Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 24, 2021, 12:21 p.m.	Nov. 24, 2021, 12:23 p.m.

Size	893.0KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Kulo, Template: Normal.dotm, Last Saved By: Kulo, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Nov 23 11:33:00 2021, Last Saved Time/Date: Tue Nov 23 11:33:00 2021, Number of Pages: 1, Number of Words: 3, Number of Characters: 19, Security: 0
MD5	`f1c6229f50d427391bc57518e23ddb33`
SHA256	`61486bee4fdef7ac9ebaa909fa683e391636e4a6f744409ba8463a9834c63a13`
CRC32	`15F46ECC`
ssdeep	`24576:eEIZ4wAK74NAx5KxZTBG75gdhtYkzyHHrF:e+wZ74Nx3c75OcWyHH`
Yara	Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries] Generic_Malware_Zero - Generic Malware Microsoft_Office_File_Zero - Microsoft Office File

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\1123_4206263640.doc
2332
- cmd.exe cmd.exe /c ping localhost -n 10 & rundll32.exe c:\users\test22\appdata\roaming\microsoft\templates\iff.bin,GWCRALYCYIAUAFG
  2612
  - PING.EXE ping localhost -n 10
    2676
  - rundll32.exe rundll32.exe c:\users\test22\appdata\roaming\microsoft\templates\iff.bin,GWCRALYCYIAUAFG
    2804

Name	Response	Post-Analysis Lookup
api.ipify.org	CNAME api.ipify.org.herokudns.com A 52.20.78.240 A 3.220.57.224 A 3.232.242.170 A 54.91.59.199	3.232.242.170
templogio.com	A 95.47.161.27	95.47.161.27

IP Address	Status	Action
164.124.101.2	Active	Moloch
3.232.242.170	Active	Moloch
95.47.161.27	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49169 -> 3.232.242.170:80	2021997	ET POLICY External IP Lookup api.ipify.org	Device Retrieving External IP Address Detected

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Nov. 24, 2021, 12:21 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 24, 2021, 12:21 p.m.			0	0

Command line console output was observed (24 events)

Time & API	Arguments	Status	Return
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: Pinging test22-PC [::1] console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: with 32 bytes of data: console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: Ping statistics for ::1: Packets: Sent = 10, Received = 10, Lost = 0 (0% loss), console_handle: 0x00000007	1	1
WriteConsoleA Nov. 24, 2021, 12:21 p.m.	buffer: Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms console_handle: 0x00000007	1	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header

suspicious_request

POST http://templogio.com/9/forum.php

Performs some HTTP requests (2 events)

request	GET http://api.ipify.org/
request	POST http://templogio.com/9/forum.php

Sends data using the HTTP POST Method (1 event)

request

POST http://templogio.com/9/forum.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 58 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a5ed000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a1fe000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a39000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a39000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a39000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a39000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a39000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a39000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a3a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a3a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a3a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a3a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a39000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a39000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a39000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a3a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a3a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a39000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a39000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a39000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a4d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a4d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a4d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a4d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a4e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a4e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a4d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08a4d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08d0d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x101e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x1004a000 process_handle: 0xffffffff	1

Looks up the external IP address (1 event)

domain

api.ipify.org

Creates (office) documents on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\~$23_4206263640.doc
file	c:\Users\test22\AppData\Roaming\microsoft\templates\~$zoro.doc

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\zoro.doc.LNK

Creates hidden or system file (2 events)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Nov. 24, 2021, 12:21 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000004ac filepath: C:\Users\test22\AppData\Local\Temp\~$23_4206263640.doc desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$23_4206263640.doc create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0
NtCreateFile Nov. 24, 2021, 12:21 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x00000678 filepath: c:\Users\test22\AppData\Roaming\microsoft\templates\~$zoro.doc desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\c:\users\test22\appdata\roaming\microsoft\templates\~$zoro.doc create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\zoro.doc.LNK

Creates a suspicious process (1 event)

cmdline

cmd.exe /c ping localhost -n 10 & rundll32.exe c:\users\test22\appdata\roaming\microsoft\templates\iff.bin,GWCRALYCYIAUAFG

Word document hooks document open

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 24, 2021, 12:21 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef70000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Nov. 24, 2021, 12:21 p.m.	flags: 0 family: 2	1	0	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	cmd.exe /c ping localhost -n 10 & rundll32.exe c:\users\test22\appdata\roaming\microsoft\templates\iff.bin,GWCRALYCYIAUAFG
cmdline	ping localhost -n 10

A command shell or script process was created by an unexpected parent process (1 event)

parent_process

winword.exe

martian_process

cmd.exe /c ping localhost -n 10 & rundll32.exe c:\users\test22\appdata\roaming\microsoft\templates\iff.bin,GWCRALYCYIAUAFG

One or more non-whitelisted processes were created (1 event)

parent_process

winword.exe

martian_process

cmd.exe /c ping localhost -n 10 & rundll32.exe c:\users\test22\appdata\roaming\microsoft\templates\iff.bin,GWCRALYCYIAUAFG

The process winword.exe wrote an executable file to disk (1 event)