Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 5, 2021, 10:08 a.m.	May 5, 2021, 10:23 a.m.

Size	14.0KB
Type	data
MD5	`3874ba5a2e4e803b953be9100aac273a`
SHA256	`e98c1efb772a4cd7d691b89beb463eefedf568e8767f4c6153c86b6df343dd99`
CRC32	`9430517A`
ssdeep	`384:nhS7Rb7GhIBF4PsnQvcZh77lrckzAUuReM3FAyGKz:nhS7R6IBFg/vc37xtzARRRFAEz`
Yara	Rich_Text_Format_Zero - Rich Text Format Signature Zero

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "QmZrjUxJIBBdY" C:\Users\test22\AppData\Local\Temp\d.dot
7140
- WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" /n /dde
  5192

Name	Response	Post-Analysis Lookup
will.kasraz.com	A 192.3.122.177	192.3.122.177

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
192.3.122.177	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49810 -> 192.3.122.177:80	2018080	ET HUNTING Suspicious Request for Pdf.exe Observed in Zeus/Luminosity Link	A Network Trojan was detected
TCP 192.168.56.102:49810 -> 192.3.122.177:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\12.0\Registration\{90120000-0030-0000-0000-0000000FF1CE}\DigitalProductID

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 5, 2021, 10:08 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68 wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0 DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232 DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206 DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6 DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6 DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e wdCommandDispatch+0x3f3be7 DllCanUnloadNow-0xd94e6 wwlib+0x7d4e5c @ 0x65294e5c DllGetClassObject+0x9b035 DllGetLCID-0x1c084b wwlib+0x9fc7f @ 0x64b5fc7f DllGetClassObject+0x9ac3c DllGetLCID-0x1c0c44 wwlib+0x9f886 @ 0x64b5f886 DllGetClassObject+0x9a90c DllGetLCID-0x1c0f74 wwlib+0x9f556 @ 0x64b5f556 DllGetClassObject+0x115ef3 DllGetLCID-0x14598d wwlib+0x11ab3d @ 0x64bdab3d DllGetClassObject+0x11457c DllGetLCID-0x147304 wwlib+0x1191c6 @ 0x64bd91c6 DllGetClassObject+0x115894 DllGetLCID-0x145fec wwlib+0x11a4de @ 0x64bda4de DllCanUnloadNow+0x127d65 wwlib+0x9d60a7 @ 0x654960a7 wdCommandDispatch+0x3e89b2 DllCanUnloadNow-0xe471b wwlib+0x7c9c27 @ 0x65289c27 DllCanUnloadNow+0x395760 wwlib+0xc43aa2 @ 0x65703aa2 DllCanUnloadNow+0x395b92 wwlib+0xc43ed4 @ 0x65703ed4 DllGetClassObject+0x5ed15 DllGetLCID-0x1fcb6b wwlib+0x6395f @ 0x64b2395f DllGetClassObject+0x78b76 DllGetLCID-0x1e2d0a wwlib+0x7d7c0 @ 0x64b3d7c0 DllGetClassObject+0x5db61 DllGetLCID-0x1fdd1f wwlib+0x627ab @ 0x64b227ab FMain+0x6ac DllGetClassObject-0x3c wwlib+0x4c0e @ 0x64ac4c0e wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fca15d7 wdCommandDispatch-0x367 winword+0x155d @ 0x2fca155d BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706be exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 2963612 registers.edi: 1957755408 registers.eax: 2963612 registers.ebp: 2963692 registers.edx: 2130566132 registers.ebx: 5678196 registers.esi: 2147944126 registers.ecx: 308783087	1	0	0
__exception__ May 5, 2021, 10:08 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641 CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172 CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6 OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68 wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0 DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232 DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206 DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6 DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6 DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e wdCommandDispatch+0x3f3be7 DllCanUnloadNow-0xd94e6 wwlib+0x7d4e5c @ 0x65294e5c DllGetClassObject+0x9b035 DllGetLCID-0x1c084b wwlib+0x9fc7f @ 0x64b5fc7f DllGetClassObject+0x9ac3c DllGetLCID-0x1c0c44 wwlib+0x9f886 @ 0x64b5f886 DllGetClassObject+0x9a90c DllGetLCID-0x1c0f74 wwlib+0x9f556 @ 0x64b5f556 DllGetClassObject+0x115ef3 DllGetLCID-0x14598d wwlib+0x11ab3d @ 0x64bdab3d DllGetClassObject+0x11457c DllGetLCID-0x147304 wwlib+0x1191c6 @ 0x64bd91c6 DllGetClassObject+0x115894 DllGetLCID-0x145fec wwlib+0x11a4de @ 0x64bda4de DllCanUnloadNow+0x127d65 wwlib+0x9d60a7 @ 0x654960a7 wdCommandDispatch+0x3e89b2 DllCanUnloadNow-0xe471b wwlib+0x7c9c27 @ 0x65289c27 DllCanUnloadNow+0x395760 wwlib+0xc43aa2 @ 0x65703aa2 DllCanUnloadNow+0x395b92 wwlib+0xc43ed4 @ 0x65703ed4 DllGetClassObject+0x5ed15 DllGetLCID-0x1fcb6b wwlib+0x6395f @ 0x64b2395f DllGetClassObject+0x78b76 DllGetLCID-0x1e2d0a wwlib+0x7d7c0 @ 0x64b3d7c0 DllGetClassObject+0x5db61 DllGetLCID-0x1fdd1f wwlib+0x627ab @ 0x64b227ab FMain+0x6ac DllGetClassObject-0x3c wwlib+0x4c0e @ 0x64ac4c0e wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fca15d7 wdCommandDispatch-0x367 winword+0x155d @ 0x2fca155d BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706ba exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 2963304 registers.edi: 1957755408 registers.eax: 2963304 registers.ebp: 2963384 registers.edx: 2130566132 registers.ebx: 5677692 registers.esi: 2147944122 registers.ecx: 308783087	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

May 5, 2021, 10:08 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
wdCommandDispatch+0x3f3be7 DllCanUnloadNow-0xd94e6 wwlib+0x7d4e5c @ 0x65294e5c
DllGetClassObject+0x9b035 DllGetLCID-0x1c084b wwlib+0x9fc7f @ 0x64b5fc7f
DllGetClassObject+0x9ac3c DllGetLCID-0x1c0c44 wwlib+0x9f886 @ 0x64b5f886
DllGetClassObject+0x9a90c DllGetLCID-0x1c0f74 wwlib+0x9f556 @ 0x64b5f556
DllGetClassObject+0x115ef3 DllGetLCID-0x14598d wwlib+0x11ab3d @ 0x64bdab3d
DllGetClassObject+0x11457c DllGetLCID-0x147304 wwlib+0x1191c6 @ 0x64bd91c6
DllGetClassObject+0x115894 DllGetLCID-0x145fec wwlib+0x11a4de @ 0x64bda4de
DllCanUnloadNow+0x127d65 wwlib+0x9d60a7 @ 0x654960a7
wdCommandDispatch+0x3e89b2 DllCanUnloadNow-0xe471b wwlib+0x7c9c27 @ 0x65289c27
DllCanUnloadNow+0x395760 wwlib+0xc43aa2 @ 0x65703aa2
DllCanUnloadNow+0x395b92 wwlib+0xc43ed4 @ 0x65703ed4
DllGetClassObject+0x5ed15 DllGetLCID-0x1fcb6b wwlib+0x6395f @ 0x64b2395f
DllGetClassObject+0x78b76 DllGetLCID-0x1e2d0a wwlib+0x7d7c0 @ 0x64b3d7c0
DllGetClassObject+0x5db61 DllGetLCID-0x1fdd1f wwlib+0x627ab @ 0x64b227ab
FMain+0x6ac DllGetClassObject-0x3c wwlib+0x4c0e @ 0x64ac4c0e
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fca15d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fca155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 2963612
registers.edi: 1957755408
registers.eax: 2963612
registers.ebp: 2963692
registers.edx: 2130566132
registers.ebx: 5678196
registers.esi: 2147944126
registers.ecx: 308783087

__exception__

May 5, 2021, 10:08 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
wdCommandDispatch+0x3f3be7 DllCanUnloadNow-0xd94e6 wwlib+0x7d4e5c @ 0x65294e5c
DllGetClassObject+0x9b035 DllGetLCID-0x1c084b wwlib+0x9fc7f @ 0x64b5fc7f
DllGetClassObject+0x9ac3c DllGetLCID-0x1c0c44 wwlib+0x9f886 @ 0x64b5f886
DllGetClassObject+0x9a90c DllGetLCID-0x1c0f74 wwlib+0x9f556 @ 0x64b5f556
DllGetClassObject+0x115ef3 DllGetLCID-0x14598d wwlib+0x11ab3d @ 0x64bdab3d
DllGetClassObject+0x11457c DllGetLCID-0x147304 wwlib+0x1191c6 @ 0x64bd91c6
DllGetClassObject+0x115894 DllGetLCID-0x145fec wwlib+0x11a4de @ 0x64bda4de
DllCanUnloadNow+0x127d65 wwlib+0x9d60a7 @ 0x654960a7
wdCommandDispatch+0x3e89b2 DllCanUnloadNow-0xe471b wwlib+0x7c9c27 @ 0x65289c27
DllCanUnloadNow+0x395760 wwlib+0xc43aa2 @ 0x65703aa2
DllCanUnloadNow+0x395b92 wwlib+0xc43ed4 @ 0x65703ed4
DllGetClassObject+0x5ed15 DllGetLCID-0x1fcb6b wwlib+0x6395f @ 0x64b2395f
DllGetClassObject+0x78b76 DllGetLCID-0x1e2d0a wwlib+0x7d7c0 @ 0x64b3d7c0
DllGetClassObject+0x5db61 DllGetLCID-0x1fdd1f wwlib+0x627ab @ 0x64b227ab
FMain+0x6ac DllGetClassObject-0x3c wwlib+0x4c0e @ 0x64ac4c0e
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fca15d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fca155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 2963304
registers.edi: 1957755408
registers.eax: 2963304
registers.ebp: 2963384
registers.edx: 2130566132
registers.ebx: 5677692
registers.esi: 2147944122
registers.ecx: 308783087

Performs some HTTP requests (1 event)

request

GET http://will.kasraz.com/a/pdf.exe

Allocates read-write-execute memory (usually to unpack itself) (37 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x2fca1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x64ac1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f4c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f5de000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x64d0e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x63aa1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6400a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75738000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ef1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73821000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bd0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72992000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bd0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c71000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72021000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7079f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7079f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73db1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73361000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73711000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ea0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04eb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06251000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ec61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ec64000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:08 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x507c1000 process_handle: 0xffffffff	1

An application raised an exception which may be indicative of an exploit crash (3 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process WINWORD.EXE with pid 5192 crashed
__exception__ May 5, 2021, 10:08 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68 wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0 DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232 DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206 DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6 DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6 DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e wdCommandDispatch+0x3f3be7 DllCanUnloadNow-0xd94e6 wwlib+0x7d4e5c @ 0x65294e5c DllGetClassObject+0x9b035 DllGetLCID-0x1c084b wwlib+0x9fc7f @ 0x64b5fc7f DllGetClassObject+0x9ac3c DllGetLCID-0x1c0c44 wwlib+0x9f886 @ 0x64b5f886 DllGetClassObject+0x9a90c DllGetLCID-0x1c0f74 wwlib+0x9f556 @ 0x64b5f556 DllGetClassObject+0x115ef3 DllGetLCID-0x14598d wwlib+0x11ab3d @ 0x64bdab3d DllGetClassObject+0x11457c DllGetLCID-0x147304 wwlib+0x1191c6 @ 0x64bd91c6 DllGetClassObject+0x115894 DllGetLCID-0x145fec wwlib+0x11a4de @ 0x64bda4de DllCanUnloadNow+0x127d65 wwlib+0x9d60a7 @ 0x654960a7 wdCommandDispatch+0x3e89b2 DllCanUnloadNow-0xe471b wwlib+0x7c9c27 @ 0x65289c27 DllCanUnloadNow+0x395760 wwlib+0xc43aa2 @ 0x65703aa2 DllCanUnloadNow+0x395b92 wwlib+0xc43ed4 @ 0x65703ed4 DllGetClassObject+0x5ed15 DllGetLCID-0x1fcb6b wwlib+0x6395f @ 0x64b2395f DllGetClassObject+0x78b76 DllGetLCID-0x1e2d0a wwlib+0x7d7c0 @ 0x64b3d7c0 DllGetClassObject+0x5db61 DllGetLCID-0x1fdd1f wwlib+0x627ab @ 0x64b227ab FMain+0x6ac DllGetClassObject-0x3c wwlib+0x4c0e @ 0x64ac4c0e wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fca15d7 wdCommandDispatch-0x367 winword+0x155d @ 0x2fca155d BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706be exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 2963612 registers.edi: 1957755408 registers.eax: 2963612 registers.ebp: 2963692 registers.edx: 2130566132 registers.ebx: 5678196 registers.esi: 2147944126 registers.ecx: 308783087	1	0	0
__exception__ May 5, 2021, 10:08 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641 CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172 CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6 OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68 wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0 DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232 DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206 DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6 DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6 DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e wdCommandDispatch+0x3f3be7 DllCanUnloadNow-0xd94e6 wwlib+0x7d4e5c @ 0x65294e5c DllGetClassObject+0x9b035 DllGetLCID-0x1c084b wwlib+0x9fc7f @ 0x64b5fc7f DllGetClassObject+0x9ac3c DllGetLCID-0x1c0c44 wwlib+0x9f886 @ 0x64b5f886 DllGetClassObject+0x9a90c DllGetLCID-0x1c0f74 wwlib+0x9f556 @ 0x64b5f556 DllGetClassObject+0x115ef3 DllGetLCID-0x14598d wwlib+0x11ab3d @ 0x64bdab3d DllGetClassObject+0x11457c DllGetLCID-0x147304 wwlib+0x1191c6 @ 0x64bd91c6 DllGetClassObject+0x115894 DllGetLCID-0x145fec wwlib+0x11a4de @ 0x64bda4de DllCanUnloadNow+0x127d65 wwlib+0x9d60a7 @ 0x654960a7 wdCommandDispatch+0x3e89b2 DllCanUnloadNow-0xe471b wwlib+0x7c9c27 @ 0x65289c27 DllCanUnloadNow+0x395760 wwlib+0xc43aa2 @ 0x65703aa2 DllCanUnloadNow+0x395b92 wwlib+0xc43ed4 @ 0x65703ed4 DllGetClassObject+0x5ed15 DllGetLCID-0x1fcb6b wwlib+0x6395f @ 0x64b2395f DllGetClassObject+0x78b76 DllGetLCID-0x1e2d0a wwlib+0x7d7c0 @ 0x64b3d7c0 DllGetClassObject+0x5db61 DllGetLCID-0x1fdd1f wwlib+0x627ab @ 0x64b227ab FMain+0x6ac DllGetClassObject-0x3c wwlib+0x4c0e @ 0x64ac4c0e wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fca15d7 wdCommandDispatch-0x367 winword+0x155d @ 0x2fca155d BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706ba exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 2963304 registers.edi: 1957755408 registers.eax: 2963304 registers.ebp: 2963384 registers.edx: 2130566132 registers.ebx: 5677692 registers.esi: 2147944122 registers.ecx: 308783087	1	0	0

Application Crash

Process WINWORD.EXE with pid 5192 crashed

Time & API

Arguments

Status

Return

Repeated

__exception__

May 5, 2021, 10:08 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
wdCommandDispatch+0x3f3be7 DllCanUnloadNow-0xd94e6 wwlib+0x7d4e5c @ 0x65294e5c
DllGetClassObject+0x9b035 DllGetLCID-0x1c084b wwlib+0x9fc7f @ 0x64b5fc7f
DllGetClassObject+0x9ac3c DllGetLCID-0x1c0c44 wwlib+0x9f886 @ 0x64b5f886
DllGetClassObject+0x9a90c DllGetLCID-0x1c0f74 wwlib+0x9f556 @ 0x64b5f556
DllGetClassObject+0x115ef3 DllGetLCID-0x14598d wwlib+0x11ab3d @ 0x64bdab3d
DllGetClassObject+0x11457c DllGetLCID-0x147304 wwlib+0x1191c6 @ 0x64bd91c6
DllGetClassObject+0x115894 DllGetLCID-0x145fec wwlib+0x11a4de @ 0x64bda4de
DllCanUnloadNow+0x127d65 wwlib+0x9d60a7 @ 0x654960a7
wdCommandDispatch+0x3e89b2 DllCanUnloadNow-0xe471b wwlib+0x7c9c27 @ 0x65289c27
DllCanUnloadNow+0x395760 wwlib+0xc43aa2 @ 0x65703aa2
DllCanUnloadNow+0x395b92 wwlib+0xc43ed4 @ 0x65703ed4
DllGetClassObject+0x5ed15 DllGetLCID-0x1fcb6b wwlib+0x6395f @ 0x64b2395f
DllGetClassObject+0x78b76 DllGetLCID-0x1e2d0a wwlib+0x7d7c0 @ 0x64b3d7c0
DllGetClassObject+0x5db61 DllGetLCID-0x1fdd1f wwlib+0x627ab @ 0x64b227ab
FMain+0x6ac DllGetClassObject-0x3c wwlib+0x4c0e @ 0x64ac4c0e
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fca15d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fca155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

__exception__

May 5, 2021, 10:08 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
wdCommandDispatch+0x3f3be7 DllCanUnloadNow-0xd94e6 wwlib+0x7d4e5c @ 0x65294e5c
DllGetClassObject+0x9b035 DllGetLCID-0x1c084b wwlib+0x9fc7f @ 0x64b5fc7f
DllGetClassObject+0x9ac3c DllGetLCID-0x1c0c44 wwlib+0x9f886 @ 0x64b5f886
DllGetClassObject+0x9a90c DllGetLCID-0x1c0f74 wwlib+0x9f556 @ 0x64b5f556
DllGetClassObject+0x115ef3 DllGetLCID-0x14598d wwlib+0x11ab3d @ 0x64bdab3d
DllGetClassObject+0x11457c DllGetLCID-0x147304 wwlib+0x1191c6 @ 0x64bd91c6
DllGetClassObject+0x115894 DllGetLCID-0x145fec wwlib+0x11a4de @ 0x64bda4de
DllCanUnloadNow+0x127d65 wwlib+0x9d60a7 @ 0x654960a7
wdCommandDispatch+0x3e89b2 DllCanUnloadNow-0xe471b wwlib+0x7c9c27 @ 0x65289c27
DllCanUnloadNow+0x395760 wwlib+0xc43aa2 @ 0x65703aa2
DllCanUnloadNow+0x395b92 wwlib+0xc43ed4 @ 0x65703ed4
DllGetClassObject+0x5ed15 DllGetLCID-0x1fcb6b wwlib+0x6395f @ 0x64b2395f
DllGetClassObject+0x78b76 DllGetLCID-0x1e2d0a wwlib+0x7d7c0 @ 0x64b3d7c0
DllGetClassObject+0x5db61 DllGetLCID-0x1fdd1f wwlib+0x627ab @ 0x64b227ab
FMain+0x6ac DllGetClassObject-0x3c wwlib+0x4c0e @ 0x64ac4c0e
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fca15d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fca155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 2963304
registers.edi: 1957755408
registers.eax: 2963304
registers.ebp: 2963384
registers.edx: 2130566132
registers.ebx: 5677692
registers.esi: 2147944122
registers.ecx: 308783087

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Creates hidden or system file (2 events)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile May 5, 2021, 10:08 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000002c8 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0
NtCreateFile May 5, 2021, 10:08 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000004ac filepath: C:\Users\test22\AppData\Local\Temp\~$d.dot desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$d.dot create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

DrWeb	Exploit.Rtf.Obfuscated.32
MicroWorld-eScan	Exploit.RTF-ObfsStrm.Gen
FireEye	Exploit.RTF-ObfsStrm.Gen
Sangfor	Malware.Generic-RTF.Save.c5a892ae
K7AntiVirus	Trojan ( 0057b3a91 )
K7GW	Trojan ( 0057b3a91 )
Symantec	Bloodhound.RTF.20
ESET-NOD32	a variant of DOC/Abnormal.B
BitDefender	Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus	Exploit.Rtf.Heuristic-rtf.dinbqn
Ad-Aware	Exploit.RTF-ObfsStrm.Gen
Emsisoft	Exploit.RTF-ObfsStrm.Gen (B)
TrendMicro	HEUR_RTFMALFORM
Sophos	Troj/RtfExp-EQ
Ikarus	Exploit.CVE-2017-11882
Avira	HEUR/Rtf.Malformed
GData	Exploit.RTF-ObfsStrm.Gen
Cynet	Malicious (score: 99)
AhnLab-V3	RTF/Malform-A.Gen
TACHYON	Trojan-Exploit/RTF.CVE-2017-11882
Zoner	Probably Heur.RTFBadHeader
MAX	malware (ai score=89)
Fortinet	RTF/CVE_2017_11882.C!exploit

d.dot

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All