Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 23, 2021, 7:36 a.m.	July 23, 2021, 7:38 a.m.

Size	8.1KB
Type	Non-ISO extended-ASCII text, with very long lines, with CRLF, CR, LF line terminators
MD5	`692b9a77e63307d2c41cd2844b3f4cb3`
SHA256	`1c827d9bbc92504fa45287480f8ca1dcd5705dcad416f6b7669d60904a8bc49f`
CRC32	`6836C69F`
ssdeep	`192:390nKyu5A4coYFN9AwwOrHCEaO87kvEia66wJmG/oqCL1PG+dtrrta+uD:t0iOocNHbrH4TiEiRhN/oz1PtbrrruD`
Yara	Rich_Text_Format_Zero - Rich Text Format Signature Zero

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "nzJzzYFfc" C:\Users\test22\AppData\Local\Temp\wiz....wiz.wiz
2056
- WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n /f "C:\Users\test22\AppData\Local\Temp\wiz....wiz.wiz"
  2188
  - splwow64.exe C:\Windows\splwow64.exe 12288
    2584

Name	Response	Post-Analysis Lookup
www.kolpath.com
www.coolsoftware.xyz	A 66.96.162.134	66.96.162.134
www.janinefowler.com	A 154.88.252.76	154.88.252.76
www.christcarriers.com

IP Address	Status	Action
154.88.252.76	Active	Moloch
164.124.101.2	Active	Moloch
198.46.201.115	Active	Moloch
66.96.162.134	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49165 -> 198.46.201.115:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.102:49165 -> 198.46.201.115:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 198.46.201.115:80 -> 192.168.56.102:49165	2022050	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1	A Network Trojan was detected
TCP 198.46.201.115:80 -> 192.168.56.102:49165	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 198.46.201.115:80 -> 192.168.56.102:49165	2022051	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2	A Network Trojan was detected
TCP 198.46.201.115:80 -> 192.168.56.102:49165	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.102:49178 -> 66.96.162.134:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 66.96.162.134:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 66.96.162.134:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 66.96.162.134:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (18 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0
IsDebuggerPresent July 23, 2021, 7:36 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptGenKey July 23, 2021, 7:36 a.m.	crypto_handle: 0x005b0820 algorithm_identifier: 0x00006610 () flags: 1 key: f @¡Öjs4bñ¨$Y7Í(# ]8qERþQ¥Ê¶^ä provider_handle: 0x005ab198	1	1
CryptExportKey July 23, 2021, 7:36 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b0820 flags: 0 crypto_export_handle: 0x005b00a0 blob_type: 1	1	1
CryptExportKey July 23, 2021, 7:36 a.m.	buffer: f¤³¯åù_Uã* ó%þ3ì^g£±L«CÖHöwyµU¿YÒ>õáâîhPþ-;ºlÆÞ¦dÈY%1p"¬S-^Èl§8çéNyG ¶AmôÌ§;%ï·{²Kth»KÏCÁ crypto_handle: 0x005b0820 flags: 0 crypto_export_handle: 0x005b00a0 blob_type: 1	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (4 events)

registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Registration\{FDF3ECB9-B56F-43B2-A9B8-1B48B6BAE1A7}\DigitalProductID
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Registration\{191301D3-A579-428C-B0C7-D7988500F9E3}\DigitalProductID
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}\DigitalProductID
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Registration\{6F327760-8C5C-417C-9B61-836A98287E0C}\DigitalProductID

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 23, 2021, 7:29 a.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 23, 2021, 7:36 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x765a374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x763df725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x765b414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x763dc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x762d98ad OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x76321414 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x76337b68 wdGetApplicationObject+0x692e4 wdCommandDispatch-0xec808 wwlib+0xb0515a @ 0x7274515a DllGetLCID+0x46ee14 wdGetApplicationObject-0x41f66c wwlib+0x67c80a @ 0x722bc80a DllGetLCID+0x431abf wdGetApplicationObject-0x45c9c1 wwlib+0x63f4b5 @ 0x7227f4b5 DllGetLCID+0x41dc02 wdGetApplicationObject-0x47087e wwlib+0x62b5f8 @ 0x7226b5f8 DllGetLCID+0x41c431 wdGetApplicationObject-0x47204f wwlib+0x629e27 @ 0x72269e27 DllGetLCID+0x46bf56 wdGetApplicationObject-0x42252a wwlib+0x67994c @ 0x722b994c DllGetLCID+0x46ba40 wdGetApplicationObject-0x422a40 wwlib+0x679436 @ 0x722b9436 _GetAllocCounters@0+0x1ed526 DllGetLCID-0x9708 wwlib+0x2042ee @ 0x71e442ee _GetAllocCounters@0+0x1bc92 DllGetLCID-0x1daf9c wwlib+0x32a5a @ 0x71c72a5a DllGetLCID+0x492af wdGetApplicationObject-0x8451d1 wwlib+0x256ca5 @ 0x71e96ca5 DllGetLCID+0x3bdb6 wdGetApplicationObject-0x8526ca wwlib+0x2497ac @ 0x71e897ac DllGetLCID+0x1f98de wdGetApplicationObject-0x694ba2 wwlib+0x4072d4 @ 0x720472d4 _GetAllocCounters@0+0x6fbf0 DllGetLCID-0x18703e wwlib+0x869b8 @ 0x71cc69b8 _GetAllocCounters@0+0x6f64e DllGetLCID-0x1875e0 wwlib+0x86416 @ 0x71cc6416 _GetAllocCounters@0+0x6f5c0 DllGetLCID-0x18766e wwlib+0x86388 @ 0x71cc6388 _GetAllocCounters@0+0x6f46f DllGetLCID-0x1877bf wwlib+0x86237 @ 0x71cc6237 DllGetLCID+0xafc7 wdGetApplicationObject-0x8834b9 wwlib+0x2189bd @ 0x71e589bd DllGetLCID+0xacb1 wdGetApplicationObject-0x8837cf wwlib+0x2186a7 @ 0x71e586a7 DllGetLCID+0xab15 wdGetApplicationObject-0x88396b wwlib+0x21850b @ 0x71e5850b DllGetLCID+0x34c0b5 wdGetApplicationObject-0x5423cb wwlib+0x559aab @ 0x72199aab DllGetLCID+0x321 wdGetApplicationObject-0x88e15f wwlib+0x20dd17 @ 0x71e4dd17 DllGetClassObject+0x29ea _GetAllocCounters@0-0xee02 wwlib+0x7fc6 @ 0x71c47fc6 FMain+0x245 DllGetClassObject-0x2a0 wwlib+0x533c @ 0x71c4533c wdCommandDispatch-0x964 winword+0x1602 @ 0x2f0d1602 wdCommandDispatch-0x9cc winword+0x159a @ 0x2f0d159a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706be exception.offset: 46887 exception.address: 0x748ab727 registers.esp: 1884024 registers.edi: 1982790160 registers.eax: 1884024 registers.ebp: 1884104 registers.edx: 2130566132 registers.ebx: 5881396 registers.esi: 2147944126 registers.ecx: 3477732800	1	0	0
__exception__ July 23, 2021, 7:36 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x765a374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x763df725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x765b414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x763dc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x762d98ad CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x762db641 CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x762db5ed CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x762db172 CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x762da66e ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x7635a68c ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x763377e6 OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x763214b7 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x76337b68 wdGetApplicationObject+0x692e4 wdCommandDispatch-0xec808 wwlib+0xb0515a @ 0x7274515a DllGetLCID+0x46ee14 wdGetApplicationObject-0x41f66c wwlib+0x67c80a @ 0x722bc80a DllGetLCID+0x431abf wdGetApplicationObject-0x45c9c1 wwlib+0x63f4b5 @ 0x7227f4b5 DllGetLCID+0x41dc02 wdGetApplicationObject-0x47087e wwlib+0x62b5f8 @ 0x7226b5f8 DllGetLCID+0x41c431 wdGetApplicationObject-0x47204f wwlib+0x629e27 @ 0x72269e27 DllGetLCID+0x46bf56 wdGetApplicationObject-0x42252a wwlib+0x67994c @ 0x722b994c DllGetLCID+0x46ba40 wdGetApplicationObject-0x422a40 wwlib+0x679436 @ 0x722b9436 _GetAllocCounters@0+0x1ed526 DllGetLCID-0x9708 wwlib+0x2042ee @ 0x71e442ee _GetAllocCounters@0+0x1bc92 DllGetLCID-0x1daf9c wwlib+0x32a5a @ 0x71c72a5a DllGetLCID+0x492af wdGetApplicationObject-0x8451d1 wwlib+0x256ca5 @ 0x71e96ca5 DllGetLCID+0x3bdb6 wdGetApplicationObject-0x8526ca wwlib+0x2497ac @ 0x71e897ac DllGetLCID+0x1f98de wdGetApplicationObject-0x694ba2 wwlib+0x4072d4 @ 0x720472d4 _GetAllocCounters@0+0x6fbf0 DllGetLCID-0x18703e wwlib+0x869b8 @ 0x71cc69b8 _GetAllocCounters@0+0x6f64e DllGetLCID-0x1875e0 wwlib+0x86416 @ 0x71cc6416 _GetAllocCounters@0+0x6f5c0 DllGetLCID-0x18766e wwlib+0x86388 @ 0x71cc6388 _GetAllocCounters@0+0x6f46f DllGetLCID-0x1877bf wwlib+0x86237 @ 0x71cc6237 DllGetLCID+0xafc7 wdGetApplicationObject-0x8834b9 wwlib+0x2189bd @ 0x71e589bd DllGetLCID+0xacb1 wdGetApplicationObject-0x8837cf wwlib+0x2186a7 @ 0x71e586a7 DllGetLCID+0xab15 wdGetApplicationObject-0x88396b wwlib+0x21850b @ 0x71e5850b DllGetLCID+0x34c0b5 wdGetApplicationObject-0x5423cb wwlib+0x559aab @ 0x72199aab DllGetLCID+0x321 wdGetApplicationObject-0x88e15f wwlib+0x20dd17 @ 0x71e4dd17 DllGetClassObject+0x29ea _GetAllocCounters@0-0xee02 wwlib+0x7fc6 @ 0x71c47fc6 FMain+0x245 DllGetClassObject-0x2a0 wwlib+0x533c @ 0x71c4533c wdCommandDispatch-0x964 winword+0x1602 @ 0x2f0d1602 wdCommandDispatch-0x9cc winword+0x159a @ 0x2f0d159a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706ba exception.offset: 46887 exception.address: 0x748ab727 registers.esp: 1883716 registers.edi: 1982790160 registers.eax: 1883716 registers.ebp: 1883796 registers.edx: 2130566132 registers.ebx: 5880892 registers.esi: 2147944122 registers.ecx: 3477732800	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

July 23, 2021, 7:36 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x765a374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x763df725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x765b414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x763dc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x762d98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x76321414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x76337b68
wdGetApplicationObject+0x692e4 wdCommandDispatch-0xec808 wwlib+0xb0515a @ 0x7274515a
DllGetLCID+0x46ee14 wdGetApplicationObject-0x41f66c wwlib+0x67c80a @ 0x722bc80a
DllGetLCID+0x431abf wdGetApplicationObject-0x45c9c1 wwlib+0x63f4b5 @ 0x7227f4b5
DllGetLCID+0x41dc02 wdGetApplicationObject-0x47087e wwlib+0x62b5f8 @ 0x7226b5f8
DllGetLCID+0x41c431 wdGetApplicationObject-0x47204f wwlib+0x629e27 @ 0x72269e27
DllGetLCID+0x46bf56 wdGetApplicationObject-0x42252a wwlib+0x67994c @ 0x722b994c
DllGetLCID+0x46ba40 wdGetApplicationObject-0x422a40 wwlib+0x679436 @ 0x722b9436
_GetAllocCounters@0+0x1ed526 DllGetLCID-0x9708 wwlib+0x2042ee @ 0x71e442ee
_GetAllocCounters@0+0x1bc92 DllGetLCID-0x1daf9c wwlib+0x32a5a @ 0x71c72a5a
DllGetLCID+0x492af wdGetApplicationObject-0x8451d1 wwlib+0x256ca5 @ 0x71e96ca5
DllGetLCID+0x3bdb6 wdGetApplicationObject-0x8526ca wwlib+0x2497ac @ 0x71e897ac
DllGetLCID+0x1f98de wdGetApplicationObject-0x694ba2 wwlib+0x4072d4 @ 0x720472d4
_GetAllocCounters@0+0x6fbf0 DllGetLCID-0x18703e wwlib+0x869b8 @ 0x71cc69b8
_GetAllocCounters@0+0x6f64e DllGetLCID-0x1875e0 wwlib+0x86416 @ 0x71cc6416
_GetAllocCounters@0+0x6f5c0 DllGetLCID-0x18766e wwlib+0x86388 @ 0x71cc6388
_GetAllocCounters@0+0x6f46f DllGetLCID-0x1877bf wwlib+0x86237 @ 0x71cc6237
DllGetLCID+0xafc7 wdGetApplicationObject-0x8834b9 wwlib+0x2189bd @ 0x71e589bd
DllGetLCID+0xacb1 wdGetApplicationObject-0x8837cf wwlib+0x2186a7 @ 0x71e586a7
DllGetLCID+0xab15 wdGetApplicationObject-0x88396b wwlib+0x21850b @ 0x71e5850b
DllGetLCID+0x34c0b5 wdGetApplicationObject-0x5423cb wwlib+0x559aab @ 0x72199aab
DllGetLCID+0x321 wdGetApplicationObject-0x88e15f wwlib+0x20dd17 @ 0x71e4dd17
DllGetClassObject+0x29ea _GetAllocCounters@0-0xee02 wwlib+0x7fc6 @ 0x71c47fc6
FMain+0x245 DllGetClassObject-0x2a0 wwlib+0x533c @ 0x71c4533c
wdCommandDispatch-0x964 winword+0x1602 @ 0x2f0d1602
wdCommandDispatch-0x9cc winword+0x159a @ 0x2f0d159a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x748ab727
registers.esp: 1884024
registers.edi: 1982790160
registers.eax: 1884024
registers.ebp: 1884104
registers.edx: 2130566132
registers.ebx: 5881396
registers.esi: 2147944126
registers.ecx: 3477732800

__exception__

July 23, 2021, 7:36 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x765a374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x763df725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x765b414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x763dc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x762d98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x762db641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x762db5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x762db172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x762da66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x7635a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x763377e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x763214b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x76337b68
wdGetApplicationObject+0x692e4 wdCommandDispatch-0xec808 wwlib+0xb0515a @ 0x7274515a
DllGetLCID+0x46ee14 wdGetApplicationObject-0x41f66c wwlib+0x67c80a @ 0x722bc80a
DllGetLCID+0x431abf wdGetApplicationObject-0x45c9c1 wwlib+0x63f4b5 @ 0x7227f4b5
DllGetLCID+0x41dc02 wdGetApplicationObject-0x47087e wwlib+0x62b5f8 @ 0x7226b5f8
DllGetLCID+0x41c431 wdGetApplicationObject-0x47204f wwlib+0x629e27 @ 0x72269e27
DllGetLCID+0x46bf56 wdGetApplicationObject-0x42252a wwlib+0x67994c @ 0x722b994c
DllGetLCID+0x46ba40 wdGetApplicationObject-0x422a40 wwlib+0x679436 @ 0x722b9436
_GetAllocCounters@0+0x1ed526 DllGetLCID-0x9708 wwlib+0x2042ee @ 0x71e442ee
_GetAllocCounters@0+0x1bc92 DllGetLCID-0x1daf9c wwlib+0x32a5a @ 0x71c72a5a
DllGetLCID+0x492af wdGetApplicationObject-0x8451d1 wwlib+0x256ca5 @ 0x71e96ca5
DllGetLCID+0x3bdb6 wdGetApplicationObject-0x8526ca wwlib+0x2497ac @ 0x71e897ac
DllGetLCID+0x1f98de wdGetApplicationObject-0x694ba2 wwlib+0x4072d4 @ 0x720472d4
_GetAllocCounters@0+0x6fbf0 DllGetLCID-0x18703e wwlib+0x869b8 @ 0x71cc69b8
_GetAllocCounters@0+0x6f64e DllGetLCID-0x1875e0 wwlib+0x86416 @ 0x71cc6416
_GetAllocCounters@0+0x6f5c0 DllGetLCID-0x18766e wwlib+0x86388 @ 0x71cc6388
_GetAllocCounters@0+0x6f46f DllGetLCID-0x1877bf wwlib+0x86237 @ 0x71cc6237
DllGetLCID+0xafc7 wdGetApplicationObject-0x8834b9 wwlib+0x2189bd @ 0x71e589bd
DllGetLCID+0xacb1 wdGetApplicationObject-0x8837cf wwlib+0x2186a7 @ 0x71e586a7
DllGetLCID+0xab15 wdGetApplicationObject-0x88396b wwlib+0x21850b @ 0x71e5850b
DllGetLCID+0x34c0b5 wdGetApplicationObject-0x5423cb wwlib+0x559aab @ 0x72199aab
DllGetLCID+0x321 wdGetApplicationObject-0x88e15f wwlib+0x20dd17 @ 0x71e4dd17
DllGetClassObject+0x29ea _GetAllocCounters@0-0xee02 wwlib+0x7fc6 @ 0x71c47fc6
FMain+0x245 DllGetClassObject-0x2a0 wwlib+0x533c @ 0x71c4533c
wdCommandDispatch-0x964 winword+0x1602 @ 0x2f0d1602
wdCommandDispatch-0x9cc winword+0x159a @ 0x2f0d159a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x748ab727
registers.esp: 1883716
registers.edi: 1982790160
registers.eax: 1883716
registers.ebp: 1883796
registers.edx: 2130566132
registers.ebx: 5880892
registers.esi: 2147944122
registers.ecx: 3477732800

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	Connection to IP address				suspicious_request	GET http://198.46.201.115/wtw/vbc.exe
suspicious_features	GET method with no useragent header				suspicious_request	GET http://www.coolsoftware.xyz/wten/?sDHpw=YQt9JlyqEsy2zrcQF3zzmw0aOxu0yxWaCFutHTrEjUWV0OkSM2wwD3qrWZyzPL9w+FSV4RH+&Wr=LhnHM8XPu

Performs some HTTP requests (2 events)

request	GET http://198.46.201.115/wtw/vbc.exe
request	GET http://www.coolsoftware.xyz/wten/?sDHpw=YQt9JlyqEsy2zrcQF3zzmw0aOxu0yxWaCFutHTrEjUWV0OkSM2wwD3qrWZyzPL9w+FSV4RH+&Wr=LhnHM8XPu

Allocates read-write-execute memory (usually to unpack itself) (23 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x2f0d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7384c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70927000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71e2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 45056 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x706ad000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f920000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75078000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73651000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a659000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a659000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03bf0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x031b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x031d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x5fff0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x762a6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76434000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76433000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76435000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76433000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a3b3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2021, 7:36 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x66064000 process_handle: 0xffffffff	1

An application raised an exception which may be indicative of an exploit crash (3 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process WINWORD.EXE with pid 2188 crashed
__exception__ July 23, 2021, 7:36 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x765a374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x763df725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x765b414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x763dc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x762d98ad OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x76321414 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x76337b68 wdGetApplicationObject+0x692e4 wdCommandDispatch-0xec808 wwlib+0xb0515a @ 0x7274515a DllGetLCID+0x46ee14 wdGetApplicationObject-0x41f66c wwlib+0x67c80a @ 0x722bc80a DllGetLCID+0x431abf wdGetApplicationObject-0x45c9c1 wwlib+0x63f4b5 @ 0x7227f4b5 DllGetLCID+0x41dc02 wdGetApplicationObject-0x47087e wwlib+0x62b5f8 @ 0x7226b5f8 DllGetLCID+0x41c431 wdGetApplicationObject-0x47204f wwlib+0x629e27 @ 0x72269e27 DllGetLCID+0x46bf56 wdGetApplicationObject-0x42252a wwlib+0x67994c @ 0x722b994c DllGetLCID+0x46ba40 wdGetApplicationObject-0x422a40 wwlib+0x679436 @ 0x722b9436 _GetAllocCounters@0+0x1ed526 DllGetLCID-0x9708 wwlib+0x2042ee @ 0x71e442ee _GetAllocCounters@0+0x1bc92 DllGetLCID-0x1daf9c wwlib+0x32a5a @ 0x71c72a5a DllGetLCID+0x492af wdGetApplicationObject-0x8451d1 wwlib+0x256ca5 @ 0x71e96ca5 DllGetLCID+0x3bdb6 wdGetApplicationObject-0x8526ca wwlib+0x2497ac @ 0x71e897ac DllGetLCID+0x1f98de wdGetApplicationObject-0x694ba2 wwlib+0x4072d4 @ 0x720472d4 _GetAllocCounters@0+0x6fbf0 DllGetLCID-0x18703e wwlib+0x869b8 @ 0x71cc69b8 _GetAllocCounters@0+0x6f64e DllGetLCID-0x1875e0 wwlib+0x86416 @ 0x71cc6416 _GetAllocCounters@0+0x6f5c0 DllGetLCID-0x18766e wwlib+0x86388 @ 0x71cc6388 _GetAllocCounters@0+0x6f46f DllGetLCID-0x1877bf wwlib+0x86237 @ 0x71cc6237 DllGetLCID+0xafc7 wdGetApplicationObject-0x8834b9 wwlib+0x2189bd @ 0x71e589bd DllGetLCID+0xacb1 wdGetApplicationObject-0x8837cf wwlib+0x2186a7 @ 0x71e586a7 DllGetLCID+0xab15 wdGetApplicationObject-0x88396b wwlib+0x21850b @ 0x71e5850b DllGetLCID+0x34c0b5 wdGetApplicationObject-0x5423cb wwlib+0x559aab @ 0x72199aab DllGetLCID+0x321 wdGetApplicationObject-0x88e15f wwlib+0x20dd17 @ 0x71e4dd17 DllGetClassObject+0x29ea _GetAllocCounters@0-0xee02 wwlib+0x7fc6 @ 0x71c47fc6 FMain+0x245 DllGetClassObject-0x2a0 wwlib+0x533c @ 0x71c4533c wdCommandDispatch-0x964 winword+0x1602 @ 0x2f0d1602 wdCommandDispatch-0x9cc winword+0x159a @ 0x2f0d159a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706be exception.offset: 46887 exception.address: 0x748ab727 registers.esp: 1884024 registers.edi: 1982790160 registers.eax: 1884024 registers.ebp: 1884104 registers.edx: 2130566132 registers.ebx: 5881396 registers.esi: 2147944126 registers.ecx: 3477732800	1	0	0
__exception__ July 23, 2021, 7:36 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x765a374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x763df725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x765b414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x763dc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x762d98ad CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x762db641 CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x762db5ed CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x762db172 CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x762da66e ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x7635a68c ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x763377e6 OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x763214b7 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x76337b68 wdGetApplicationObject+0x692e4 wdCommandDispatch-0xec808 wwlib+0xb0515a @ 0x7274515a DllGetLCID+0x46ee14 wdGetApplicationObject-0x41f66c wwlib+0x67c80a @ 0x722bc80a DllGetLCID+0x431abf wdGetApplicationObject-0x45c9c1 wwlib+0x63f4b5 @ 0x7227f4b5 DllGetLCID+0x41dc02 wdGetApplicationObject-0x47087e wwlib+0x62b5f8 @ 0x7226b5f8 DllGetLCID+0x41c431 wdGetApplicationObject-0x47204f wwlib+0x629e27 @ 0x72269e27 DllGetLCID+0x46bf56 wdGetApplicationObject-0x42252a wwlib+0x67994c @ 0x722b994c DllGetLCID+0x46ba40 wdGetApplicationObject-0x422a40 wwlib+0x679436 @ 0x722b9436 _GetAllocCounters@0+0x1ed526 DllGetLCID-0x9708 wwlib+0x2042ee @ 0x71e442ee _GetAllocCounters@0+0x1bc92 DllGetLCID-0x1daf9c wwlib+0x32a5a @ 0x71c72a5a DllGetLCID+0x492af wdGetApplicationObject-0x8451d1 wwlib+0x256ca5 @ 0x71e96ca5 DllGetLCID+0x3bdb6 wdGetApplicationObject-0x8526ca wwlib+0x2497ac @ 0x71e897ac DllGetLCID+0x1f98de wdGetApplicationObject-0x694ba2 wwlib+0x4072d4 @ 0x720472d4 _GetAllocCounters@0+0x6fbf0 DllGetLCID-0x18703e wwlib+0x869b8 @ 0x71cc69b8 _GetAllocCounters@0+0x6f64e DllGetLCID-0x1875e0 wwlib+0x86416 @ 0x71cc6416 _GetAllocCounters@0+0x6f5c0 DllGetLCID-0x18766e wwlib+0x86388 @ 0x71cc6388 _GetAllocCounters@0+0x6f46f DllGetLCID-0x1877bf wwlib+0x86237 @ 0x71cc6237 DllGetLCID+0xafc7 wdGetApplicationObject-0x8834b9 wwlib+0x2189bd @ 0x71e589bd DllGetLCID+0xacb1 wdGetApplicationObject-0x8837cf wwlib+0x2186a7 @ 0x71e586a7 DllGetLCID+0xab15 wdGetApplicationObject-0x88396b wwlib+0x21850b @ 0x71e5850b DllGetLCID+0x34c0b5 wdGetApplicationObject-0x5423cb wwlib+0x559aab @ 0x72199aab DllGetLCID+0x321 wdGetApplicationObject-0x88e15f wwlib+0x20dd17 @ 0x71e4dd17 DllGetClassObject+0x29ea _GetAllocCounters@0-0xee02 wwlib+0x7fc6 @ 0x71c47fc6 FMain+0x245 DllGetClassObject-0x2a0 wwlib+0x533c @ 0x71c4533c wdCommandDispatch-0x964 winword+0x1602 @ 0x2f0d1602 wdCommandDispatch-0x9cc winword+0x159a @ 0x2f0d159a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706ba exception.offset: 46887 exception.address: 0x748ab727 registers.esp: 1883716 registers.edi: 1982790160 registers.eax: 1883716 registers.ebp: 1883796 registers.edx: 2130566132 registers.ebx: 5880892 registers.esi: 2147944122 registers.ecx: 3477732800	1	0	0

Application Crash

Process WINWORD.EXE with pid 2188 crashed

Time & API

Arguments

Status

Return

Repeated

__exception__

July 23, 2021, 7:36 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x765a374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x763df725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x765b414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x763dc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x762d98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x76321414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x76337b68
wdGetApplicationObject+0x692e4 wdCommandDispatch-0xec808 wwlib+0xb0515a @ 0x7274515a
DllGetLCID+0x46ee14 wdGetApplicationObject-0x41f66c wwlib+0x67c80a @ 0x722bc80a
DllGetLCID+0x431abf wdGetApplicationObject-0x45c9c1 wwlib+0x63f4b5 @ 0x7227f4b5
DllGetLCID+0x41dc02 wdGetApplicationObject-0x47087e wwlib+0x62b5f8 @ 0x7226b5f8
DllGetLCID+0x41c431 wdGetApplicationObject-0x47204f wwlib+0x629e27 @ 0x72269e27
DllGetLCID+0x46bf56 wdGetApplicationObject-0x42252a wwlib+0x67994c @ 0x722b994c
DllGetLCID+0x46ba40 wdGetApplicationObject-0x422a40 wwlib+0x679436 @ 0x722b9436
_GetAllocCounters@0+0x1ed526 DllGetLCID-0x9708 wwlib+0x2042ee @ 0x71e442ee
_GetAllocCounters@0+0x1bc92 DllGetLCID-0x1daf9c wwlib+0x32a5a @ 0x71c72a5a
DllGetLCID+0x492af wdGetApplicationObject-0x8451d1 wwlib+0x256ca5 @ 0x71e96ca5
DllGetLCID+0x3bdb6 wdGetApplicationObject-0x8526ca wwlib+0x2497ac @ 0x71e897ac
DllGetLCID+0x1f98de wdGetApplicationObject-0x694ba2 wwlib+0x4072d4 @ 0x720472d4
_GetAllocCounters@0+0x6fbf0 DllGetLCID-0x18703e wwlib+0x869b8 @ 0x71cc69b8
_GetAllocCounters@0+0x6f64e DllGetLCID-0x1875e0 wwlib+0x86416 @ 0x71cc6416
_GetAllocCounters@0+0x6f5c0 DllGetLCID-0x18766e wwlib+0x86388 @ 0x71cc6388
_GetAllocCounters@0+0x6f46f DllGetLCID-0x1877bf wwlib+0x86237 @ 0x71cc6237
DllGetLCID+0xafc7 wdGetApplicationObject-0x8834b9 wwlib+0x2189bd @ 0x71e589bd
DllGetLCID+0xacb1 wdGetApplicationObject-0x8837cf wwlib+0x2186a7 @ 0x71e586a7
DllGetLCID+0xab15 wdGetApplicationObject-0x88396b wwlib+0x21850b @ 0x71e5850b
DllGetLCID+0x34c0b5 wdGetApplicationObject-0x5423cb wwlib+0x559aab @ 0x72199aab
DllGetLCID+0x321 wdGetApplicationObject-0x88e15f wwlib+0x20dd17 @ 0x71e4dd17
DllGetClassObject+0x29ea _GetAllocCounters@0-0xee02 wwlib+0x7fc6 @ 0x71c47fc6
FMain+0x245 DllGetClassObject-0x2a0 wwlib+0x533c @ 0x71c4533c
wdCommandDispatch-0x964 winword+0x1602 @ 0x2f0d1602
wdCommandDispatch-0x9cc winword+0x159a @ 0x2f0d159a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

__exception__

July 23, 2021, 7:36 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x765a374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x763df725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x765b414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x763dc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x762d98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x762db641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x762db5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x762db172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x762da66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x7635a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x763377e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x763214b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x76337b68
wdGetApplicationObject+0x692e4 wdCommandDispatch-0xec808 wwlib+0xb0515a @ 0x7274515a
DllGetLCID+0x46ee14 wdGetApplicationObject-0x41f66c wwlib+0x67c80a @ 0x722bc80a
DllGetLCID+0x431abf wdGetApplicationObject-0x45c9c1 wwlib+0x63f4b5 @ 0x7227f4b5
DllGetLCID+0x41dc02 wdGetApplicationObject-0x47087e wwlib+0x62b5f8 @ 0x7226b5f8
DllGetLCID+0x41c431 wdGetApplicationObject-0x47204f wwlib+0x629e27 @ 0x72269e27
DllGetLCID+0x46bf56 wdGetApplicationObject-0x42252a wwlib+0x67994c @ 0x722b994c
DllGetLCID+0x46ba40 wdGetApplicationObject-0x422a40 wwlib+0x679436 @ 0x722b9436
_GetAllocCounters@0+0x1ed526 DllGetLCID-0x9708 wwlib+0x2042ee @ 0x71e442ee
_GetAllocCounters@0+0x1bc92 DllGetLCID-0x1daf9c wwlib+0x32a5a @ 0x71c72a5a
DllGetLCID+0x492af wdGetApplicationObject-0x8451d1 wwlib+0x256ca5 @ 0x71e96ca5
DllGetLCID+0x3bdb6 wdGetApplicationObject-0x8526ca wwlib+0x2497ac @ 0x71e897ac
DllGetLCID+0x1f98de wdGetApplicationObject-0x694ba2 wwlib+0x4072d4 @ 0x720472d4
_GetAllocCounters@0+0x6fbf0 DllGetLCID-0x18703e wwlib+0x869b8 @ 0x71cc69b8
_GetAllocCounters@0+0x6f64e DllGetLCID-0x1875e0 wwlib+0x86416 @ 0x71cc6416
_GetAllocCounters@0+0x6f5c0 DllGetLCID-0x18766e wwlib+0x86388 @ 0x71cc6388
_GetAllocCounters@0+0x6f46f DllGetLCID-0x1877bf wwlib+0x86237 @ 0x71cc6237
DllGetLCID+0xafc7 wdGetApplicationObject-0x8834b9 wwlib+0x2189bd @ 0x71e589bd
DllGetLCID+0xacb1 wdGetApplicationObject-0x8837cf wwlib+0x2186a7 @ 0x71e586a7
DllGetLCID+0xab15 wdGetApplicationObject-0x88396b wwlib+0x21850b @ 0x71e5850b
DllGetLCID+0x34c0b5 wdGetApplicationObject-0x5423cb wwlib+0x559aab @ 0x72199aab
DllGetLCID+0x321 wdGetApplicationObject-0x88e15f wwlib+0x20dd17 @ 0x71e4dd17
DllGetClassObject+0x29ea _GetAllocCounters@0-0xee02 wwlib+0x7fc6 @ 0x71c47fc6
FMain+0x245 DllGetClassObject-0x2a0 wwlib+0x533c @ 0x71c4533c
wdCommandDispatch-0x964 winword+0x1602 @ 0x2f0d1602
wdCommandDispatch-0x9cc winword+0x159a @ 0x2f0d159a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x748ab727
registers.esp: 1883716
registers.edi: 1982790160
registers.eax: 1883716
registers.ebp: 1883796
registers.edx: 2130566132
registers.ebx: 5880892
registers.esi: 2147944122
registers.ecx: 3477732800

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Creates hidden or system file (2 events)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile July 23, 2021, 7:36 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x0000038c filepath: C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0
NtCreateFile July 23, 2021, 7:36 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x00000444 filepath: C:\Users\test22\AppData\Local\Temp\~$z....wiz.wiz desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$z....wiz.wiz create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

198.46.201.115

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

154.88.252.76:80

wiz....wiz.wiz

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All