diagram_1318555547.xls

Allocates read-write-execute memory (usually to unpack itself) (5 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 8, 2021, 5:21 p.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6bf98000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 5:21 p.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6b252000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 5:21 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c471000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 5:21 p.m.	process_identifier: 2756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c471000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 5:21 p.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c471000 process_handle: 0xffffffff	1	0	0

Creates a suspicious process (6 events)

cmdline	regsvr32 C:\Datop\test.test
cmdline	"C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
cmdline	"C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
cmdline	"C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
cmdline	regsvr32 C:\Datop\test1.test
cmdline	regsvr32 C:\Datop\test2.test

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 8, 2021, 5:21 p.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef60000 process_handle: 0xffffffff	1	0	0

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

CAT-QuickHeal	Excel4.Downloader.44317
Sangfor	Malware.Generic-XLM.Save.ma29
K7AntiVirus	Trojan ( 00568efb1 )
K7GW	Trojan ( 00568efb1 )
Symantec	Trojan.Gen.2
ESET-NOD32	DOC/TrojanDownloader.Agent.DIY
ClamAV	Xls.Downloader.SquirrelWaffle20921-9895790-0
Kaspersky	HEUR:Trojan.MSOffice.Generic
Tencent	Trojan.MsOffice.Macro40.11013976
DrWeb	X97M.DownLoader.714
McAfee-GW-Edition	X97M/Downloader.lg
Ikarus	Trojan-Downloader.Office.Crypt
Microsoft	TrojanDownloader:O97M/EncDoc.RQ!MTB
McAfee	X97M/Downloader.lg
Zoner	Probably Heur.W97ShellB
Fortinet	XF/Agent.AF!tr.dldr

Network communications indicative of a potential document or script payload download was initiated by the process excel.exe (3 events)

Time & API	Arguments	Status	Return	Repeated
URLDownloadToFileW Oct. 8, 2021, 5:21 p.m.	url: https://cortinastelasytrazos.com/Yro6Atvj/sec.html stack_pivoted: 0 filepath_r: C:\Datop\test.test filepath: C:\Datop\test.test		2148270085	0
URLDownloadToFileW Oct. 8, 2021, 5:21 p.m.	url: https://orquideavallenata.com/4jmDb0s9sg/sec.html stack_pivoted: 0 filepath_r: C:\Datop\test1.test filepath: C:\Datop\test1.test		2148270085	0
URLDownloadToFileW Oct. 8, 2021, 5:21 p.m.	url: https://fundacionverdaderosheroes.com/gY0Op5Jkht/sec.html stack_pivoted: 0 filepath_r: C:\Datop\test2.test filepath: C:\Datop\test2.test		2148270085	0

One or more non-whitelisted processes were created (6 events)

parent_process	excel.exe				martian_process	regsvr32 C:\Datop\test.test
parent_process	excel.exe				martian_process	"C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
parent_process	excel.exe				martian_process	"C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
parent_process	excel.exe				martian_process	"C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
parent_process	excel.exe				martian_process	regsvr32 C:\Datop\test1.test
parent_process	excel.exe				martian_process	regsvr32 C:\Datop\test2.test

The process excel.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Windows\System32\regsvr32.exe