Манифест.docx

Allocates read-write-execute memory (usually to unpack itself) (7 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 3, 2021, 9:38 a.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a466000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 3, 2021, 9:38 a.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a364000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 3, 2021, 9:38 a.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a321000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 3, 2021, 9:38 a.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a292000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 3, 2021, 9:38 a.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x69f21000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 3, 2021, 9:38 a.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6953e000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 3, 2021, 9:38 a.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7512b000 process_handle: 0xffffffff	1	0	0

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$нифест.docx

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Aug. 3, 2021, 9:38 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x00000490 filepath: C:\Users\test22\AppData\Local\Temp\~$нифест.docx desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$нифест.docx create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 3, 2021, 9:38 a.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef50000 process_handle: 0xffffffff	1	0	0

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 events)

Lionic	Trojan.MSWord.Generic.4!c
MicroWorld-eScan	Trojan.GenericKD.37320171
ALYac	Trojan.Downloader.DOC.Gen
BitDefender	Trojan.GenericKD.37320171
Tencent	Trojan.Win32.Office_Dl.11012634
Ad-Aware	Trojan.GenericKD.37320171
McAfee-GW-Edition	Artemis!Trojan
FireEye	Trojan.GenericKD.37320171
Emsisoft	Trojan.GenericKD.37320171 (B)
Avira	EXP/Agent.dmj
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.GenericKD.37320171
Cynet	Malicious (score: 99)
Zoner	Probably Heur.W97OleLink
Qihoo-360	susp.exp.20170199