Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 7, 2021, 11:08 p.m.	July 7, 2021, 11:11 p.m.

Size	49.3KB
Type	Microsoft Word 2007+
MD5	`ae17389c50df966455179ec5b5c3c75a`
SHA256	`5dfc5eed13582377319f203c946461bab71b466119d02b4fd3c3410a60ea2a24`
CRC32	`8511EAD7`
ssdeep	`768:/fxPuJ3yy2cCBkGQ0Nq5hJD1iB/be8k+uYtjR5y6LaJDS2LV6OX5d:/pPu3yy21mGQT5hJ1iBkYzYpV6Of`
Yara	Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\require.06.30.21.doc
2992
- cmd.exe c:\windows\system32\cmd /c c:\programdata\refArrB.hta
  2528
  - mshta.exe "C:\Windows\SysWOW64\mshta.exe" "C:\programdata\refArrB.hta"
    2396

Name	Response	Post-Analysis Lookup
testmahoneyd.com	A 45.84.0.215	45.84.0.215

IP Address	Status	Action
164.124.101.2	Active	Moloch
45.84.0.215	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 7, 2021, 11:08 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 90 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724b6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a9fb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a9d7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a9e6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a9cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a997000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a9d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724d2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724bb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724b6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a9fb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a9d7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a9e6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a9cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a997000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00318000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00318000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00319000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00319000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$quire.06.30.21.doc

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile July 7, 2021, 11:08 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x0000041c filepath: C:\Users\test22\AppData\Local\Temp\~$quire.06.30.21.doc desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$quire.06.30.21.doc create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Creates a suspicious process (1 event)

cmdline

"C:\Windows\SysWOW64\mshta.exe" "C:\programdata\refArrB.hta"

Word document hooks document open

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 7, 2021, 11:08 p.m.	process_identifier: 2396 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 16 (PAGE_EXECUTE) base_address: 0x03400000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA July 7, 2021, 11:08 p.m.	key_handle: 0x00000384 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

One or more non-whitelisted processes were created (1 event)

parent_process

winword.exe

martian_process

c:\windows\system32\cmd /c c:\programdata\refArrB.hta

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2528 resumed a thread in remote process 2396
NtResumeThread July 7, 2021, 11:08 p.m.	thread_handle: 0x0000022c suspend_count: 1 process_identifier: 2396	1	0	0

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Lionic	Trojan.MSOffice.SAgent.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37168600
FireEye	Trojan.GenericKD.37168600
ALYac	Trojan.Downloader.DOC.Gen
Alibaba	TrojanDownloader:VBA/MalDoc.ali1000101
Arcabit	HEUR.VBA.Trojan.d
Cyren	Trojan.COYW-7
Symantec	Trojan.Gen.NPE
ESET-NOD32	a variant of VBA/TrojanDropper.Agent.CAV
Avast	Other:Malware-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.37168600
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi
Ad-Aware	Trojan.GenericKD.37168600
McAfee-GW-Edition	BehavesLike.Downloader.pc
Emsisoft	Trojan.GenericKD.37168600 (B)
Ikarus	Trojan.VBA.Agent
Avira	W2000M/Agent.2798516
Microsoft	TrojanDownloader:O97M/IcedID.RVO!MTB
GData	Trojan.GenericKD.37168600
Cynet	Malicious (score: 99)
AhnLab-V3	Downloader/DOC.TA551
McAfee	W97M/Downloader.dkf
MAX	malware (ai score=83)
SentinelOne	Static AI - Malicious OPENXML
Fortinet	VBA/Agent.DFK!tr.dldr
AVG	Other:Malware-gen [Trj]
Qihoo-360	virus.office.qexvmc.1070

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

45.84.0.215:80

require.06.30.21.doc

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All