Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

specification-1114748542.xls

KeyLogger ScreenShot AntiDebug MSOffice File AntiVM

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 23, 2021, 9:30 a.m.	Sept. 23, 2021, 9:32 a.m.

Size	258.0KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Last Saved By: Vdgtjghk, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 18:19:34 2015, Last Saved Time/Date: Wed Sep 22 07:32:13 2021, Security: 0
MD5	`bcf85cb453a5827d672791aa29c7f398`
SHA256	`593f8b47248e16e08fc041bf4f0cf2d0942c30c3da1678d4390ef6450711d5c1`
CRC32	`2C17E060`
ssdeep	`6144:wKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg9nfb7I6+tqDWcwnoRZzlj+oSGpGvhmmmmf:Hj7CqScwoRZ9bSXkh/nLoH`
Yara	Microsoft_Office_File_Zero - Microsoft Office File

EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\specification-1114748542.xls
2100

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 23, 2021, 9:30 a.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6b5c7000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (11 events)

description	Run a KeyLogger				rule	KeyLogger
description	Take ScreenShot				rule	ScreenShot
description	(no description)				rule	DebuggerCheck__GlobalFlags
description	(no description)				rule	DebuggerCheck__QueryInfo
description	(no description)				rule	DebuggerHiding__Thread
description	(no description)				rule	DebuggerHiding__Active
description	(no description)				rule	ThreadControl__Context
description	(no description)				rule	SEH__vectored
description	Checks if being debugged				rule	anti_dbg
description	Bypass DEP				rule	disable_dep
description	Affect hook table				rule	win_hook

One or more non-whitelisted processes were created (1 event)

parent_process

excel.exe

martian_process

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /Embedding

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2100 resumed a thread in remote process 1644
NtResumeThread Sept. 23, 2021, 9:30 a.m.	thread_handle: 0x0000046c suspend_count: 1 process_identifier: 1644	1	0	0