Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 15, 2021, 9:25 a.m.	Sept. 15, 2021, 9:38 a.m.

Size	52.1KB
Type	Microsoft OOXML
MD5	`9021afcfefe0fd391eacd306de705448`
SHA256	`54d26a878e217bc7548eecbd70fdf8fcd22806e32b3d86fd7a45916d0f4e9243`
CRC32	`EBD1B1B2`
ssdeep	`768:HRgb/iFmhxEr83RGShdXbmgo+nWIgkKl4j3d80JsSPLWLlDw+8t+ARY8:xsgca8csmgo+twuj3dfJ5o8tz`
Yara	docx - Word 2007 file format detection

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\Invoice1.docx
2216

Name	Response	Post-Analysis Lookup
wiyolo.com	A 142.234.157.206	142.234.157.206

IP Address	Status	Action
142.234.157.206	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Performs some HTTP requests (6 events)

request	OPTIONS http://wiyolo.com/956fb7ffae6a93d9
request	OPTIONS http://wiyolo.com/956fb7ffae6a93d9/
request	PROPFIND http://wiyolo.com/956fb7ffae6a93d9
request	PROPFIND http://wiyolo.com/956fb7ffae6a93d9/
request	GET http://wiyolo.com/956fb7ffae6a93d9/remove.html
request	HEAD http://wiyolo.com/956fb7ffae6a93d9/remove.html

Allocates read-write-execute memory (usually to unpack itself) (39 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6caf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cab1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x765b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c9f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c961000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c951000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73321000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c8e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c8c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c7c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x765b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6bb41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6bb95000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6bb31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6b1e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6b1a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6afa1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6afa4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x65001000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06230000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06230000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06240000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06250000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 9:25 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x507c1000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$voice1.docx

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Sept. 15, 2021, 9:25 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000003ec filepath: C:\Users\test22\AppData\Local\Temp\~$voice1.docx desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$voice1.docx create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Libraries known to be associated with a CVE were requested (may be False Positive) (1 event)

cve	CVE-2013-3906

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

DrWeb	Exploit.CVE-2021-40444.1
MicroWorld-eScan	Exploit.CVE-2021-40444.Gen.1
FireEye	Exploit.CVE-2021-40444.Gen.1
CAT-QuickHeal	OLE.CVE-2021-40444.44117
Arcabit	Exploit.CVE-2021-40444.Gen.1
ESET-NOD32	DOC/TrojanDownloader.Agent.DHY
Avast	XML:CVE-2021-40444-A [Expl]
ClamAV	Doc.Exploit.CVE_2021_40444-9891528-0
Kaspersky	HEUR:Exploit.MSOffice.CVE-2021-40444.a
BitDefender	Exploit.CVE-2021-40444.Gen.1
NANO-Antivirus	Exploit.Xml.CVE-2017-0199.equmby
Rising	Exploit.CVE-2021-40444!1.D97D (CLASSIC)
Ad-Aware	Exploit.CVE-2021-40444.Gen.1
McAfee-GW-Edition	Exploit-CVE2021-40444.a
Emsisoft	Exploit.CVE-2021-40444.Gen.1 (B)
MAX	malware (ai score=84)
Microsoft	TrojanDownloader:O97M/Donoff.SA!Gen
ZoneAlarm	HEUR:Exploit.MSOffice.CVE-2021-40444.a
GData	Script.Exploit.CVE-2021-40444.A
McAfee	Exploit-CVE2021-40444.a
Ikarus	Exploit.CVE-2021-40444
Fortinet	MSOffice/Agent.DHY!tr
AVG	XML:CVE-2021-40444-A [Expl]

Invoice1.docx

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All