Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 27, 2021, 2:48 p.m.	Sept. 27, 2021, 2:50 p.m.

Size	862.9KB
Type	Microsoft Word 2007+
MD5	`ebfa7b412fe87af4bf586472f6f274c5`
SHA256	`b00d27bb7b9a1962dd8166ec51b4497b71bf47120fdb96e0d058d2136d190b57`
CRC32	`E035E691`
ssdeep	`24576:YKMGlCX0q4m+Vsd0GYAi4XWRtvzS5yPK3Z/5eIaq4G7gUozAK:YKDq41kxfGXvO5yPa/cIjMt`
Yara	docx - Word 2007 file format detection

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\Afghanistan-is-rich-in-minerals-but-getting-to-them-is-challenging.docx
1940
- MSOSYNC.EXE "C:\Program Files (x86)\Microsoft Office\Office15\MsoSync.exe"
  2688

Name	Response	Post-Analysis Lookup
aljazeera.cc	A 181.214.31.79	181.214.31.79

IP Address	Status	Action
164.124.101.2	Active	Moloch
181.214.31.79	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:53893 -> 164.124.101.2:53	2027758	ET DNS Query for .cc TLD	Potentially Bad Traffic
TCP 192.168.56.103:49169 -> 181.214.31.79:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.103:49168 -> 181.214.31.79:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.103:49169 -> 181.214.31.79:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.103:49168 -> 181.214.31.79:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.103:49168 -> 181.214.31.79:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 181.214.31.79:443 -> 192.168.56.103:49169	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 181.214.31.79:443 -> 192.168.56.103:49169	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 181.214.31.79:443 -> 192.168.56.103:49168	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 181.214.31.79:443 -> 192.168.56.103:49168	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameA Sept. 27, 2021, 2:48 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 27, 2021, 2:48 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 27, 2021, 2:48 p.m.	computer_name: TEST22-PC	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Registration\{91150000-0011-0000-0000-0000000FF1CE}\DigitalProductID

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 27, 2021, 2:48 p.m.		1	1	0

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

aljazeera.cc

description

Cocos Islands domain TLD

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a216000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a114000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a0d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a042000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x69cd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01251000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 2688 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00670000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fb2f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 2688 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x35180000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75180000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 65536 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x35180000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75179000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 65536 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x35180000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75181000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75187000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6af44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x738ba000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a216000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a042000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x695d1000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$ghanistan-is-rich-in-minerals-but-getting-to-them-is-challenging.docx

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Sept. 27, 2021, 2:48 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x00000488 filepath: C:\Users\test22\AppData\Local\Temp\~$ghanistan-is-rich-in-minerals-but-getting-to-them-is-challenging.docx desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$ghanistan-is-rich-in-minerals-but-getting-to-them-is-challenging.docx create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 events)

ESET-NOD32	DOC/TrojanDownloader.Agent.ARJ
TrendMicro-HouseCall	TROJ_FRS.VSNW1AI21
Avast	Other:Malware-gen [Trj]
Kaspersky	HEUR:Trojan-Downloader.MSOffice.Dotmer.gen
NANO-Antivirus	Exploit.Xml.CVE-2017-0199.equmby
Sophos	Troj/DocDl-AEIR
Rising	Exploit.ExtLink/OFFICE!1.C97A (CLASSIC)
AVG	Other:Malware-gen [Trj]

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 27, 2021, 2:48 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef60000 process_handle: 0xffffffff	1	0	0

Malicious document featuring Office DDE has been identified (1 event)

One or more non-whitelisted processes were created (1 event)

parent_process

winword.exe

martian_process

C:\Program Files (x86)\Microsoft Office\Office15\MSOSYNC.EXE

Uses Sysinternals tools in order to add additional command line functionality (1 event)

cmdline

C:\Program Files (x86)\Microsoft Office\Office15\MSOSYNC.EXE

Zeus P2P (Banking Trojan) (27 events)

mutex	Local\Microsoft_Office_15Csi_TableRuntimeBucketsLock:{F67652BA-0F41-4F64-8380-9850372555E7}
mutex	Local\Microsoft_Office_15CSI_OMTX:{723E7339-CA26-4A2C-93ED-E4BB2979B83B}
mutex	Local\Microsoft_Office_15Csi_CTTxnTableLock:{56E7129E-5267-4F11-8C92-EAAC6A93C76C}:TID{48DEC616-56E4-4F30-8030-C51111C102A9}
mutex	Local\Microsoft_Office_15CSI_WDW:{7019502D-2B31-4340-86B7-46ABA5D12D96}
mutex	Local\Microsoft_Office_15CSI_WDW:{723E7339-CA26-4A2C-93ED-E4BB2979B83B}
mutex	Global\Microsoft_Office_15Csi:GC:C:/Users/test22/AppData/Local/Microsoft/Office/15.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF
mutex	Local\Microsoft_Office_15CSI_WDW:{5D5017D3-74EC-471D-B5F2-F49FAD4DDEB3}
mutex	Local\Microsoft_Office_15Csi_CTTxnTableLock:{56E7129E-5267-4F11-8C92-EAAC6A93C76C}:TID{5585BD79-2A2B-4359-8F93-404ED6147369}
mutex	Local\Microsoft_Office_15Csi_CTTxnTableLock:{56E7129E-5267-4F11-8C92-EAAC6A93C76C}:TID{BFCEF68A-3F40-481B-B237-FD551CEC6C8A}
mutex	Local\Microsoft_Office_15CSI_OMTX:{5D5017D3-74EC-471D-B5F2-F49FAD4DDEB3}
mutex	Local\Microsoft_Office_15CSI_WDW:{56CC461A-82F9-40B5-97F9-65D4559FDF49}
mutex	Local\Microsoft_Office_15Csi_CTTxnTableLock:{56E7129E-5267-4F11-8C92-EAAC6A93C76C}:TID{D0A49606-3BBC-45A0-A810-6E7F9720E394}
mutex	Local\Microsoft_Office_15Csi_CTTxnTableLock:{56E7129E-5267-4F11-8C92-EAAC6A93C76C}:TID{F85AF7C9-265C-434D-ACAE-E783DFE17053}
mutex	Local\Microsoft_Office_15CSI_WDW:{0197864C-9ADB-422C-9CB4-517063C37373}
mutex	Local\Microsoft_Office_15CSI_OMTX:{98EAF636-1A01-4810-B675-27F2EF0AB09C}
mutex	Local\Microsoft_Office_15Csi_CTTxnTableLock:{56E7129E-5267-4F11-8C92-EAAC6A93C76C}:TID{4A6D6FD4-6B5E-4B91-B650-BF1EC9669D4C}
mutex	Local\Microsoft_Office_15CSI_WDW:{98EAF636-1A01-4810-B675-27F2EF0AB09C}
mutex	Local\Microsoft_Office_15CSI_WDW:{2AA5C200-022C-48A8-B001-5BEDEE449613}
mutex	Local\Microsoft_Office_15CSI_WDW:{F67652BA-0F41-4F64-8380-9850372555E7}
mutex	Local\Microsoft_Office_15Csi_CTTxnTableLock:{56E7129E-5267-4F11-8C92-EAAC6A93C76C}:TID{16284F64-D1CB-4015-ACFA-9E3944D6B6DD}
mutex	Local\Microsoft_Office_15Csi_CTTxnTableLock:{56E7129E-5267-4F11-8C92-EAAC6A93C76C}:TID{7A3B9BC8-95AF-498B-A58A-AB578703D72A}
mutex	Local\Microsoft_Office_15CSI_WDW:{0D26ED19-B922-42EF-BE63-3582DDAA80E9}
udp	{u'src': u'192.168.56.103', u'dst': u'239.255.255.250', u'offset': 12014, u'time': 4.177455902099609, u'dport': 3702, u'sport': 49152}
udp	{u'src': u'192.168.56.103', u'dst': u'239.255.255.250', u'offset': 20394, u'time': 4.777735948562622, u'dport': 1900, u'sport': 49168}
udp	{u'src': u'192.168.56.103', u'dst': u'239.255.255.250', u'offset': 26512, u'time': 4.634357929229736, u'dport': 3702, u'sport': 49170}
udp	{u'src': u'192.168.56.103', u'dst': u'239.255.255.250', u'offset': 29368, u'time': 4.785506010055542, u'dport': 3702, u'sport': 49172}
udp	{u'src': u'192.168.56.103', u'dst': u'239.255.255.250', u'offset': 32096, u'time': 8.883843898773193, u'dport': 3702, u'sport': 53894}

Afghanistan-is-rich-in-minerals-but-getting-to-them-is-challenging.docx

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All