Ops Afg post 9-11.doc

Performs some HTTP requests (5 events)

request	OPTIONS http://designerzebra.com/services/
request	HEAD http://designerzebra.com/services/check6
request	OPTIONS http://designerzebra.com/services
request	PROPFIND http://designerzebra.com/services
request	GET http://designerzebra.com/services/check6

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 12, 2021, 6:02 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a4fa000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 12, 2021, 6:02 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x69614000 process_handle: 0xffffffff	1	0	0

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$s Afg post 9-11.doc

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile July 12, 2021, 6:02 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x00000418 filepath: C:\Users\test22\AppData\Local\Temp\~$s Afg post 9-11.doc desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$s Afg post 9-11.doc create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

File has been identified by 4 AntiVirus engines on VirusTotal as malicious (4 events)

Kaspersky	HEUR:Exploit.RTF.T1221.gen
Rising	Downloader.Generic/RTF!1.D4A8 (CLASSIC)
McAfee-GW-Edition	BehavesLike.BadFile.cv
ZoneAlarm	HEUR:Exploit.RTF.T1221.gen

RTF file has an unknown character set (1 event)

filetype_details

Rich Text Format data, version 1, unknown character set

filename

Ops Afg post 9-11.doc