Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 6, 2021, 8:39 a.m.	Sept. 6, 2021, 8:41 a.m.

Size	430.5KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: kell, Template: Normal.dotm, Last Saved By: MyPc, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Sep 1 09:52:00 2021, Last Saved Time/Date: Wed Sep 1 09:52:00 2021, Number of Pages: 1, Number of Words: 3, Number of Characters: 19, Security: 0
MD5	`b4095bc22ff3f27dd088852a49338c08`
SHA256	`2c4557c9b0b5f18c6cffb810cbbb07601ae0b1b071658611523bf980d814d7b8`
CRC32	`093E5F00`
ssdeep	`12288:0V9iQsDr8New5KY01lEIbcUXoDCWyK8hIxYfjP:0VXkr8NewozcmTEx6`
Yara	Generic_Malware_Zero - Generic Malware Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries] Microsoft_Office_File_Zero - Microsoft Office File

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\0902_6686864155.doc
2508
- rundll32.exe rundll32 c:\users\test22\appdata\roaming\microsoft\templates\yefff.dll,VVNOUNDWUMR
  2132

Name	Response	Post-Analysis Lookup
asinvotheir.com	A 185.230.91.127	185.230.91.127
api.ipify.org	A 54.235.244.43 A 50.16.185.207 CNAME nagano-19599.herokussl.com A 50.16.244.183 A 50.17.226.156 A 50.17.229.70 A 50.19.119.155 A 50.16.239.65 CNAME elb097307-934924932.us-east-1.elb.amazonaws.com A 23.21.173.155	50.16.185.207
clatrommon.ru	A 46.148.26.93	46.148.26.93
ditrismale.ru	A 176.105.252.131	176.105.252.131

IP Address	Status	Action
164.124.101.2	Active	Moloch
176.105.252.131	Active	Moloch
185.230.91.127	Active	Moloch
46.148.26.93	Active	Moloch
50.16.239.65	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49177 -> 50.16.239.65:80	2021997	ET POLICY External IP Lookup api.ipify.org	Device Retrieving External IP Address Detected

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Sept. 6, 2021, 8:40 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 6, 2021, 8:40 a.m.			0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (1 event)

request

GET http://api.ipify.org/

Resolves a suspicious Top Level Domain (TLD) (2 events)

domain	clatrommon.ru				description	Russian Federation domain TLD
domain	ditrismale.ru				description	Russian Federation domain TLD

Allocates read-write-execute memory (usually to unpack itself) (50 out of 67 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a85d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a46e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c0c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c0c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c0c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c0c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c0e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c0e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c0c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c0c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x089fa000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x089fa000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x089fa000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x089fa000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a4e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a50000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a50000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a50000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a50000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a4e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x089fa000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x089fa000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a50000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a50000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a50000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a50000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a50000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a50000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a50000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a50000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a50000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a50000 process_handle: 0xffffffff	1

Looks up the external IP address (1 event)

domain

api.ipify.org

Creates (office) documents on the filesystem (2 events)

file	c:\Users\test22\AppData\Roaming\microsoft\templates\~$glib.doc
file	C:\Users\test22\AppData\Local\Temp\~$02_6686864155.doc

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\jjy.dll
file	C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\glib.doc.LNK

Creates hidden or system file (2 events)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Sept. 6, 2021, 8:39 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000004ac filepath: C:\Users\test22\AppData\Local\Temp\~$02_6686864155.doc desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$02_6686864155.doc create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0
NtCreateFile Sept. 6, 2021, 8:39 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x0000066c filepath: c:\Users\test22\AppData\Roaming\microsoft\templates\~$glib.doc desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\c:\users\test22\appdata\roaming\microsoft\templates\~$glib.doc create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\glib.doc.LNK

Word document hooks document open

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 6, 2021, 8:39 a.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef70000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 6, 2021, 8:40 a.m.	flags: 0 family: 2	1	0	0

File has been identified by 17 AntiVirus engines on VirusTotal as malicious (17 events)

Lionic	Trojan.Script.Generic.b!c
MicroWorld-eScan	VB:Trojan.Valyria.5252
ALYac	VB:Trojan.Valyria.5252
VIPRE	LooksLike.Macro.Malware.k (v)
Cyren	W97M/Agent.ABS.gen!Eldorado
ESET-NOD32	a variant of VBA/TrojanDropper.Agent.CDU
Avast	Script:SNH-gen [Trj]
Kaspersky	HEUR:Trojan-Dropper.Script.Generic
BitDefender	VB:Trojan.Valyria.5252
Tencent	Heur.Macro.Generic.c.a300810b
Ad-Aware	VB:Trojan.Valyria.5252
FireEye	VB:Trojan.Valyria.5252
SentinelOne	Static AI - Suspicious OLE
GData	VB:Trojan.Valyria.5252
MAX	malware (ai score=87)
Ikarus	Trojan-Dropper.VBA.Agent
AVG	Script:SNH-gen [Trj]

One or more non-whitelisted processes were created (1 event)

parent_process

winword.exe

martian_process

rundll32 c:\users\test22\appdata\roaming\microsoft\templates\yefff.dll,VVNOUNDWUMR

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (3 events)

Time & API	Arguments	Status	Return	Repeated
HttpSendRequestA Sept. 6, 2021, 8:40 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: GUID=8962251904648732308&BUILD=0109_iqwnm&INFO=TEST22-PC @ test22-PC\test22&EXT=&IP=175.208.134.150&TYPE=1&WIN=6.1(x64)		0	0
HttpSendRequestA Sept. 6, 2021, 8:40 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: GUID=8962251904648732308&BUILD=0109_iqwnm&INFO=TEST22-PC @ test22-PC\test22&EXT=&IP=175.208.134.150&TYPE=1&WIN=6.1(x64)		0	0
HttpSendRequestA Sept. 6, 2021, 8:41 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: GUID=8962251904648732308&BUILD=0109_iqwnm&INFO=TEST22-PC @ test22-PC\test22&EXT=&IP=175.208.134.150&TYPE=1&WIN=6.1(x64)		0	0

The process winword.exe wrote an executable file to disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\jjy.dll

Generates some ICMP traffic

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 events)

dead_host	46.148.26.93:80
dead_host	185.230.91.127:80
dead_host	176.105.252.131:80

0902_6686864155.doc

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All