Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 24, 2024, 9:21 a.m.	July 24, 2024, 9:23 a.m.

Size	1.0MB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 00:00:00 2006, Last Saved Time/Date: Tue Jul 23 07:02:54 2024, Security: 1
MD5	`c433eae598bb293ae5c2f28ad9a61c3b`
SHA256	`f17bd7fd6d8a9e5fcbda5a90f2e7b6cd0835e52eda90c374290e896cd460745f`
CRC32	`6F357130`
ssdeep	`24576:4MwnuV9kaaGSUtaAfIZduMI5M5TIgZABgOqT6xZvYx:4uV9kaaRUAAfIZduMI5M5cAADqT6TY`
Yara	Microsoft_Office_File_Zero - Microsoft Office File

EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\DRWG-347RB1.pd.xls
2544

Name	Response	Post-Analysis Lookup
jx.ax	A 104.21.74.75 A 172.67.200.114	172.67.200.114

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.200.114	Active	Moloch
54.38.139.98	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49164 -> 172.67.200.114:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49164 172.67.200.114:443	C=US, O=Google Trust Services, CN=WE1	CN=jx.ax	08:61:59:dc:8c:fb:65:d8:fe:2b:db:4d:43:d4:85:c5:67:18:41:c1

Performs some HTTP requests (2 events)

request	GET http://jx.ax/Ld3
request	GET https://jx.ax/Ld3

Allocates read-write-execute memory (usually to unpack itself) (27 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f5b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f60f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f60f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70e11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f561000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f701000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f4e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f4d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f4c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x730d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f4b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f4a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f461000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f411000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f3d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f3b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f351000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f2f1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05770000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 24, 2024, 9:21 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05780000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

54.38.139.98

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 events)

ALYac	Exploit.CVE-2017-0199.04.Gen
VIPRE	Exploit.CVE-2017-0199.04.Gen
Arcabit	Exploit.CVE-2017-0199.04.Gen
Symantec	Scr.Malcode!gen59
BitDefender	Exploit.CVE-2017-0199.04.Gen
MicroWorld-eScan	Exploit.CVE-2017-0199.04.Gen
Rising	Exploit.CVE-2017-0199!1.FDBF (CLASSIC)
Emsisoft	Exploit.CVE-2017-0199.04.Gen (B)
FireEye	Exploit.CVE-2017-0199.04.Gen
GData	Exploit.CVE-2017-0199.04.Gen
TACHYON	Downloader/W97.CVE-2017-0199
Tencent	Exp.MsOffice.Cve2017_0199.11030291
MAX	malware (ai score=88)
Fortinet	MSExcel/CVE_2017_0199.G1!exploit
alibabacloud	Exploit:MSOffice/CVE-2017-0199.Gen

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

54.38.139.98:80

DRWG-347RB1.pd.xls

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All