ScreenShot
| Created | 2021.03.23 08:07 | Machine | s1_win7_x6401 |
| Filename | MsWord.exe | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 35 detected (Trojan:Win32/Glupteba!ml, HEUR:Trojan.Win32.Generic, Malicious, Trojan:Win32/Filecoder.a203b383, Trojan/Win32.RL_Generic.R364092, malicious.e7bd1d, Generic.Ransom.PyCL.A.F7E862A1, Python/Filecoder.DM!tr.ransom, malware (ai score=85), Artemis!DE6717DE7BD1, Trojan.GenericKD.36557671 (B), FileRepMalware, Trojan-Ransom.FileCrypter, Trojan.GenericKD.36557671, Malicious (score: 100), TROJ_GEN.R002H0CCM21, UDS:DangerousObject.Multi.Generic, Trojan.RegRun!hO0NykKcr0w, Trojan.PSW.Python.at, win/malicious_confidence_60% (W), Tool.Convagent.Win32.58, Mal/Generic-S, generic.ml, Unsafe, Python/Filecoder.DM, Trojan.Win32.Generic.4!c, Ransom.FileCryptor.Python.Generic, Malware.Win32.Gencirc.10ce36a1) | ||
| md5 | de6717de7bd1daa595c0b00887c25f05 | ||
| sha256 | 95cfd76bfea8839d2c545cc10d1c94131868471d51ccb8a4525058f591f92b44 | ||
| ssdeep | 196608:a2OqTXrTaX8jgp1Dm9onJ5hrZERYxQ3jo4UR7+8ezH2o1wTFX5:3TXarpNm9c5hlERYxA2RSlz31w | ||
| imphash | b0d2bcfaf69e32f6189b93d5e3f439ad | ||
| impfuzzy | 48:VgdkP9d0kteS1hEc+ppYeNgT+ONfilmbU1b:VZPrteS1hEc+ppYea+C6qyb | ||
Network IP location
Signature (13cnts)
| Level | Description |
|---|---|
| watch | Communicates with host for which no DNS query was performed |
| watch | Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | An application raised an exception which may be indicative of an exploit crash |
| notice | Creates executable files on the filesystem |
| notice | File has been identified by 5 AntiVirus engines on VirusTotal as malicious |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | Performs some HTTP requests |
| notice | Potentially malicious URLs were found in the process memory dump |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | One or more processes crashed |
Rules (58cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| notice | Str_Win32_Http_API | Match Windows Http API call | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
| info | Check_Dlls | (no description) | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerCheck__RemoteAPI | (no description) | memory |
| info | DebuggerException__ConsoleCtrl | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE64 | (no description) | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check Signature Zero | binaries (download) |
| info | PE_Header_Zero | PE File Signature Zero | binaries (download) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | win_hook | Affect hook table | memory |
| info | create_com_service | Create a COM server | memory |
| info | create_service | Create a windows service | memory |
| info | cred_local | Steal credential | memory |
| info | escalate_priv | Escalade priviledges | memory |
| info | HasDebugData | DebugData Check | binaries (download) |
| info | HasOverlay | Overlay Check | binaries (download) |
| info | HasRichSignature | Rich Signature Check | binaries (download) |
| info | hijack_network | Hijack network configuration | memory |
| info | inject_thread | Code injection with CreateRemoteThread in a remote process | memory |
| info | IsPacked | Entropy Check | binaries (download) |
| info | IsWindowsGUI | (no description) | binaries (download) |
| info | keylogger | Run a keylogger | memory |
| info | Microsoft_Office_Document_Zero | Microsoft Office Document Signature Zero | binaries (download) |
| info | migrate_apc | APC queue tasks migration | memory |
| info | network_dga | Communication using dga | memory |
| info | network_dns | Communications use DNS | memory |
| info | network_dropper | File downloader/dropper | memory |
| info | network_ftp | Communications over FTP | memory |
| info | network_http | Communications over HTTP | memory |
| info | network_p2p_win | Communications over P2P network | memory |
| info | network_tcp_listen | Listen for incoming communication | memory |
| info | network_tcp_socket | Communications over RAW socket | binaries (download) |
| info | network_tcp_socket | Communications over RAW socket | memory |
| info | network_toredo | Communications over Toredo network | memory |
| info | network_udp_sock | Communications over UDP network | memory |
| info | screenshot | Take screenshot | memory |
| info | sniff_audio | Record Audio | memory |
| info | spreading_file | Malware can spread east-west file | memory |
| info | spreading_share | Malware can spread east-west using share drive | memory |
| info | Str_Win32_Wininet_Library | Match Windows Inet API library declaration | memory |
| info | Str_Win32_Winsock2_Library | Match Winsock 2 API library declaration | binaries (download) |
| info | Str_Win32_Winsock2_Library | Match Winsock 2 API library declaration | memory |
| info | win_files_operation | Affect private profile | binaries (download) |
| info | win_files_operation | Affect private profile | memory |
| info | win_mutex | Create or check mutex | memory |
| info | win_private_profile | Affect private profile | memory |
| info | win_registry | Affect system registries | memory |
| info | win_token | Affect system token | binaries (download) |
| info | win_token | Affect system token | memory |
Suricata ids
ET INFO Executable Download from dotted-quad Host
ET POLICY PE EXE or DLL Windows file download HTTP
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET INFO TLS Handshake Failure
ET POLICY PE EXE or DLL Windows file download HTTP
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET INFO TLS Handshake Failure
PE API
IAT(Import Address Table) Library
USER32.dll
0x140022320 MessageBoxW
0x140022328 MessageBoxA
KERNEL32.dll
0x140022028 GetModuleFileNameW
0x140022030 GetProcAddress
0x140022038 GetCommandLineW
0x140022040 GetEnvironmentVariableW
0x140022048 SetEnvironmentVariableW
0x140022050 ExpandEnvironmentStringsW
0x140022058 CreateDirectoryW
0x140022060 GetTempPathW
0x140022068 WaitForSingleObject
0x140022070 Sleep
0x140022078 SetDllDirectoryW
0x140022080 CreateProcessW
0x140022088 GetStartupInfoW
0x140022090 LoadLibraryExW
0x140022098 CloseHandle
0x1400220a0 GetCurrentProcess
0x1400220a8 LocalFree
0x1400220b0 FormatMessageW
0x1400220b8 LoadLibraryA
0x1400220c0 MultiByteToWideChar
0x1400220c8 WideCharToMultiByte
0x1400220d0 GetLastError
0x1400220d8 HeapReAlloc
0x1400220e0 SetEndOfFile
0x1400220e8 GetExitCodeProcess
0x1400220f0 GetCommandLineA
0x1400220f8 HeapSize
0x140022100 GetTimeZoneInformation
0x140022108 RtlCaptureContext
0x140022110 RtlLookupFunctionEntry
0x140022118 RtlVirtualUnwind
0x140022120 UnhandledExceptionFilter
0x140022128 SetUnhandledExceptionFilter
0x140022130 TerminateProcess
0x140022138 IsProcessorFeaturePresent
0x140022140 QueryPerformanceCounter
0x140022148 GetCurrentProcessId
0x140022150 GetCurrentThreadId
0x140022158 GetSystemTimeAsFileTime
0x140022160 InitializeSListHead
0x140022168 IsDebuggerPresent
0x140022170 GetModuleHandleW
0x140022178 RtlUnwindEx
0x140022180 SetLastError
0x140022188 EnterCriticalSection
0x140022190 LeaveCriticalSection
0x140022198 DeleteCriticalSection
0x1400221a0 InitializeCriticalSectionAndSpinCount
0x1400221a8 TlsAlloc
0x1400221b0 TlsGetValue
0x1400221b8 TlsSetValue
0x1400221c0 TlsFree
0x1400221c8 FreeLibrary
0x1400221d0 RaiseException
0x1400221d8 ReadFile
0x1400221e0 CreateFileW
0x1400221e8 GetDriveTypeW
0x1400221f0 GetFileType
0x1400221f8 PeekNamedPipe
0x140022200 SystemTimeToTzSpecificLocalTime
0x140022208 FileTimeToSystemTime
0x140022210 GetFullPathNameW
0x140022218 RemoveDirectoryW
0x140022220 FindClose
0x140022228 FindFirstFileExW
0x140022230 FindNextFileW
0x140022238 SetStdHandle
0x140022240 SetConsoleCtrlHandler
0x140022248 DeleteFileW
0x140022250 GetStdHandle
0x140022258 WriteFile
0x140022260 ExitProcess
0x140022268 GetModuleHandleExW
0x140022270 GetACP
0x140022278 HeapFree
0x140022280 HeapAlloc
0x140022288 GetConsoleMode
0x140022290 ReadConsoleW
0x140022298 SetFilePointerEx
0x1400222a0 GetConsoleCP
0x1400222a8 CompareStringW
0x1400222b0 LCMapStringW
0x1400222b8 GetCurrentDirectoryW
0x1400222c0 FlushFileBuffers
0x1400222c8 SetEnvironmentVariableA
0x1400222d0 GetFileAttributesExW
0x1400222d8 IsValidCodePage
0x1400222e0 GetOEMCP
0x1400222e8 GetCPInfo
0x1400222f0 GetEnvironmentStringsW
0x1400222f8 FreeEnvironmentStringsW
0x140022300 GetStringTypeW
0x140022308 GetProcessHeap
0x140022310 WriteConsoleW
ADVAPI32.dll
0x140022000 ConvertSidToStringSidW
0x140022008 GetTokenInformation
0x140022010 OpenProcessToken
0x140022018 ConvertStringSecurityDescriptorToSecurityDescriptorW
WS2_32.dll
0x140022338 ntohl
EAT(Export Address Table) is none
USER32.dll
0x140022320 MessageBoxW
0x140022328 MessageBoxA
KERNEL32.dll
0x140022028 GetModuleFileNameW
0x140022030 GetProcAddress
0x140022038 GetCommandLineW
0x140022040 GetEnvironmentVariableW
0x140022048 SetEnvironmentVariableW
0x140022050 ExpandEnvironmentStringsW
0x140022058 CreateDirectoryW
0x140022060 GetTempPathW
0x140022068 WaitForSingleObject
0x140022070 Sleep
0x140022078 SetDllDirectoryW
0x140022080 CreateProcessW
0x140022088 GetStartupInfoW
0x140022090 LoadLibraryExW
0x140022098 CloseHandle
0x1400220a0 GetCurrentProcess
0x1400220a8 LocalFree
0x1400220b0 FormatMessageW
0x1400220b8 LoadLibraryA
0x1400220c0 MultiByteToWideChar
0x1400220c8 WideCharToMultiByte
0x1400220d0 GetLastError
0x1400220d8 HeapReAlloc
0x1400220e0 SetEndOfFile
0x1400220e8 GetExitCodeProcess
0x1400220f0 GetCommandLineA
0x1400220f8 HeapSize
0x140022100 GetTimeZoneInformation
0x140022108 RtlCaptureContext
0x140022110 RtlLookupFunctionEntry
0x140022118 RtlVirtualUnwind
0x140022120 UnhandledExceptionFilter
0x140022128 SetUnhandledExceptionFilter
0x140022130 TerminateProcess
0x140022138 IsProcessorFeaturePresent
0x140022140 QueryPerformanceCounter
0x140022148 GetCurrentProcessId
0x140022150 GetCurrentThreadId
0x140022158 GetSystemTimeAsFileTime
0x140022160 InitializeSListHead
0x140022168 IsDebuggerPresent
0x140022170 GetModuleHandleW
0x140022178 RtlUnwindEx
0x140022180 SetLastError
0x140022188 EnterCriticalSection
0x140022190 LeaveCriticalSection
0x140022198 DeleteCriticalSection
0x1400221a0 InitializeCriticalSectionAndSpinCount
0x1400221a8 TlsAlloc
0x1400221b0 TlsGetValue
0x1400221b8 TlsSetValue
0x1400221c0 TlsFree
0x1400221c8 FreeLibrary
0x1400221d0 RaiseException
0x1400221d8 ReadFile
0x1400221e0 CreateFileW
0x1400221e8 GetDriveTypeW
0x1400221f0 GetFileType
0x1400221f8 PeekNamedPipe
0x140022200 SystemTimeToTzSpecificLocalTime
0x140022208 FileTimeToSystemTime
0x140022210 GetFullPathNameW
0x140022218 RemoveDirectoryW
0x140022220 FindClose
0x140022228 FindFirstFileExW
0x140022230 FindNextFileW
0x140022238 SetStdHandle
0x140022240 SetConsoleCtrlHandler
0x140022248 DeleteFileW
0x140022250 GetStdHandle
0x140022258 WriteFile
0x140022260 ExitProcess
0x140022268 GetModuleHandleExW
0x140022270 GetACP
0x140022278 HeapFree
0x140022280 HeapAlloc
0x140022288 GetConsoleMode
0x140022290 ReadConsoleW
0x140022298 SetFilePointerEx
0x1400222a0 GetConsoleCP
0x1400222a8 CompareStringW
0x1400222b0 LCMapStringW
0x1400222b8 GetCurrentDirectoryW
0x1400222c0 FlushFileBuffers
0x1400222c8 SetEnvironmentVariableA
0x1400222d0 GetFileAttributesExW
0x1400222d8 IsValidCodePage
0x1400222e0 GetOEMCP
0x1400222e8 GetCPInfo
0x1400222f0 GetEnvironmentStringsW
0x1400222f8 FreeEnvironmentStringsW
0x140022300 GetStringTypeW
0x140022308 GetProcessHeap
0x140022310 WriteConsoleW
ADVAPI32.dll
0x140022000 ConvertSidToStringSidW
0x140022008 GetTokenInformation
0x140022010 OpenProcessToken
0x140022018 ConvertStringSecurityDescriptorToSecurityDescriptorW
WS2_32.dll
0x140022338 ntohl
EAT(Export Address Table) is none