Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 1, 2021, 4:40 p.m.	Oct. 1, 2021, 4:42 p.m.

Size	57.4KB
Type	Microsoft Word 2007+
MD5	`a91be9529d06cd4a6c06a01b5c595630`
SHA256	`034cfe57d26cfea4139cf7bb387b9ba8f8705e44d3868e5edc36af0f7a8aa5bf`
CRC32	`A0B2EE82`
ssdeep	`1536:KhU4q2xdbzCmVk6I/bJHU1oQmZqBWEiorSxL6f1Y6:8PqYVAbJ0yQmZqBW6r3f7`
Yara	Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries] docx - Word 2007 file format detection

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\Ticket00073146.docm
1608
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Reflection.Assembly]::LoadFile('C:\Users\test22\AppData\Local\Temp\skfk.txt');$doo = New-Object Tysdf.Class1;$doo.sadkj()
  2088

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 1, 2021, 4:40 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2021, 4:40 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2021, 4:40 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2021, 4:40 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 1, 2021, 4:40 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2021, 4:40 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 1, 2021, 4:40 p.m.			0	0

Command line console output was observed (24 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: Exception calling "LoadFile" with "1" argument(s): "This assembly is built by a console_handle: 0x00000023	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: runtime newer than the currently loaded runtime and cannot be loaded. (Excepti console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: on from HRESULT: 0x8013101B)" console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: At line:1 char:32 console_handle: 0x00000047	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: + [Reflection.Assembly]::LoadFile <<<< ('C:\Users\test22\AppData\Local\Temp\skf console_handle: 0x00000053	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: k.txt');$doo = New-Object Tysdf.Class1;$doo.sadkj() console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x00000077	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: New-Object : Cannot find type [Tysdf.Class1]: make sure the assembly containing console_handle: 0x00000097	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: this type is loaded. console_handle: 0x000000a3	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: At line:1 char:97 console_handle: 0x000000af	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: + [Reflection.Assembly]::LoadFile('C:\Users\test22\AppData\Local\Temp\skfk.txt' console_handle: 0x000000bb	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: );$doo = New-Object <<<< Tysdf.Class1;$doo.sadkj() console_handle: 0x000000c7	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: + CategoryInfo : InvalidType: (:) [New-Object], PSArgumentExcepti console_handle: 0x000000d3	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: on console_handle: 0x000000df	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: + FullyQualifiedErrorId : TypeNotFound,Microsoft.PowerShell.Commands.NewOb console_handle: 0x000000eb	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: jectCommand console_handle: 0x000000f7	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: You cannot call a method on a null-valued expression. console_handle: 0x00000117	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: At line:1 char:121 console_handle: 0x00000123	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: + [Reflection.Assembly]::LoadFile('C:\Users\test22\AppData\Local\Temp\skfk.txt' console_handle: 0x0000012f	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: );$doo = New-Object Tysdf.Class1;$doo.sadkj <<<< () console_handle: 0x0000013b	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: + CategoryInfo : InvalidOperation: (sadkj:String) [], RuntimeExce console_handle: 0x00000147	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: ption console_handle: 0x00000153	1	1
WriteConsoleW Oct. 1, 2021, 4:40 p.m.	buffer: + FullyQualifiedErrorId : InvokeMethodOnNull console_handle: 0x0000015f	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 51 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0070fc28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007101a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007101a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007101a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007103a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007103a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007103a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007103a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007103a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007103a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007101a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007101a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007101a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0070f7e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0070f7e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0070f7e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007100a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0070f7e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0070f7e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0070f7e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0070f7e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0070f7e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0070f7e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0070f7e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2021, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00710468 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 1, 2021, 4:40 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 169 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a34e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7620b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ab5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ab5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ab5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ab5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ab5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ab5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d06000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02620000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02770000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x69161000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0238a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x69162000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02382000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02392000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02771000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02772000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02393000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02394000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0240b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0238b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02405000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02395000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02396000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0240c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$cket00073146.docm

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Oct. 1, 2021, 4:40 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x00000490 filepath: C:\Users\test22\AppData\Local\Temp\~$cket00073146.docm desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$cket00073146.docm create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	Powershell [Reflection.Assembly]::LoadFile('C:\Users\test22\AppData\Local\Temp\skfk.txt');$doo = New-Object Tysdf.Class1;$doo.sadkj()
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Reflection.Assembly]::LoadFile('C:\Users\test22\AppData\Local\Temp\skfk.txt');$doo = New-Object Tysdf.Class1;$doo.sadkj()

Word document hooks document close

Word document hooks document open

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\skfk.txt

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Oct. 1, 2021, 4:40 p.m.	show_type: 0 filepath_r: Powershell parameters: [Reflection.Assembly]::LoadFile('C:\Users\test22\AppData\Local\Temp\skfk.txt');$doo = New-Object Tysdf.Class1;$doo.sadkj() filepath: Powershell	1	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 1, 2021, 4:40 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef70000 process_handle: 0xffffffff	1	0	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 1, 2021, 4:40 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

File has been identified by 19 AntiVirus engines on VirusTotal as malicious (19 events)

Elastic	malicious (high confidence)
Arcabit	VB.Heur2.PwShell.2.44355A71.Gen
Symantec	ISB.Downloader!gen84
Kaspersky	HEUR:Trojan-Downloader.Script.Generic
BitDefender	VB.Heur2.PwShell.2.44355A71.Gen
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi
MicroWorld-eScan	VB.Heur2.PwShell.2.44355A71.Gen
Tencent	Heur.Macro.Generic.a.14e6b9e2
Ad-Aware	VB.Heur2.PwShell.2.44355A71.Gen
Emsisoft	VB.Heur2.PwShell.2.44355A71.Gen (B)
DrWeb	modification of W97M.Suspicious.1
McAfee-GW-Edition	BehavesLike.Downloader.qc
FireEye	VB.Heur2.PwShell.2.44355A71.Gen
GData	VB.Heur2.PwShell.2.44355A71.Gen
ZoneAlarm	HEUR:Trojan-Downloader.Script.Generic
TACHYON	Suspicious/WOX.Obfus.Gen.8
MAX	malware (ai score=87)
SentinelOne	Static AI - Malicious OPENXML
Fortinet	VBA/Agent.2EA16!tr.dldr

One or more non-whitelisted processes were created (2 events)

parent_process	winword.exe				martian_process	Powershell [Reflection.Assembly]::LoadFile('C:\Users\test22\AppData\Local\Temp\skfk.txt');$doo = New-Object Tysdf.Class1;$doo.sadkj()
parent_process	winword.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Reflection.Assembly]::LoadFile('C:\Users\test22\AppData\Local\Temp\skfk.txt');$doo = New-Object Tysdf.Class1;$doo.sadkj()

The process winword.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Users\test22\AppData\Local\Temp\skfk.txt
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Ticket00073146.docm

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All