Summary | ZeroBOX

4c12d617aa51bb0c0108242da6aa0071.docm

VBA_macro Word 2007 file format(docx) ZIP Format
Category Machine Started Completed
FILE s1_win7_x6401 July 18, 2024, 10:52 a.m. July 18, 2024, 10:54 a.m.
Size 57.3KB
Type Microsoft Word 2007+
MD5 4c12d617aa51bb0c0108242da6aa0071
SHA256 ee088f55e7cbc5d797c5b030f880b96708d86103e60d2e89fbc6b8bf2cdf6130
CRC32 ABF0A599
ssdeep 1536:ZZvvDiCRMOeIF7fankKddtXFMrI3eP40fcyD:zve7MUkK1O4qX
Yara
  • docx - Word 2007 file format detection
  • zip_file_format - ZIP file format
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleW

buffer: 'C:\Users\test22\AppData\Roaming\Microsoft\Templates\version.vbs' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e251000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e2a5000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e541000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e221000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x65001000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76161000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75d41000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6dfe1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6dde1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6dde4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x507c1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6ddc1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6ddc1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6dd21000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6dd37000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b641000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6cd25000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\~$12d617aa51bb0c0108242da6aa0071.docm
Time & API Arguments Status Return Repeated

NtCreateFile

create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x000003ec
filepath: C:\Users\test22\AppData\Local\Temp\~$12d617aa51bb0c0108242da6aa0071.docm
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$12d617aa51bb0c0108242da6aa0071.docm
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0
cmdline "C:\Windows\System32\cmd.exe" /c C:\Users\test22\AppData\Roaming\Microsoft\Templates\version.vbs
com_class WScript.Shell May attempt to create new processes
cve CVE-2013-3906
parent_process winword.exe martian_process "C:\Windows\System32\cmd.exe" /c C:\Users\test22\AppData\Roaming\Microsoft\Templates\version.vbs
Elastic malicious (high confidence)
Cynet Malicious (score: 99)
ALYac GT:VB.EmoooDldr.4.B03C1B6E
VIPRE GT:VB.EmoooDldr.4.B03C1B6E
Sangfor Malware.Generic-Macro.Save.a893fb17
BitDefender GT:VB.EmoooDldr.4.B03C1B6E
Arcabit HEUR.VBA.CG.2
ESET-NOD32 VBA/Kimsuky.K
Avast VBS:Obfuscated-gen [Trj]
ClamAV Doc.Downloader.Valyria-10021468-0
NANO-Antivirus Trojan.Script.Dnldr.elyanu
MicroWorld-eScan GT:VB.EmoooDldr.4.B03C1B6E
Rising Trojan.Kimsuky/VBA!8.1330D (TOPIS:E0:6BMNDE24csN)
Emsisoft GT:VB.EmoooDldr.4.B03C1B6E (B)
F-Secure Heuristic.HEUR/Macro.Downloader.PBMD.Gen
DrWeb modification of W97M.Suspicious.1
TrendMicro HEUR_VBA.O2
FireEye GT:VB.EmoooDldr.4.B03C1B6E
Google Detected.Heuristic.Script
Avira HEUR/Macro.Downloader.PBMD.Gen
Antiy-AVL Trojan/Macro.Kimsuky.k
GData GT:VB.EmoooDldr.4.B03C1B6E
TACHYON Suspicious/WOX.XSR.Gen
MAX malware (ai score=81)
AVG VBS:Obfuscated-gen [Trj]
file C:\Windows\System32\cmd.exe