Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 3, 2021, 9:07 a.m.	March 3, 2021, 9:09 a.m.

Size	21.0KB
Type	Microsoft Word 2007+
MD5	`201a45a33e877324be58f5541fef9011`
SHA256	`0652962c5dace16ed170a932e3ce7eb3097b34bc809343fbb96b27cf3d22a5c7`
CRC32	`B8578486`
ssdeep	`384:Q3CZQ62G0cHrsozpn0i13LEAvDPtbYt0q9tHlxxnEIs2W9LY7k40ldng+XaUNnn:Q3KT0cH9pv13DodlnE00L4n0DbKm`
Yara	None matched

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" "C:\Users\test22\AppData\Local\Temp\BANK TRANSFER CONFIRMATION RECEIPT IN ATTACHMENT.docx"
1016

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (13 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 3, 2021, 9:07 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c9b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 3, 2021, 9:07 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca05000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 3, 2021, 9:07 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 3, 2021, 9:07 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 3, 2021, 9:07 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 3, 2021, 9:07 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c784000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 3, 2021, 9:07 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x65001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 3, 2021, 9:07 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c761000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 3, 2021, 9:07 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ba0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 3, 2021, 9:07 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ba0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 3, 2021, 9:07 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05bb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 3, 2021, 9:07 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 3, 2021, 9:07 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x507c1000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$NK TRANSFER CONFIRMATION RECEIPT IN ATTACHMENT.docx

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile March 3, 2021, 9:07 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000003ec filepath: C:\Users\test22\AppData\Local\Temp\~$NK TRANSFER CONFIRMATION RECEIPT IN ATTACHMENT.docx desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$NK TRANSFER CONFIRMATION RECEIPT IN ATTACHMENT.docx create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

File has been identified by 9 AntiVirus engines on VirusTotal as malicious (9 events)

ESET-NOD32	BAT/TrojanDownloader.Agent.OEV
Avast	Other:Malware-gen [Trj]
Kaspersky	HEUR:Trojan.BAT.Generic
AegisLab	Trojan.BAT.Generic.4!c
Tencent	Bat.Trojan-downloader.Agent.Hmhm
ZoneAlarm	HEUR:Trojan.BAT.Generic
Ikarus	Win32.Outbreak
AVG	Other:Malware-gen [Trj]
Qihoo-360	Office/Trojan.Generic.HjcASQAA

Potentially malicious URLs were found in the process memory dump (50 out of 53 events)

url	http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0
url	http://schemas.openx
url	http://purl.org/dc/elements/1.1/
url	http://schemas.openxmlformats.org/officeDocument/2006/relationships/fontTable
url	http://ocsp.verisign.com0
url	http://schemas.openxmlformats.org/package/2006/content-types
url	http://schemas.xmlsoap.org/wsdl/soap/
url	http://schemas.openxmlformats.org/presentationml/2006/3/main
url	http://schemas.openxmlformats.org/officeDocument/2006/relationships/image
url	http://purl.org/dc/terms
url	http://schemas.openxmlformats.org/officeDocument/2006/math
url	http://schemas.openxmlformats.org/package/2006/metadata/core-properties
url	http://schemas.openxmlformats.org/officeDocument/2006/relationships/header
url	http://schemas.openxmlformats.org/officeDocument/2006/relationships/webSettings
url	http://schemas.openxmlformats.org/officeDocument/2006/relationships/settings
url	http://storage.msn.com/mydata/myspace/SpaceFolder/PhotoAlbums/My
url	http://office.microsoft.com
url	http://crl.verisign.com/ThawteTimestampingCA.crl0
url	http://schemas.xmlsoap.org/wsdl/http/
url	http://microsoft.com/wsdl/mime/textMatching/
url	http://schemas.openxmlformats.org/officeDocument/2006/relationships/footnotes
url	http://schemas.xmlsoap.org/wsdl/mime/
url	http://microsoft.com/webservices/SharePointPortalServer/BDCClientWS/Resolve
url	http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
url	http://schemas.openxmlformats.org/wordprocessingml/2006/main
url	http://www.microsoft.com0
url	http://schemas.openxmlformats.org/officeDocument/2006/relationships/oleObject
url	http://schemas.xmlsoap.org/wsdl/
url	http://schemas.xmlsoap.org/soap/envelope/
url	http://schemas.openxmlformats.org/officeDocument/2006/relationships
url	http://schemas.openxmlformats.org/drawingml/2006/3/diagram
url	http://sc
url	http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme
url	http://schemas.xmlsoap.org/soap/encoding/
url	http://crl.verisign.com/tss-ca.crl0
url	http://schemas.openxmlformats.org/drawingml/2006/3/main
url	http://purl.org/dc/elements/1.
url	http://schemas.openxmlformats.org/drawingml/2006/3/spreadsheetDrawing
url	http://schemas.openxmlformats.org/officeDocument/2006/relationships/endnotes
url	http://microsoft.com0
url	http://schemas.openxmlformats.org/package/2006/relationships
url	http://microsoft.com/webservices/SharePointPortalServer/BDCClientWS/
url	http://www.typepad.com/t/api
url	https://storage.msn.com/storageservice/MetaWeblog.rpc
url	http://schemas.openxmlformats.org/drawingml/2006/main
url	http://purl.org/dc/dcmitype/
url	http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles
url	http://purl.org/dc/terms/
url	http://schemas.open
url	http://dublincore.org/schemas/xmls/qdc/2003/04/02/dc.xsd

Yara rule detected in process memory (28 events)

description	Create a COM server	rule	create_com_service
description	Listen for incoming communication	rule	network_tcp_listen
description	Communications over HTTP	rule	network_http
description	Communications over FTP	rule	network_ftp
description	Communications over RAW socket	rule	network_tcp_socket
description	Communications use DNS	rule	network_dns
description	Communication using dga	rule	network_dga
description	Escalade priviledges	rule	escalate_priv
description	Take screenshot	rule	screenshot
description	Run a keylogger	rule	keylogger
description	Steal credential	rule	cred_local
description	APC queue tasks migration	rule	migrate_apc
description	Malware can spread east-west file	rule	spreading_file
description	Remote Administration toolkit enable RDP	rule	rat_rdp
description	Create or check mutex	rule	win_mutex
description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_private_profile
description	Affect private profile	rule	win_files_operation
description	Match Winsock 2 API library declaration	rule	Str_Win32_Winsock2_Library
description	Match Windows Inet API library declaration	rule	Str_Win32_Wininet_Library
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	ThreadControl__Context
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Affect hook table	rule	win_hook

Libraries known to be associated with a CVE were requested (may be False Positive) (1 event)

cve	CVE-2013-3906

BANK TRANSFER CONFIRMATION RECEIPT IN ATTACHMENT.docx

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All