Documents new.xlsb

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 9, 2021, 8 p.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6bdb2000 process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\tru.dll

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Sept. 9, 2021, 8 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000470 filepath: C:\Users\test22\AppData\Local\Temp\~$Documents new.xlsb desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$Documents new.xlsb create_options: 4198496 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0

Creates a suspicious process (1 event)

cmdline

regsvr32 -silent ..\tru.dll

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 9, 2021, 8 p.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef70000 process_handle: 0xffffffff	1	0	0

Network communications indicative of a potential document or script payload download was initiated by the process excel.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
URLDownloadToFileW Sept. 9, 2021, 8 p.m.	url: https://pawevi.com/lch5.dll stack_pivoted: 0 filepath_r: ..\tru.dll filepath: C:\Users\test22\tru.dll		2148270085	0

One or more non-whitelisted processes were created (1 event)

parent_process

excel.exe

martian_process

regsvr32 -silent ..\tru.dll

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

Lionic	Trojan.MSOffice.SLoad.a!c
MicroWorld-eScan	Trojan.GenericKD.46821851
FireEye	Trojan.GenericKD.46821851
ALYac	Trojan.Downloader.XLS.gen
Alibaba	TrojanDownloader:VBA/MalDoc.ali1000101
Cyren	XF/SneakyBin.AC.gen!Camelot
Symantec	Trojan.Gen.NPE
ESET-NOD32	a variant of Generik.HYXVNJK
Avast	Other:Malware-gen [Trj]
Kaspersky	HEUR:Trojan-Downloader.MSOffice.SLoad.gen
BitDefender	Trojan.GenericKD.46821851
Tencent	Trojan.MsOffice.Macro40.11013333
Ad-Aware	Trojan.GenericKD.46821851
Emsisoft	Trojan.GenericKD.46821851 (B)
McAfee-GW-Edition	Artemis!Trojan
Ikarus	Trojan.SuspectCRC
Avira	W97M/Dldr.Sload.mhxaz
Gridinsoft	Trojan.U.Downloader.oa
ViRobot	XLS.Z.Agent.332087
GData	Trojan.GenericKD.46821851
Cynet	Malicious (score: 99)
AhnLab-V3	Downloader/XLS.Agent
MAX	malware (ai score=87)
Fortinet	MSExcel/Agent.4214!tr.dldr
AVG	Other:Malware-gen [Trj]