Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 10, 2021, 5:36 p.m.	Aug. 10, 2021, 5:38 p.m.

Size	326.9KB
Type	Microsoft Excel 2007+
MD5	`8420c97abd12c1aaad8f01a84c7a0181`
SHA256	`27e948c0ffe9467da1268ddb8187620b37b6c99d28ed74bf0ef1ef7dfce8c8fb`
CRC32	`78A21901`
ssdeep	`6144:ScX97MFRbJQNGAtxPn1Rq7JaYBCn2JFKAveG2N9F15pRBbLTDE91lZJBx7rDz3SN:pARbONGAfP1R0JVEn2W8axif+`
Yara	Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]

EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office15\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\S58.CARGO_2021.08.09.xlsb
2300
- mshta.exe mshta "C:\ProgramData\fKAzXVkTeC.sct"
  160

Name	Response	Post-Analysis Lookup
loans.uhuruloans.com	A 67.225.140.14	67.225.140.14

IP Address	Status	Action
164.124.101.2	Active	Moloch
67.225.140.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 10, 2021, 5:36 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 10, 2021, 5:36 p.m.	process_identifier: 2300 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6b974000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:36 p.m.	process_identifier: 2300 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6b42e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:36 p.m.	process_identifier: 2300 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:36 p.m.	process_identifier: 2300 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:36 p.m.	process_identifier: 2300 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6b1e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:37 p.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:37 p.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:37 p.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:37 p.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:37 p.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:37 p.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:37 p.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:37 p.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:37 p.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:37 p.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:37 p.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04372000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:37 p.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04372000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:37 p.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04372000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:37 p.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04372000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2021, 5:37 p.m.	process_identifier: 160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04372000 process_handle: 0xffffffff	1

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Aug. 10, 2021, 5:36 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000474 filepath: C:\Users\test22\AppData\Local\Temp\~$S58.CARGO_2021.08.09.xlsb desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES\|DELETE\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$S58.CARGO_2021.08.09.xlsb create_options: 4198496 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0

Creates a suspicious process (1 event)

cmdline

mshta "C:\ProgramData\fKAzXVkTeC.sct"

File has been identified by 3 AntiVirus engines on VirusTotal as malicious (3 events)

Cyren	XF/SneakyBin.AC.gen!Camelot
Kaspersky	UDS:Exploit.MSOffice.CVE-2017-8570.gen
Alibaba	TrojanDownloader:VBA/MalDoc.ali1000101

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 10, 2021, 5:36 p.m.	process_identifier: 2300 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef70000 process_handle: 0xffffffff	1	0	0

One or more non-whitelisted processes were created (1 event)

parent_process

excel.exe

martian_process

mshta "C:\ProgramData\fKAzXVkTeC.sct"

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

67.225.140.14:443

S58.CARGO_2021.08.09.xlsb

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All