Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 7, 2021, 10:41 a.m.	Nov. 7, 2021, 10:44 a.m.

Size	22.6KB
Type	Microsoft Word 2007+
MD5	`8299c65b3c9e10900aaedf20da44cea6`
SHA256	`fa1f9f5deac24c735baa77eb5b76b9057b3fea6c2bc7f2bf7f16420a8b48f00c`
CRC32	`06EE862D`
ssdeep	`384:t+5mtPYFpRRO9z3mDrBQei85RllJoWInw57j8v55nqPbhepJ/NwUmWpU3rUl:oCMRMzdARDJPInojinqMpleipU3Al`
Yara	Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries] docx - Word 2007 file format detection

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\1.dotm
2376

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
47.94.236.117	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (14 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a1fe000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06a4c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06a4c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06a4c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06a4c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06a4c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06a4c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06a4c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06a4c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06a4c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0456a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04569000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0456a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04569000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$1.dotm

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Nov. 7, 2021, 10:41 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x00000490 filepath: C:\Users\test22\AppData\Local\Temp\~$1.dotm desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$1.dotm create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef60000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

47.94.236.117

Allocates execute permission to another process indicative of possible code injection (50 out of 1597 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1

Manipulates memory of a non-child process indicative of process injection (50 out of 1598 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2376 manipulating memory of non-child process 2580
NtAllocateVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0
NtProtectVirtualMemory Nov. 7, 2021, 10:41 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x000005b0	1	0	0

One or more non-whitelisted processes were created (1 event)

parent_process

winword.exe

martian_process

C:\Windows\\SysWOW64\\rundll32.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2376 resumed a thread in remote process 2580
NtResumeThread Nov. 7, 2021, 10:41 a.m.	thread_handle: 0x000005b8 suspend_count: 1 process_identifier: 2580	1	0	0

File has been identified by 33 AntiVirus engines on VirusTotal as malicious (33 events)

Lionic	Trojan.Script.Agent.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	VB:Trojan.Valyria.3573
FireEye	VB:Trojan.Valyria.3573
CAT-QuickHeal	O97M.Donoff.B
Sangfor	Malware.Generic-VBS.Save.f5fb1099
Alibaba	TrojanDownloader:VBA/MalDoc.ali1000101
K7GW	Trojan ( 00578b5e1 )
K7AntiVirus	Trojan ( 00578b5e1 )
Baidu	VBA.Trojan.Kryptik.d
Cyren	PP97M/Agent.ACE.gen!Eldorado
Symantec	Trojan Horse
ESET-NOD32	VBA/TrojanDownloader.Agent.WOE
TrendMicro-HouseCall	W2KM_POWLOAD.SME
ClamAV	Doc.Macro.Injection-6355574-0
BitDefender	VB:Trojan.Valyria.3573
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi
Rising	Macro.Agent.bn (CLASSIC)
Ad-Aware	VB:Trojan.Valyria.3573
Sophos	ATK/VbShlCde-A
DrWeb	W97M.DownLoader.631
TrendMicro	W2KM_POWLOAD.SME
Emsisoft	VB:Trojan.Valyria.3573 (B)
Ikarus	Trojan.VBA.Crypt
Avira	HEUR/Macro.Downloader
MAX	malware (ai score=84)
ViRobot	DOC.Z.Agent.23168
GData	VB:Trojan.Valyria.3573
AhnLab-V3	VBA/Downloader.S12
TACHYON	Suspicious/WOX.MDRP.Gen
Tencent	OLE.Win32.Macro.704456
SentinelOne	Static AI - Malicious OPENXML
Fortinet	VBA/Kryptik.A!tr

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 events)

dead_host	192.168.56.103:49165
dead_host	47.94.236.117:9999

1.dotm

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All