popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

reason.xlsx

KeyLogger ScreenShot AntiVM MSOffice File AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 26, 2021, 10:53 a.m. Oct. 26, 2021, 10:55 a.m.
Size 280.5KB
Type CDFV2 Encrypted
MD5 9adafeb992d82eba6e4c5d1e420a48ef
SHA256 13a23f2531da55410645a2a8f0da7bdd86cd656f2dbf268ec8f3204261e8cf27
CRC32 7F00A5FA
ssdeep 3072:vcO6UjaoZvFL5vOK/VOcjpHgU+vsfq7vzQlHvEjz1oV/hEt2TheYN+PoxzqIeCt/:vMWZtUKEqKU+vPQlPEjRXtGNN+PuTJvr
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File

Name Response Post-Analysis Lookup
itisalllove.servepics.com
A 31.3.244.76
31.3.244.76
newme122.3utilities.com
A 23.105.131.228
23.105.131.228
newme1122.3utilities.com
IP Address Status Action
164.124.101.2 Active Moloch
23.105.131.228 Active Moloch
31.3.244.76 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:61479 -> 164.124.101.2:53 2028698 ET POLICY DNS Query to DynDNS Domain *.servepics .com Potentially Bad Traffic
UDP 192.168.56.101:55450 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:56887 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:62430 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:56977 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:50851 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:61673 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:60751 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:55667 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
TCP 31.3.244.76:80 -> 192.168.56.101:49205 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
UDP 192.168.56.101:62362 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:63951 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:59369 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:65329 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:62902 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:54657 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:63983 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:54056 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:50492 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:57460 -> 164.124.101.2:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:55629 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:63194 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:60820 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:61794 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\12.0\Registration\{90120000-0030-0000-0000-0000000FF1CE}\DigitalProductID
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
MdCallBack-0x620fb3 excel+0x3f4bb1 @ 0x2f894bb1
MdCallBack-0x842308 excel+0x1d385c @ 0x2f67385c
MdCallBack-0x86a796 excel+0x1ab3ce @ 0x2f64b3ce
MdCallBack-0x86e0e8 excel+0x1a7a7c @ 0x2f647a7c
MdCallBack-0x8ed1a3 excel+0x1289c1 @ 0x2f5c89c1
MdCallBack-0x8ecda1 excel+0x128dc3 @ 0x2f5c8dc3
MdCallBack-0x8eca85 excel+0x1290df @ 0x2f5c90df
MdCallBack-0x8eca2b excel+0x129139 @ 0x2f5c9139
MdCallBack-0x9e632f excel+0x2f835 @ 0x2f4cf835
MdCallBack-0xe2a93 excel+0x9330d1 @ 0x2fdd30d1
_LPenHelper+0x12cab2 DllGetLCID-0x13e001 excel+0xd0c398 @ 0x301ac398
MdCallBack-0x648e07 excel+0x3ccd5d @ 0x2f86cd5d
MdCallBack-0x9eeebe excel+0x26ca6 @ 0x2f4c6ca6
MdCallBack-0xa1208c excel+0x3ad8 @ 0x2f4a3ad8
MdCallBack-0xa12378 excel+0x37ec @ 0x2f4a37ec
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3110008
registers.edi: 1957755408
registers.eax: 3110008
registers.ebp: 3110088
registers.edx: 2130566132
registers.ebx: 6301268
registers.esi: 2147944126
registers.ecx: 261251448
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
MdCallBack-0x620fb3 excel+0x3f4bb1 @ 0x2f894bb1
MdCallBack-0x842308 excel+0x1d385c @ 0x2f67385c
MdCallBack-0x86a796 excel+0x1ab3ce @ 0x2f64b3ce
MdCallBack-0x86e0e8 excel+0x1a7a7c @ 0x2f647a7c
MdCallBack-0x8ed1a3 excel+0x1289c1 @ 0x2f5c89c1
MdCallBack-0x8ecda1 excel+0x128dc3 @ 0x2f5c8dc3
MdCallBack-0x8eca85 excel+0x1290df @ 0x2f5c90df
MdCallBack-0x8eca2b excel+0x129139 @ 0x2f5c9139
MdCallBack-0x9e632f excel+0x2f835 @ 0x2f4cf835
MdCallBack-0xe2a93 excel+0x9330d1 @ 0x2fdd30d1
_LPenHelper+0x12cab2 DllGetLCID-0x13e001 excel+0xd0c398 @ 0x301ac398
MdCallBack-0x648e07 excel+0x3ccd5d @ 0x2f86cd5d
MdCallBack-0x9eeebe excel+0x26ca6 @ 0x2f4c6ca6
MdCallBack-0xa1208c excel+0x3ad8 @ 0x2f4a3ad8
MdCallBack-0xa12378 excel+0x37ec @ 0x2f4a37ec
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3109700
registers.edi: 1957755408
registers.eax: 3109700
registers.ebp: 3109780
registers.edx: 2130566132
registers.ebx: 6298748
registers.esi: 2147944122
registers.ecx: 261251448
1 0 0
domain newme122.3utilities.com
domain newme1122.3utilities.com
request GET http://itisalllove.servepics.com/georgia/city/reason.exe
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x2f533000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6ee61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6f3ca000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75738000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72c41000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x723f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x723f2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x721c1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72215000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x724b1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72481000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72171000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2264
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x035a0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2264
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03680000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72162000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2264
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ef0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2264
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02f40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2264
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02520000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2264
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02570000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72461000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73361000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2264
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04170000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2264
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04170000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2264
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04280000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2264
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04290000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6dc71000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6dccf000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6dccf000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6dbb1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6dbb1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x736e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b3f1000
process_handle: 0xffffffff
1 0 0
Application Crash Process EXCEL.EXE with pid 2264 crashed
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
MdCallBack-0x620fb3 excel+0x3f4bb1 @ 0x2f894bb1
MdCallBack-0x842308 excel+0x1d385c @ 0x2f67385c
MdCallBack-0x86a796 excel+0x1ab3ce @ 0x2f64b3ce
MdCallBack-0x86e0e8 excel+0x1a7a7c @ 0x2f647a7c
MdCallBack-0x8ed1a3 excel+0x1289c1 @ 0x2f5c89c1
MdCallBack-0x8ecda1 excel+0x128dc3 @ 0x2f5c8dc3
MdCallBack-0x8eca85 excel+0x1290df @ 0x2f5c90df
MdCallBack-0x8eca2b excel+0x129139 @ 0x2f5c9139
MdCallBack-0x9e632f excel+0x2f835 @ 0x2f4cf835
MdCallBack-0xe2a93 excel+0x9330d1 @ 0x2fdd30d1
_LPenHelper+0x12cab2 DllGetLCID-0x13e001 excel+0xd0c398 @ 0x301ac398
MdCallBack-0x648e07 excel+0x3ccd5d @ 0x2f86cd5d
MdCallBack-0x9eeebe excel+0x26ca6 @ 0x2f4c6ca6
MdCallBack-0xa1208c excel+0x3ad8 @ 0x2f4a3ad8
MdCallBack-0xa12378 excel+0x37ec @ 0x2f4a37ec
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3110008
registers.edi: 1957755408
registers.eax: 3110008
registers.ebp: 3110088
registers.edx: 2130566132
registers.ebx: 6301268
registers.esi: 2147944126
registers.ecx: 261251448
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
MdCallBack-0x620fb3 excel+0x3f4bb1 @ 0x2f894bb1
MdCallBack-0x842308 excel+0x1d385c @ 0x2f67385c
MdCallBack-0x86a796 excel+0x1ab3ce @ 0x2f64b3ce
MdCallBack-0x86e0e8 excel+0x1a7a7c @ 0x2f647a7c
MdCallBack-0x8ed1a3 excel+0x1289c1 @ 0x2f5c89c1
MdCallBack-0x8ecda1 excel+0x128dc3 @ 0x2f5c8dc3
MdCallBack-0x8eca85 excel+0x1290df @ 0x2f5c90df
MdCallBack-0x8eca2b excel+0x129139 @ 0x2f5c9139
MdCallBack-0x9e632f excel+0x2f835 @ 0x2f4cf835
MdCallBack-0xe2a93 excel+0x9330d1 @ 0x2fdd30d1
_LPenHelper+0x12cab2 DllGetLCID-0x13e001 excel+0xd0c398 @ 0x301ac398
MdCallBack-0x648e07 excel+0x3ccd5d @ 0x2f86cd5d
MdCallBack-0x9eeebe excel+0x26ca6 @ 0x2f4c6ca6
MdCallBack-0xa1208c excel+0x3ad8 @ 0x2f4a3ad8
MdCallBack-0xa12378 excel+0x37ec @ 0x2f4a37ec
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3109700
registers.edi: 1957755408
registers.eax: 3109700
registers.ebp: 3109780
registers.edx: 2130566132
registers.ebx: 6298748
registers.esi: 2147944122
registers.ecx: 261251448
1 0 0
file C:\Users\test22\AppData\Local\Temp\~$reason.xlsx
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x0000043c
filepath: C:\Users\test22\AppData\Local\Temp\~$reason.xlsx
desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$reason.xlsx
create_options: 4198496 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_DELETE_ON_CLOSE)
status_info: 2 (FILE_CREATED)
share_access: 1 (FILE_SHARE_READ)
1 0 0
description Run a KeyLogger rule KeyLogger
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
cve CVE-2013-3906
dead_host 192.168.56.101:49213
dead_host 192.168.56.101:49212
dead_host 192.168.56.101:49210
dead_host 192.168.56.101:49211
dead_host 23.105.131.228:8822
dead_host 192.168.56.101:49209
dead_host 192.168.56.101:49215
dead_host 192.168.56.101:49217
dead_host 192.168.56.101:49214
dead_host 192.168.56.101:49216