Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 12, 2021, 8:03 a.m.	Nov. 12, 2021, 8:05 a.m.

Size	446.5KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 936, Author: SLL, Template: Normal.dotm, Last Saved By: SLL, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Sat Sep 25 11:31:00 2021, Last Saved Time/Date: Sat Sep 25 11:31:00 2021, Number of Pages: 1, Number of Words: 44, Number of Characters: 255, Security: 0
MD5	`a90e6ede67996b3825adb6b8c5b2a204`
SHA256	`de7eab879e9fd5ae72a2dea73ec5b2e49957617c5f6d7fa4a61819054f52c528`
CRC32	`900C43A1`
ssdeep	`12288:EcxMPEVrmuJu5ELqj7SYicxMP4Vrm9Ju5:fxVcuXujdx5c9`
Yara	Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries] Generic_Malware_Zero - Generic Malware Microsoft_Office_File_Zero - Microsoft Office File

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\%e5%85%b3%e4%ba%8e%e5%bc%80%e5%b1%95%e8%b4%a2%e5%8a%a1%e4%b8%93%e9%a1%b9%e6%a3%80%e6%9f%a5%e7%9a%84%e9%80%9a%e7%9f%a5.doc
2320

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
101.35.100.211	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (17 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a5ed000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a07e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752fb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x072ef000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x072ef000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x072ef000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x072ef000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x072ef000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x072ef000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x072ef000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x072ef000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x072ef000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x072bb000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$5%85%b3%e4%ba%8e%e5%bc%80%e5%b1%95%e8%b4%a2%e5%8a%a1%e4%b8%93%e9%a1%b9%e6%a3%80%e6%9f%a5%e7%9a%84%e9%80%9a%e7%9f%a5.doc

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Nov. 12, 2021, 8:03 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000004a4 filepath: C:\Users\test22\AppData\Local\Temp\~$5%85%b3%e4%ba%8e%e5%bc%80%e5%b1%95%e8%b4%a2%e5%8a%a1%e4%b8%93%e9%a1%b9%e6%a3%80%e6%9f%a5%e7%9a%84%e9%80%9a%e7%9f%a5.doc desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$5%85%b3%e4%ba%8e%e5%bc%80%e5%b1%95%e8%b4%a2%e5%8a%a1%e4%b8%93%e9%a1%b9%e6%a3%80%e6%9f%a5%e7%9a%84%e9%80%9a%e7%9f%a5.doc create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef70000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

101.35.100.211

Allocates execute permission to another process indicative of possible code injection (50 out of 1599 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1

Manipulates memory of a non-child process indicative of process injection (50 out of 1600 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2320 manipulating memory of non-child process 2624
NtAllocateVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0
NtProtectVirtualMemory Nov. 12, 2021, 8:03 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000610	1	0	0

One or more non-whitelisted processes were created (1 event)

parent_process

winword.exe

martian_process

C:\Windows\\SysWOW64\\rundll32.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2320 resumed a thread in remote process 2624
NtResumeThread Nov. 12, 2021, 8:03 a.m.	thread_handle: 0x00000618 suspend_count: 1 process_identifier: 2624	1	0	0

File has been identified by 40 AntiVirus engines on VirusTotal as malicious (40 events)

Lionic	Trojan.Script.Generic.a!c
Elastic	malicious (high confidence)
ClamAV	Doc.Macro.Injection-6355574-0
CAT-QuickHeal	W97M.Donoff.B
ALYac	Trojan.Downloader.DOC.Gen
Sangfor	Malware.Generic-VBS.Save.f5fb1099
Arcabit	VB:Trojan.Valyria.163
Cyren	W97M/Agent.ACE.gen!Eldorado
ESET-NOD32	VBA/TrojanDownloader.Agent.WOE
Baidu	VBA.Trojan.Kryptik.d
TrendMicro-HouseCall	W2KM_POWLOAD.SME
Avast	VBA:Dropper-AK [Trj]
Cynet	Malicious (score: 99)
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	VB:Trojan.Valyria.163
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi
ViRobot	DOC.Z.Agent.457216
MicroWorld-eScan	VB:Trojan.Valyria.163
Rising	Macro.Agent.bn (CLASSIC)
Ad-Aware	VB:Trojan.Valyria.163
Sophos	ATK/VbShlCde-A
Comodo	TrojWare.VBS.Crypt.BN@8aystx
DrWeb	W97M.DownLoader.631
TrendMicro	W2KM_POWLOAD.SME
McAfee-GW-Edition	BehavesLike.OLE2.Downloader.gb
FireEye	VB:Trojan.Valyria.163
Emsisoft	VB:Trojan.Valyria.163 (B)
Ikarus	Trojan.VBA.Crypt
Avira	VBA/Dldr.Agent.dtfve
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMacro.2DA0F
Microsoft	TrojanDownloader:O97M/Bartallex.AA
GData	VB:Trojan.Valyria.163
AhnLab-V3	VBA/Downloader.S12
McAfee	RDN/Bartallex
TACHYON	Suspicious/W97M.MDRP.Gen
Tencent	OLE.Win32.Macro.704456
SentinelOne	Static AI - Malicious OLE
Fortinet	VBA/Kryptik.A!tr
AVG	VBA:Dropper-AK [Trj]

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 events)

dead_host	192.168.56.103:49164
dead_host	101.35.100.211:58888

%e5%85%b3%e4%ba%8e%e5%bc%80%e5%b1%95%e8%b4%a2%e5%8a%a1%e4%b8%93%e9%a1%b9%e6%a3%80%e6%9f%a5%e7%9a%84%e9%80%9a%e7%9f%a5.doc

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All