popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cc.dot

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 28, 2021, 9:42 a.m. April 28, 2021, 9:49 a.m.
Size 6.1KB
Type data
MD5 c10fba3ded1f5c313d83ac9f7ff82961
SHA256 2eade5f19b3af2c65638f662e4e3ecb5c4a4791ef1be5738d99f247d342f8331
CRC32 6A7CA51D
ssdeep 96:IMUhUc3Mf+sJlqwAh/eA8B7TlT7tUh16G2wp03fkNCJG79zDr/:3Bc3g1Ah/ex3xUh1tW3sNC2vb
Yara None matched

Name Response Post-Analysis Lookup
www.15slotozlo.site
A 104.21.40.63
A 172.67.178.12
172.67.178.12
www.coolblue.digital
A 198.54.117.218
A 198.54.117.216
A 198.54.117.217
CNAME parkingpage.namecheap.com
A 198.54.117.215
A 198.54.117.212
A 198.54.117.210
A 198.54.117.211
198.54.117.211
www.adecquo.com
A 154.81.19.216
154.81.19.216
www.zuisyoraku.com
A 183.90.250.91
183.90.250.91
IP Address Status Action
104.21.40.63 Active Moloch
154.81.19.216 Active Moloch
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
183.90.250.91 Active Moloch
198.54.117.212 Active Moloch
23.95.122.25 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49816 -> 104.21.40.63:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49816 -> 104.21.40.63:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49816 -> 104.21.40.63:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49810 -> 23.95.122.25:80 2016141 ET INFO Executable Download from dotted-quad Host A Network Trojan was detected
TCP 192.168.56.102:49810 -> 23.95.122.25:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 23.95.122.25:80 -> 192.168.56.102:49810 2022050 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 A Network Trojan was detected
TCP 23.95.122.25:80 -> 192.168.56.102:49810 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 23.95.122.25:80 -> 192.168.56.102:49810 2022051 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 A Network Trojan was detected
TCP 23.95.122.25:80 -> 192.168.56.102:49810 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.102:49817 -> 198.54.117.212:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49819 -> 183.90.250.91:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49817 -> 198.54.117.212:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49819 -> 183.90.250.91:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49817 -> 198.54.117.212:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49819 -> 183.90.250.91:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49818 -> 154.81.19.216:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49818 -> 154.81.19.216:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49818 -> 154.81.19.216:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\12.0\Registration\{90120000-0030-0000-0000-0000000FF1CE}\DigitalProductID
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
wdCommandDispatch+0x3f3be7 DllCanUnloadNow-0xd94e6 wwlib+0x7d4e5c @ 0x65294e5c
DllGetClassObject+0x9b035 DllGetLCID-0x1c084b wwlib+0x9fc7f @ 0x64b5fc7f
DllGetClassObject+0x9ac3c DllGetLCID-0x1c0c44 wwlib+0x9f886 @ 0x64b5f886
DllGetClassObject+0x9a90c DllGetLCID-0x1c0f74 wwlib+0x9f556 @ 0x64b5f556
DllGetClassObject+0x115ef3 DllGetLCID-0x14598d wwlib+0x11ab3d @ 0x64bdab3d
DllGetClassObject+0x11457c DllGetLCID-0x147304 wwlib+0x1191c6 @ 0x64bd91c6
DllGetClassObject+0x115894 DllGetLCID-0x145fec wwlib+0x11a4de @ 0x64bda4de
DllCanUnloadNow+0x127d65 wwlib+0x9d60a7 @ 0x654960a7
wdCommandDispatch+0x3e89b2 DllCanUnloadNow-0xe471b wwlib+0x7c9c27 @ 0x65289c27
DllCanUnloadNow+0x395760 wwlib+0xc43aa2 @ 0x65703aa2
DllCanUnloadNow+0x395b92 wwlib+0xc43ed4 @ 0x65703ed4
DllGetClassObject+0x5ed15 DllGetLCID-0x1fcb6b wwlib+0x6395f @ 0x64b2395f
DllGetClassObject+0x78b76 DllGetLCID-0x1e2d0a wwlib+0x7d7c0 @ 0x64b3d7c0
DllGetClassObject+0x5db61 DllGetLCID-0x1fdd1f wwlib+0x627ab @ 0x64b227ab
FMain+0x6ac DllGetClassObject-0x3c wwlib+0x4c0e @ 0x64ac4c0e
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fb515d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fb5155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 2244408
registers.edi: 1957755408
registers.eax: 2244408
registers.ebp: 2244488
registers.edx: 2130566132
registers.ebx: 6355412
registers.esi: 2147944126
registers.ecx: 1384037243
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
wdCommandDispatch+0x3f3be7 DllCanUnloadNow-0xd94e6 wwlib+0x7d4e5c @ 0x65294e5c
DllGetClassObject+0x9b035 DllGetLCID-0x1c084b wwlib+0x9fc7f @ 0x64b5fc7f
DllGetClassObject+0x9ac3c DllGetLCID-0x1c0c44 wwlib+0x9f886 @ 0x64b5f886
DllGetClassObject+0x9a90c DllGetLCID-0x1c0f74 wwlib+0x9f556 @ 0x64b5f556
DllGetClassObject+0x115ef3 DllGetLCID-0x14598d wwlib+0x11ab3d @ 0x64bdab3d
DllGetClassObject+0x11457c DllGetLCID-0x147304 wwlib+0x1191c6 @ 0x64bd91c6
DllGetClassObject+0x115894 DllGetLCID-0x145fec wwlib+0x11a4de @ 0x64bda4de
DllCanUnloadNow+0x127d65 wwlib+0x9d60a7 @ 0x654960a7
wdCommandDispatch+0x3e89b2 DllCanUnloadNow-0xe471b wwlib+0x7c9c27 @ 0x65289c27
DllCanUnloadNow+0x395760 wwlib+0xc43aa2 @ 0x65703aa2
DllCanUnloadNow+0x395b92 wwlib+0xc43ed4 @ 0x65703ed4
DllGetClassObject+0x5ed15 DllGetLCID-0x1fcb6b wwlib+0x6395f @ 0x64b2395f
DllGetClassObject+0x78b76 DllGetLCID-0x1e2d0a wwlib+0x7d7c0 @ 0x64b3d7c0
DllGetClassObject+0x5db61 DllGetLCID-0x1fdd1f wwlib+0x627ab @ 0x64b227ab
FMain+0x6ac DllGetClassObject-0x3c wwlib+0x4c0e @ 0x64ac4c0e
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fb515d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fb5155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 2244100
registers.edi: 1957755408
registers.eax: 2244100
registers.ebp: 2244180
registers.edx: 2130566132
registers.ebx: 6354908
registers.esi: 2147944122
registers.ecx: 1384037243
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://23.95.122.25/cc/vbc.exe
suspicious_features GET method with no useragent header suspicious_request GET http://www.15slotozlo.site/pmc/?RRH=JFva54IOlKVnlpYoc1RFuL3mKqtDw0bOy0bUZ/qRd+Wy0jUa0JT0k3ufM/C3GMX4A5VkykN2&rVBxDv=S0Ghq4
suspicious_features GET method with no useragent header suspicious_request GET http://www.coolblue.digital/pmc/?RRH=vUAXos/W3FKdVA5hdlCIKF5pzGKq7f7QtJqJhVwRzw7HIwgr+5PWnKVzXZj3kVyxMQr8Z77l&rVBxDv=S0Ghq4
suspicious_features GET method with no useragent header suspicious_request GET http://www.adecquo.com/pmc/?RRH=vjDla05s3BwYir9AIyM9qtJMEH6ykGoQMvqSGth8Nv/9Pw1B8DxUB3DqZFlnRD+swTMkapVO&rVBxDv=S0Ghq4
suspicious_features GET method with no useragent header suspicious_request GET http://www.zuisyoraku.com/pmc/?RRH=4l6fyKTFHDaHe1GcRTEUPSwbRJmK3jvlIAQWbuZctk+ctcpozhtelOPFUCnZPaeJbIh2wtV5&rVBxDv=S0Ghq4
request GET http://23.95.122.25/cc/vbc.exe
request GET http://www.15slotozlo.site/pmc/?RRH=JFva54IOlKVnlpYoc1RFuL3mKqtDw0bOy0bUZ/qRd+Wy0jUa0JT0k3ufM/C3GMX4A5VkykN2&rVBxDv=S0Ghq4
request GET http://www.coolblue.digital/pmc/?RRH=vUAXos/W3FKdVA5hdlCIKF5pzGKq7f7QtJqJhVwRzw7HIwgr+5PWnKVzXZj3kVyxMQr8Z77l&rVBxDv=S0Ghq4
request GET http://www.adecquo.com/pmc/?RRH=vjDla05s3BwYir9AIyM9qtJMEH6ykGoQMvqSGth8Nv/9Pw1B8DxUB3DqZFlnRD+swTMkapVO&rVBxDv=S0Ghq4
request GET http://www.zuisyoraku.com/pmc/?RRH=4l6fyKTFHDaHe1GcRTEUPSwbRJmK3jvlIAQWbuZctk+ctcpozhtelOPFUCnZPaeJbIh2wtV5&rVBxDv=S0Ghq4
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x2fb51000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x64ac1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6f4c1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6f5de000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x64d0e000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x63aa1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6400a000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75738000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70851000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70851000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ef1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73771000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73772000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73821000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 5720
region_size: 2228224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b90000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 5720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02d70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72992000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 5720
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b90000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 5720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02be0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c71000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 5720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 5720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72021000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7079f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7079f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73db1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73361000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73711000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 5720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bd0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 5720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bd0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 5720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ce0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 5720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04cf0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05fd1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6ec61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6ec64000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x507c1000
process_handle: 0xffffffff
1 0 0
Application Crash Process WINWORD.EXE with pid 5720 crashed
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
wdCommandDispatch+0x3f3be7 DllCanUnloadNow-0xd94e6 wwlib+0x7d4e5c @ 0x65294e5c
DllGetClassObject+0x9b035 DllGetLCID-0x1c084b wwlib+0x9fc7f @ 0x64b5fc7f
DllGetClassObject+0x9ac3c DllGetLCID-0x1c0c44 wwlib+0x9f886 @ 0x64b5f886
DllGetClassObject+0x9a90c DllGetLCID-0x1c0f74 wwlib+0x9f556 @ 0x64b5f556
DllGetClassObject+0x115ef3 DllGetLCID-0x14598d wwlib+0x11ab3d @ 0x64bdab3d
DllGetClassObject+0x11457c DllGetLCID-0x147304 wwlib+0x1191c6 @ 0x64bd91c6
DllGetClassObject+0x115894 DllGetLCID-0x145fec wwlib+0x11a4de @ 0x64bda4de
DllCanUnloadNow+0x127d65 wwlib+0x9d60a7 @ 0x654960a7
wdCommandDispatch+0x3e89b2 DllCanUnloadNow-0xe471b wwlib+0x7c9c27 @ 0x65289c27
DllCanUnloadNow+0x395760 wwlib+0xc43aa2 @ 0x65703aa2
DllCanUnloadNow+0x395b92 wwlib+0xc43ed4 @ 0x65703ed4
DllGetClassObject+0x5ed15 DllGetLCID-0x1fcb6b wwlib+0x6395f @ 0x64b2395f
DllGetClassObject+0x78b76 DllGetLCID-0x1e2d0a wwlib+0x7d7c0 @ 0x64b3d7c0
DllGetClassObject+0x5db61 DllGetLCID-0x1fdd1f wwlib+0x627ab @ 0x64b227ab
FMain+0x6ac DllGetClassObject-0x3c wwlib+0x4c0e @ 0x64ac4c0e
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fb515d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fb5155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 2244408
registers.edi: 1957755408
registers.eax: 2244408
registers.ebp: 2244488
registers.edx: 2130566132
registers.ebx: 6355412
registers.esi: 2147944126
registers.ecx: 1384037243
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
wdCommandDispatch+0x3f3be7 DllCanUnloadNow-0xd94e6 wwlib+0x7d4e5c @ 0x65294e5c
DllGetClassObject+0x9b035 DllGetLCID-0x1c084b wwlib+0x9fc7f @ 0x64b5fc7f
DllGetClassObject+0x9ac3c DllGetLCID-0x1c0c44 wwlib+0x9f886 @ 0x64b5f886
DllGetClassObject+0x9a90c DllGetLCID-0x1c0f74 wwlib+0x9f556 @ 0x64b5f556
DllGetClassObject+0x115ef3 DllGetLCID-0x14598d wwlib+0x11ab3d @ 0x64bdab3d
DllGetClassObject+0x11457c DllGetLCID-0x147304 wwlib+0x1191c6 @ 0x64bd91c6
DllGetClassObject+0x115894 DllGetLCID-0x145fec wwlib+0x11a4de @ 0x64bda4de
DllCanUnloadNow+0x127d65 wwlib+0x9d60a7 @ 0x654960a7
wdCommandDispatch+0x3e89b2 DllCanUnloadNow-0xe471b wwlib+0x7c9c27 @ 0x65289c27
DllCanUnloadNow+0x395760 wwlib+0xc43aa2 @ 0x65703aa2
DllCanUnloadNow+0x395b92 wwlib+0xc43ed4 @ 0x65703ed4
DllGetClassObject+0x5ed15 DllGetLCID-0x1fcb6b wwlib+0x6395f @ 0x64b2395f
DllGetClassObject+0x78b76 DllGetLCID-0x1e2d0a wwlib+0x7d7c0 @ 0x64b3d7c0
DllGetClassObject+0x5db61 DllGetLCID-0x1fdd1f wwlib+0x627ab @ 0x64b227ab
FMain+0x6ac DllGetClassObject-0x3c wwlib+0x4c0e @ 0x64ac4c0e
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fb515d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fb5155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 2244100
registers.edi: 1957755408
registers.eax: 2244100
registers.ebp: 2244180
registers.edx: 2130566132
registers.ebx: 6354908
registers.esi: 2147944122
registers.ecx: 1384037243
1 0 0
file C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x000002c8
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x000004ac
filepath: C:\Users\test22\AppData\Local\Temp\~$cc.dot
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$cc.dot
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0
description Affect private profile rule win_files_operation
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
host 172.217.25.14
host 23.95.122.25
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee Exploit-CVE2017-11882.bw
K7AntiVirus Trojan ( 0057b3a91 )
K7GW Trojan ( 0057b3a91 )
Arcabit Exploit.RTF-ObfsObjDat.Gen
Cyren RTF/CVE-2017-11882.N.gen!Camelot
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
Ad-Aware Exploit.RTF-ObfsObjDat.Gen
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition Exploit-CVE2017-11882.bw
FireEye Exploit.RTF-ObfsObjDat.Gen
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
Avira HEUR/Rtf.Malformed
MAX malware (ai score=89)
Microsoft Exploit:Win32/CVE-2017-11882!ml
GData Exploit.RTF-ObfsObjDat.Gen
Cynet Malicious (score: 99)
AhnLab-V3 RTF/Malform-A.Gen
ALYac Exploit.RTF-ObfsObjDat.Gen
TACHYON Trojan-Exploit/RTF.CVE-2017-11882
Zoner Probably Heur.RTFBadHeader
Ikarus Exploit.CVE-2017-11882
Fortinet RTF/CVE_2017_11882.C!exploit