	VBS:Malware-gen

Network communications indicative of a potential document or script payload download was initiated by the process excel.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
URLDownloadToFileW June 29, 2021, 9:38 a.m.	url: https://carpascapital.com/gBPg8MtsGbv/ka.html stack_pivoted: 0 filepath_r: ..\gihi1.dll filepath: C:\Users\test22\gihi1.dll		2148270085	0
URLDownloadToFileW June 29, 2021, 9:38 a.m.	url: https://gruasphenbogota.com/C74hwGGxi/ka.html stack_pivoted: 0 filepath_r: ..\gihi2.dll filepath: C:\Users\test22\gihi2.dll		2148270085	0

One or more non-whitelisted processes were created (2 events)

parent_process	excel.exe				martian_process	regsvr32 ..\gihi2.dll
parent_process	excel.exe				martian_process	regsvr32 ..\gihi1.dll