Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 21, 2023, 6:38 p.m.	July 21, 2023, 6:40 p.m.

Size	74.1KB
Type	Microsoft Word 2007+
MD5	`583489e24bfba0289d80fb987724d581`
SHA256	`c23f3600d9e2ff4c9e0d3df547ba61d0e8084b788e953e05f297fde7939beff2`
CRC32	`08E2CC52`
ssdeep	`1536:1j8lO63yVoxdRgfRGsZxUx+8h+pQah+s11kyJavfRGspYRTIh0DX0Dz0DcOjG/:O`
Yara	zip_file_format - ZIP file format docx - Word 2007 file format detection Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries] Microsoft_Office_File_Zero - Microsoft Office File

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\0.dotm
2572

Name	Response	Post-Analysis Lookup
independent.vittoriocas137.workers.dev	A 172.67.132.50 A 104.21.12.165	104.21.12.165

IP Address	Status	Action
104.21.12.165	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49163 -> 104.21.12.165:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49163 104.21.12.165:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=vittoriocas137.workers.dev	82:7a:33:57:99:a2:c0:cf:3f:2c:bc:b3:26:c3:4b:ce:ce:da:77:b8

Performs some HTTP requests (1 event)

request

GET https://independent.vittoriocas137.workers.dev/hWHU

Allocates read-write-execute memory (usually to unpack itself) (9 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x65001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dfa1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dfa4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e531000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x507c1000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$0.dotm

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile July 21, 2023, 6:38 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000003ec filepath: C:\Users\test22\AppData\Local\Temp\~$0.dotm desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$0.dotm create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (50 out of 1721 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1

Manipulates memory of a non-child process indicative of process injection (50 out of 1722 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2572 manipulating memory of non-child process 2704
NtAllocateVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0
NtProtectVirtualMemory July 21, 2023, 6:38 p.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000470	1	0	0

One or more non-whitelisted processes were created (1 event)

parent_process

winword.exe

martian_process

C:\Windows\\SysWOW64\\rundll32.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2572 resumed a thread in remote process 2704
NtResumeThread July 21, 2023, 6:38 p.m.	thread_handle: 0x00000478 suspend_count: 1 process_identifier: 2704	1	0	0

File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	VB:Trojan.Valyria.7135
CAT-QuickHeal	O97M.Donoff.B
VIPRE	VB:Trojan.Valyria.7135
Sangfor	Trojan.Macro.Inject.se
Arcabit	VB:Trojan.Valyria.D1BDF
Baidu	VBA.Trojan.Kryptik.d
Cyren	PP97M/Agent.ACE.gen!Eldorado
Symantec	Trojan Horse
ESET-NOD32	VBA/TrojanDownloader.Agent.WOE
Cynet	Malicious (score: 70)
TrendMicro-HouseCall	W2KM_POWLOAD.SME
Avast	VBS:HackTool-B [Trj]
ClamAV	Doc.Macro.Injection-6355574-0
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	VB:Trojan.Valyria.7135
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi
Tencent	OLE.Win32.Macro.704456
TACHYON	Suspicious/WOX.MDRP.Gen
Emsisoft	VB:Trojan.Valyria.7135 (B)
F-Secure	Trojan:W97M/MaliciousMacro.GEN2
DrWeb	W97M.DownLoader.2358
TrendMicro	W2KM_POWLOAD.SME
McAfee-GW-Edition	X97M/Downloader.j
FireEye	VB:Trojan.Valyria.7135
Sophos	ATK/VbShlCde-A
SentinelOne	Static AI - Malicious OPENXML
GData	Script.Trojan-Downloader.Agent.BJV
Avira	HEUR/Macro.Downloader
Xcitium	TrojWare.VBS.Crypt.BN@8aystx
Microsoft	Trojan:X97M/LionWolf.A
ZoneAlarm	HEUR:Trojan.Script.Agent.gen
Google	Detected
AhnLab-V3	VBA/Downloader.S12
Acronis	suspicious
McAfee	X97M/Downloader.j
MAX	malware (ai score=81)
Rising	Macro.Agent.bn (CLASSIC)
Ikarus	Trojan.VBA.Crypt
Fortinet	VBA/Agent.4BCC!tr
AVG	VBS:HackTool-B [Trj]

0.dotm

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All