Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.17 10:11
wwbizsrvs.exe
11.15 01:11
wwbizsrvs.exe
11.15 01:11
op.exe
11.15 01:11
msf.exe
11.15 01:11
lum250.exe
11.15 01:11
msf443.exe
11.13 04:11
hello.exe
11.13 03:11
espsemhvcioff.exe
11.13 02:11
Geek_se.exe
11.13 02:11
cred64.dll

Latest News
11.18 09:11
아이케미스트, '2024 창업 경진대회'...
11.18 09:11
[AIS 2024 영상] 정일옥 이글루코...
11.18 09:11
[AIS 2024 영상] 이승훈 퓨쳐시스...
11.18 08:11
IT Sicherheitsnews woc...
11.18 08:11
IT Sicherheitsnews tae...
11.18 08:11
IT Sicherheitsnews stü...
11.18 08:11
[AIS 2024 영상] 최광희 세종 고...
11.18 08:11
Asia’s Richest Man Joi...
11.18 07:11
[AIS 2024 영상] 김기홍 샌즈랩 ...
11.18 07:11
Wall Street Bankers Sp...

Summary | ZeroBOX

doc-1271460016.xls

Downloader MSOffice File

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 5, 2021, 3:04 p.m.	Oct. 5, 2021, 3:06 p.m.

Size	229.0KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 18:19:34 2015, Last Saved Time/Date: Mon Oct 4 17:21:33 2021, Security: 0
MD5	`60f636f00050f303aa523c8edbe7aadf`
SHA256	`d04d3bab2e0c73ccb33a0f040ba64e6a8ae089087939ccd80a659ca1e831934d`
CRC32	`3FF3FAF1`
ssdeep	`6144:NKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgW9DW/cZZRBDq1JOb7AvOsPDMlovS3OPI7Z:B9D1TDmUb7AvDDy3fLvfv1O+Co`
Yara	Microsoft_Office_File_Zero - Microsoft Office File Microsoft_Office_File_Downloader_Zero - Microsoft Office File Downloader

EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\doc-1271460016.xls
112
- regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
  1892
- regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
  556
- regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
  2112

Name	Response	Post-Analysis Lookup
razatoursandtravels.com	A 65.60.58.202	65.60.58.202
7xwelfare.com	A 65.60.58.202	65.60.58.202
rosepetalsschool.com	A 65.60.58.202	65.60.58.202

IP Address	Status	Action
164.124.101.2	Active	Moloch
65.60.58.202	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 65.60.58.202:443 -> 192.168.56.101:49203	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49200 -> 65.60.58.202:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49206 -> 65.60.58.202:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49201 -> 65.60.58.202:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 65.60.58.202:443 -> 192.168.56.101:49207	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49211 -> 65.60.58.202:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49205 -> 65.60.58.202:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49210 -> 65.60.58.202:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 65.60.58.202:443 -> 192.168.56.101:49212	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 5, 2021, 3:04 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (16 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 5, 2021, 3:04 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dce1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 3:04 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dd3f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 3:04 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dd3f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 3:04 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 3:04 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 3:04 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 3:04 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73321000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 3:04 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dbf1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 3:04 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dbe1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 3:04 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dba1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 3:04 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6db91000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 3:04 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6db51000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 5, 2021, 3:04 p.m.	process_identifier: 112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06360000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 5, 2021, 3:04 p.m.	process_identifier: 112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06360000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 5, 2021, 3:04 p.m.	process_identifier: 112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 5, 2021, 3:04 p.m.	process_identifier: 112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Creates a suspicious process (6 events)

cmdline	regsvr32 C:\Datop\test.test
cmdline	"C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
cmdline	"C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
cmdline	"C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
cmdline	regsvr32 C:\Datop\test1.test
cmdline	regsvr32 C:\Datop\test2.test

Network communications indicative of a potential document or script payload download was initiated by the process excel.exe (3 events)

Time & API	Arguments	Status	Return	Repeated
URLDownloadToFileW Oct. 5, 2021, 3:04 p.m.	url: https://7xwelfare.com/n0LsDHNqyCii/ni.html stack_pivoted: 0 filepath_r: C:\Datop\test.test filepath: C:\Datop\test.test		2148270085	0
URLDownloadToFileW Oct. 5, 2021, 3:04 p.m.	url: https://razatoursandtravels.com/eVkGYa8BHO/ni.html stack_pivoted: 0 filepath_r: C:\Datop\test1.test filepath: C:\Datop\test1.test		2148270085	0
URLDownloadToFileW Oct. 5, 2021, 3:04 p.m.	url: https://rosepetalsschool.com/Rp49rtJdgh/ni.html stack_pivoted: 0 filepath_r: C:\Datop\test2.test filepath: C:\Datop\test2.test		2148270085	0

One or more non-whitelisted processes were created (6 events)

parent_process	excel.exe				martian_process	regsvr32 C:\Datop\test.test
parent_process	excel.exe				martian_process	"C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
parent_process	excel.exe				martian_process	"C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
parent_process	excel.exe				martian_process	"C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
parent_process	excel.exe				martian_process	regsvr32 C:\Datop\test1.test
parent_process	excel.exe				martian_process	regsvr32 C:\Datop\test2.test

The process excel.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Windows\System32\regsvr32.exe