Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 3, 2021, 9:57 a.m.	March 3, 2021, 9:59 a.m.

Size	21.0KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: Tester10, Template: Normal, Last Saved By: Tester10, Revision Number: 4, Name of Creating Application: Microsoft Office Word, Total Editing Time: 03:00, Create Time/Date: Sun Jan 31 23:32:00 2021, Last Saved Time/Date: Sun Jan 31 23:35:00 2021, Number of Pages: 1, Number of Words: 3, Number of Characters: 18, Security: 0
MD5	`e582f3f495cbd17ca0c4a63e3ee8d7db`
SHA256	`869057252cb67652a89248a497806609871fa551b4dac8112d6f12da9773bc81`
CRC32	`0DE07375`
ssdeep	`192:qCQvCCyHu/MdKdyXHt0hHt0sNhClLZEvAcD6/6rrILd/Kf3HO8tSe:caHu/M1t0Vt0sN0aiSUR/8dS`
Yara	Microsoft_Office_Document_Zero - Microsoft Office Document Signature Zero

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" "C:\Users\test22\AppData\Local\Temp\NewBSPlink Document.doc"
2768

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (13 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 3, 2021, 9:57 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 3, 2021, 9:57 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c944000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 3, 2021, 9:57 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x65001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 3, 2021, 9:57 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 3, 2021, 9:57 a.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 3, 2021, 9:57 a.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 3, 2021, 9:57 a.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 3, 2021, 9:57 a.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05870000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 3, 2021, 9:57 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c7a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 3, 2021, 9:57 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c7f5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 3, 2021, 9:57 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 3, 2021, 9:57 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 3, 2021, 9:57 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x507c1000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$wBSPlink Document.doc

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile March 3, 2021, 9:57 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000003fc filepath: C:\Users\test22\AppData\Local\Temp\~$wBSPlink Document.doc desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$wBSPlink Document.doc create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Potentially malicious URLs were found in the process memory dump (50 out of 51 events)

url	http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0
url	http://159.89.238.15/new.bat
url	http://ocsp.verisign.com0
url	http://schemas.openxmlformats.org/package/2006/content-types
url	http://schemas.xmlsoap.org/soap/envelope/
url	http://purl.org/dc/terms
url	http://schemas.xmlsoap.org/wsdl/
url	http://schemas.openxmlformats.org/officeDocument/2006/math
url	http://schemas.openxmlformats.org/package/2006/metadata/core-properties
url	http://schemas.xmlsoap.org/wsdl/mime/
url	http://storage.msn.com/mydata/myspace/SpaceFolder/PhotoAlbums/My
url	http://office.microsoft.com
url	http://crl.verisign.com/ThawteTimestampingCA.crl0
url	http://schemas.xmlsoap.org/wsdl/http/
url	http://microsoft.com/wsdl/mime/textMatching/
url	http://purl.org/dc/elements/1.1/
url	http://purl.org/dcP
url	http://www.w
url	http://schemas.xmlsoap.org/wsdl/soap/
url	http://microsoft.com/webservices/SharePointPortalServer/BDCClientWS/Resolve
url	http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
url	http://schemas.openxmlformats.org/wordprocessingml/2006/main
url	http://schemas.openxmlformats.org/presentationml/2006/3/main
url	http://www.microsoft.com0
url	http://purl.
url	http://schemas.openxmlformats.org/package/2006/metadata/corepbM
url	http://schemas.openxmlformats.org/drawingml/2006/3/diagram
url	http://sc
url	http://purl.org/dc/elements/
url	http://purl.org/dc/
url	http://purl.or
url	http://schemas.xmlsoap.org/soap/encoding/
url	http://crl.verisign.com/tss-ca.crl0
url	http://schemas.openxmlformats.org/drawingml/2006/3/main
url	http://schemas.openxmlformats.org/drawingml/2006/diagram
url	http://wwwHbM
url	http://schemas.openxmlformats.org/drawingml/2006/3/spreadsheetDrawing
url	http://microsoft.com0
url	http://schemas.open
url	http://microsoft.com/webservices/SharePointPortalServer/BDCClientWS/
url	http://www.typepad.com/t/api
url	https://storage.msn.com/storageservice/MetaWeblog.rpc
url	http://schemas.openxmlformats.org/drawingml/2006/main
url	http://purl.org/dc/dcmitype/
url	http://purl.org/dc/terms/
url	http://schemas.openxmlformats.org/officeDocument/2006/relationships
url	http://dublincore.org/schemas/xmls/qdc/2003/04/02/dc.xsd
url	http://purl
url	http://dublincore.org/schemas/xmls/qdc/2003/04/02/dcterms.xsd
url	http://purl.org/dc/dcmi

Yara rule detected in process memory (29 events)

description	Create a COM server	rule	create_com_service
description	Listen for incoming communication	rule	network_tcp_listen
description	Communications over HTTP	rule	network_http
description	Communications over FTP	rule	network_ftp
description	Communications over RAW socket	rule	network_tcp_socket
description	Communications use DNS	rule	network_dns
description	Communication using dga	rule	network_dga
description	Escalade priviledges	rule	escalate_priv
description	Take screenshot	rule	screenshot
description	Run a keylogger	rule	keylogger
description	Steal credential	rule	cred_local
description	APC queue tasks migration	rule	migrate_apc
description	Malware can spread east-west file	rule	spreading_file
description	Remote Administration toolkit enable RDP	rule	rat_rdp
description	Create or check mutex	rule	win_mutex
description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_private_profile
description	Affect private profile	rule	win_files_operation
description	Match Winsock 2 API library declaration	rule	Str_Win32_Winsock2_Library
description	Match Windows Inet API library declaration	rule	Str_Win32_Wininet_Library
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Affect hook table	rule	win_hook

File has been identified by 14 AntiVirus engines on VirusTotal as malicious (14 events)

MicroWorld-eScan	Heur.BZC.ONG.Pantera.14.534B1F13
FireEye	Heur.BZC.ONG.Pantera.14.534B1F13
Arcabit	Heur.BZC.ONG.Pantera.14.534B1F13
ESET-NOD32	BAT/TrojanDownloader.Agent.OEV
BitDefender	Heur.BZC.ONG.Pantera.14.534B1F13
Ad-Aware	Heur.BZC.ONG.Pantera.14.534B1F13
DrWeb	BAT.DownLoader.600
McAfee-GW-Edition	Artemis
Emsisoft	Heur.BZC.ONG.Pantera.14.534B1F13 (B)
GData	Heur.BZC.ONG.Pantera.14.534B1F13
ALYac	Heur.BZC.ONG.Pantera.14.534B1F13
MAX	malware (ai score=80)
Rising	Exploit.BypassUAC/BAT!1.D324 (CLASSIC)
Fortinet	BAT/Agent.00CD!tr

Libraries known to be associated with a CVE were requested (may be False Positive) (1 event)

cve	CVE-2013-3906

Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) (1 event)

url	http://159.89.238.15/new.bat

NewBSPlink Document.doc

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All